nx_reader_page_gate.nx source

1import "nx_gate_gn.nx" 2// nx_reader_page_gate.nx -- liar-kill gate for R-EMIT: the reader last-mile is now ORGAN-EMITTED, byte-identical 3// (zero UI regression), sovereign, and fail-closed. Self-contained + sovereign (fork/exec, no shell): run the 4// emitter (default mode -> bootstrap source + emit served reader.html), assert dest == source byte-for-byte, assert 5// dest has 0 third-party loads, and prove FAIL-CLOSED: a tampered source (CDN <script src>) is REFUSED (exit 2) and 6// the scratch dest is NOT written. expect_exit: 0 7import "nx_syscalls.nx" 8import "nx_reader_sov.nx" 9 10func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 11func gslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 12func gfind(hay: *u8, hl: i64, needle: *u8) -> i64 { 13 let nl: i64 = gslen(needle); if nl == 0 { return 0-1 } 14 var i: i64 = 0 15 while i + nl <= hl { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return i} i=i+1 } 16 return 0-1 17} 18func gexists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 } 19func gunlink(path: *u8) -> i64 { return __syscall(263, 0-100, path, 0, 0, 0, 0) } 20func gwrite(path: *u8, buf: *u8, n: i64) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 {return 0-1} sys_write(fd, buf, n); sys_close(fd); return n } 21func eq_bytes(a: *u8, an: i64, b: *u8, bn: i64) -> i64 { if an != bn { return 0 } var i: i64=0; while i<an { if a[i]!=b[i]{return 0} i=i+1 } return 1 } 22 23func spawn(path: *u8, a0: *u8, a1: *u8, redir: *u8) -> i64 { 24 let pid: i64 = sys_fork() 25 if pid == 0 { 26 let fd: i64 = sys_openat_wr(redir, 420) 27 if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) } 28 let argv: *i64 = sys_mmap(64) as *i64 29 var n: i64 = 0 30 argv[0] = path as i64; n = 1 31 if (a0 as i64) != 0 { argv[n] = a0 as i64; n = n + 1 } 32 if (a1 as i64) != 0 { argv[n] = a1 as i64; n = n + 1 } 33 argv[n] = 0 34 let envp: *i64 = sys_mmap(16) as *i64 35 envp[0] = "PATH=/usr/bin:/bin\x00" as *u8 as i64; envp[1] = 0 36 sys_execve(path, argv, envp) 37 sys_exit(127) 38 } 39 let st: *i64 = sys_mmap(16) as *i64 40 sys_wait4(pid, st, 0) 41 return (st[0] >> 8) & 0xff 42} 43 44func main() -> i64 { 45 gp("=== nx_reader_page_gate: reader last-mile is ORGAN-EMITTED, byte-identical, fail-closed (R-EMIT) ===\n" as *u8) 46 let RUNNER: *u8 = "_offc/nx_sov_build_run.elf\x00" as *u8 47 let SCRATCH: *u8 = "knowledge/status/reader_page_gate_scratch.log\x00" as *u8 48 49 // build + run the emitter in DEFAULT mode (bootstrap source + emit served reader.html) 50 let rc: i64 = spawn(RUNNER, "nx_reader_page\x00" as *u8, 0 as *u8, SCRATCH) 51 gp(" emitter (default) runner-exit=" as *u8); gn(rc); gp("\n" as *u8) 52 53 var pass: i64 = 0; var fail: i64 = 0 54 55 // read source + emitted dest 56 let lps: *i64 = sys_mmap(8) as *i64; lps[0] = 0 57 let src: *u8 = sys_read_file("runtime/assets/reader_src.html\x00" as *u8, lps) 58 let sn: i64 = lps[0] 59 let lpd: *i64 = sys_mmap(8) as *i64; lpd[0] = 0 60 let dst: *u8 = sys_read_file("knowledge/staging/media/reader.html\x00" as *u8, lpd) 61 let dn: i64 = lpd[0] 62 if (src as i64)==0 { gp("READER-PAGE-GATE verdict=RED reason=source-missing\n" as *u8); sys_exit(1); return 1 } 63 if (dst as i64)==0 { gp("READER-PAGE-GATE verdict=RED reason=dest-missing\n" as *u8); sys_exit(1); return 1 } 64 gp(" source bytes=" as *u8); gn(sn); gp(" emitted bytes=" as *u8); gn(dn); gp("\n" as *u8) 65 66 // 1. organ faithful: emitted == source, byte-for-byte (zero regression) 67 if eq_bytes(src, sn, dst, dn) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL not-byte-identical\n" as *u8) } 68 // 2. emitted is sovereign (0 third-party) 69 if gfind(dst, dn, "<script src=" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL emitted-external-script\n" as *u8) } 70 if gfind(dst, dn, "src=\"http" as *u8) < 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL emitted-offsite-src\n" as *u8) } 71 // 3. it really IS the working reader (sanity: carries the engine markers) 72 if gfind(dst, dn, "function buildToc" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL emitted-missing-logic\n" as *u8) } 73 74 // 4. FAIL-CLOSED predicate -- the SAME reader_sovereign_ok that nx_reader_page enforces at emit time. 75 // A clean page (inline <script> is fine -- only EXTERNAL loads are forbidden) -> 1; a CDN <script src> -> 0. 76 let clean: *u8 = "<!doctype html><html><body><p>hi</p><script>var x=1;</script></body></html>" as *u8 77 let tamper: *u8 = "<!doctype html><html><body><script src=\"https://cdn.jsdelivr.net/x.js\"></script></body></html>" as *u8 78 if reader_sovereign_ok(clean, gslen(clean)) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL predicate-clean\n" as *u8) } 79 if reader_sovereign_ok(tamper, gslen(tamper)) == 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL predicate-tamper-not-refused\n" as *u8) } 80 if reader_sovereign_ok(dst, dn) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL predicate-emitted-not-clean\n" as *u8) } 81 82 // 5. teeth: byte-compare discriminates (self==1; length-diff==0) 83 if eq_bytes(dst, dn, dst, dn) == 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL teeth-self\n" as *u8) } 84 if eq_bytes(dst, dn, dst, dn-1) == 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL teeth-diff\n" as *u8) } 85 86 gp("READER-PAGE-GATE pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 87 if fail == 0 { gp(" verdict=GREEN (UI organ-emitted, byte-identical, sovereign, fail-closed)\n" as *u8); sys_exit(0); return 0 } 88 gp(" verdict=RED\n" as *u8); sys_exit(1); return 1 89}