nx_recovery_guard_gate.nx source
↩ module page · 55 lines · 3446 B
1// nx_recovery_guard_gate.nx -- proves the enforcement bridge end-to-end on REAL images, and that it honors
2// supervision: (T1) a fingerprint APPROVED on the seg_store blocklist blocks its real image; (T2) a fingerprint that
3// is on the blocklist but only PENDING does NOT block (the same image is allowed); (T3) once the operator approves it,
4// that same image is now blocked. So only operator-approved entries enforce -- nothing blocks behind your back.
5// license_tier: ORIGINAL
6import "nx_recovery_guard.nx"
7import "nx_gate.nx"
8import "nx_tabrec.nx"
9func hex16(v: i64, out: *u8) -> i64 { var i: i64=0; while i<16 { let sh: i64=(15-i)*4; let nib: i64=(v>>sh)&0xf; if nib<10 { out[i]=(48+nib) as u8 } else { out[i]=(87+nib) as u8 } i=i+1 } out[16]=0 as u8; return 16 }
10func dhash_gif(path: *u8) -> i64 {
11 let wh: *i64=sys_mmap(16) as *i64; let box: *i64=sys_mmap(16) as *i64
12 let raw: *u8=sys_read_file(path, box); if raw==(0 as *u8) { return 0 }
13 let g: *u8=gif_decode(raw, box[0], wh); if g==(0 as *u8) { return 0 }
14 return nx_phash_dhash(g, wh[0], wh[1])
15}
16func seed(prefix: *u8, id: *u8, dhhex: *u8) -> i64 {
17 let r: *u8=sys_mmap(512); var o: i64=0
18 o=tr_cat(r,o,dhhex); o=tr_tab(r,o); o=tr_cat(r,o,"10" as *u8); o=tr_tab(r,o); o=tr_cat(r,o,"NCII" as *u8); o=tr_tab(r,o); o=tr_cat(r,o,"operator" as *u8); o=tr_tab(r,o); o=tr_cat(r,o,"2026-06-30" as *u8); o=tr_tab(r,o); o=tr_cat(r,o,"REF" as *u8); o=tr_tab(r,o); o=tr_cat(r,o,"pending" as *u8)
19 return bl_put_pfx(prefix, id, r, o)
20}
21
22func main() -> i64 {
23 gw("=== nx_recovery_guard_gate: only APPROVED entries enforce; proven on real images ===\n" as *u8)
24 let TP: *u8="knowledge/blocklist-gtest-" as *u8
25 let img0: *u8="web_assets/archive/page3.com/media/img0.gif" as *u8
26 let img2: *u8="web_assets/archive/page3.com/media/img2.gif" as *u8
27
28 let dh0: i64=dhash_gif(img0)
29 let dh2: i64=dhash_gif(img2)
30 if dh0==0 { gw("no page3 media -- run nx_archive_site_viewer for page3.com first\n" as *u8); return 1 }
31
32 let h0: *u8=sys_mmap(32); hex16(dh0, h0)
33 let h2: *u8=sys_mmap(32); hex16(dh2, h2)
34 seed(TP, "m" as *u8, h0); bl_set_status_pfx(TP, "m" as *u8, "approved" as *u8) // m = APPROVED
35 seed(TP, "p" as *u8, h2) // p = left PENDING
36
37 var pass: i64=0; var tot: i64=0
38
39 let r1: i64=guard_check_gif(img0, TP)
40 tot=tot+1; if r1>=0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
41 gw("T1 APPROVED fingerprint -> real image BLOCKED (row " as *u8); gn(r1); gw(")\n" as *u8)
42
43 let r2: i64=guard_check_gif(img2, TP)
44 tot=tot+1; if r2<0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
45 gw("T2 PENDING entry does NOT block -- same image ALLOWED though its hash is listed (SUPERVISION)\n" as *u8)
46
47 bl_set_status_pfx(TP, "p" as *u8, "approved" as *u8)
48 let r3: i64=guard_check_gif(img2, TP)
49 tot=tot+1; if r3>=0 { pass=pass+1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
50 gw("T3 after operator APPROVE -> that same image now BLOCKED (row " as *u8); gn(r3); gw(")\n" as *u8)
51
52 gw("\n=== nx_recovery_guard_gate " as *u8); gn(pass); gw("/" as *u8); gn(tot); gw(" ===\n" as *u8)
53 if pass==tot { gw("RECOVERY-GUARD GREEN -- enforcement reads seg_store, blocks ONLY approved, on real images\n" as *u8); sys_exit(0); return 0 }
54 gw("RECOVERY-GUARD RED\n" as *u8); sys_exit(1); return 1
55}