code wiki / _hdl_build / nx_reader_sovereignty_gate.nx
`nx_reader_sovereignty_gate.nx` source

1// nx_reader_sovereignty_gate.nx -- mechanical proof the reader last-mile (reader.html) has ZERO third-party bleed
2// = the "hardware rung up" guarantee for the browser surface. The reader is the sanctioned last-mile HTML render;
3// this gate enforces, by construction, that it loads NOTHING from a 3rd party (no external <script src>, no CDN,
4// no external stylesheet/font, no <iframe>, no @import, no offsite src/href). All logic is inline + sovereign; the
5// only fetches are same-origin relative (/library/api/...). Standing regression guard so no future edit slips a
6// CDN dependency in. (Note: full compliance also wants reader.html EMITTED by a Nishi organ -- R-EMIT, the open
7// rung; this gate proves dependency-freeness, the substance.)  expect_exit: 0
8import "nx_syscalls.nx"
9import "nx_gate_verdict.nx"
10
11func sp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12func sn(v0: i64) -> i64 { var v: i64=v0; if v<0 { sys_write(1,"-" as *u8,1); v=0-v } let b: *u8=sys_mmap(24); var k: i64=0; if v==0 {b[0]=48 as u8;k=1} while v>0 {b[k]=(48+(v%10)) as u8; v=v/10; k=k+1} let o: *u8=sys_mmap(24); var j: i64=0; while j<k {o[j]=b[k-1-j];j=j+1} sys_write(1,o,k); return 0 }
13func sslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
14func sfind(hay: *u8, hl: i64, needle: *u8) -> i64 {
15    let nl: i64 = sslen(needle); if nl == 0 { return 0-1 }
16    var i: i64 = 0
17    while i + nl <= hl { var k: i64=0; var hit: i64=1; while k<nl { if hay[i+k]!=needle[k]{hit=0;k=nl}else{k=k+1} } if hit==1 {return i} i=i+1 }
18    return 0-1
19}
20func sabsent(hay: *u8, hl: i64, needle: *u8) -> i64 { if sfind(hay, hl, needle) < 0 { return 1 } return 0 }
21
22func main() -> i64 {
23    sp("=== nx_reader_sovereignty_gate: reader.html has zero 3rd-party bleed (hardware-rung-up last mile) ===\n" as *u8)
24    let lp: *i64 = sys_mmap(8) as *i64; lp[0] = 0
25    let h: *u8 = sys_read_file("knowledge/staging/media/reader.html\x00" as *u8, lp)
26    if (h as i64) == 0 { sp("READER-SOV verdict=RED reason=reader.html-missing\n" as *u8); sys_exit(1); return 1 }
27    let n: i64 = lp[0]
28    sp("  reader.html bytes=" as *u8); sn(n); sp("\n" as *u8)
29
30    var pass: i64 = 0; var fail: i64 = 0
31    // forbidden = any 3rd-party load. each must be ABSENT.
32    if sabsent(h, n, "<script src=" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL external-script\n" as *u8) }
33    if sabsent(h, n, "src=\"http" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL offsite-src\n" as *u8) }
34    if sabsent(h, n, "href=\"http" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL offsite-href\n" as *u8) }
35    if sabsent(h, n, "@import" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL css-import\n" as *u8) }
36    if sabsent(h, n, "<iframe" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL iframe\n" as *u8) }
37    if sabsent(h, n, "googleapis" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL googleapis-cdn\n" as *u8) }
38    if sabsent(h, n, "jsdelivr" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL jsdelivr-cdn\n" as *u8) }
39    if sabsent(h, n, "unpkg" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL unpkg-cdn\n" as *u8) }
40    if sabsent(h, n, "epub.js" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL epubjs-dep\n" as *u8) }
41    // TEETH: the search must actually work -- a known-present token is FOUND, a known-absent token is ABSENT.
42    if sfind(h, n, "function buildToc" as *u8) >= 0 { pass=pass+1 } else { fail=fail+1; sp("  FAIL search-finds-present\n" as *u8) }
43    if sabsent(h, n, "https://cdn.example.fake" as *u8) == 1 { pass=pass+1 } else { fail=fail+1; sp("  FAIL search-teeth\n" as *u8) }
44
45    sp("READER-SOV pass=" as *u8); sn(pass); sp(" fail=" as *u8); sn(fail)
46    // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
47    // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
48    // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
49    let ctr__dry: *i64 = gv_ctr()
50    ctr__dry[0] = pass
51    ctr__dry[1] = pass + fail
52    let rc__dry: i64 = gv_verdict("READER-SOVEREIGNTY-GATE" as *u8, ctr__dry, "last mile = 0 third-party loads; all logic inline + same-origin)" as *u8)
53    sys_exit(rc__dry)
54    return rc__dry
55}
nx_reader_sovereignty_gate.nx source

`nx_reader_sovereignty_gate.nx` source
