nx_recycler_sov_gate.nx source

1import "nx_gate_gn.nx" 2// nx_recycler_sov_gate.nx -- the leftpad (npm supply-chain) verdict RECYCLED into a regression-locked invariant. 3// The left-pad incident (knowledge/fetched/recyc_leftpad.raw): a 11-line third-party package was unpublished and 4// broke builds worldwide. Nishi's immunity is STRUCTURAL -- zero third-party runtime deps -- but immunity unproven 5// is immunity unlocked, so this gate AUDITS real organ sources (including our most "tempted to use a library" code: 6// the HTTPS-fetch + TLS-1.3 stack) and proves EVERY `import "..."` is sovereign (a relative .nx, no URL / package 7// scheme). If anyone ever adds a third-party import, this goes RED. Grounded: scans the real files + the real intake 8// artifact. expect_exit: 0 license_tier: ORIGINAL 9import "nx_syscalls.nx" 10 11func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 12func have_file(p: *u8) -> i64 { let fd: i64=sys_openat_rd(p); if fd<0 { return 0 } sys_close(fd); return 1 } 13// `import "` (8 bytes) present at buf[i]? 14import "nx_gate_verdict.nx" 15func is_import_at(buf: *u8, n: i64, i: i64) -> i64 { 16 if i+8 > n { return 0 } 17 if buf[i]!=(105 as u8) { return 0 } 18 if buf[i+1]!=(109 as u8) { return 0 } 19 if buf[i+2]!=(112 as u8) { return 0 } 20 if buf[i+3]!=(111 as u8) { return 0 } 21 if buf[i+4]!=(114 as u8) { return 0 } 22 if buf[i+5]!=(116 as u8) { return 0 } 23 if buf[i+6]!=(32 as u8) { return 0 } 24 if buf[i+7]!=(34 as u8) { return 0 } 25 return 1 26} 27func has_scheme(buf: *u8, from: i64, to: i64) -> i64 { 28 var i: i64=from 29 while i+3<=to { if buf[i]==(58 as u8) { if buf[i+1]==(47 as u8) { if buf[i+2]==(47 as u8) { return 1 } } } i=i+1 } 30 return 0 31} 32// sovereign import iff: no "://" scheme AND ends in ".nx". 33func is_sovereign(buf: *u8, from: i64, to: i64) -> i64 { 34 if has_scheme(buf, from, to)==1 { return 0 } 35 if to-from < 3 { return 0 } 36 if buf[to-3]!=(46 as u8) { return 0 } 37 if buf[to-2]!=(110 as u8) { return 0 } 38 if buf[to-1]!=(120 as u8) { return 0 } 39 return 1 40} 41// audit one file: accumulate total imports + non-sovereign count into totp/badp. returns 1 if the file was read. 42func audit(path: *u8, totp: *i64, badp: *i64) -> i64 { 43 let lp: *i64 = sys_mmap(16) as *i64; lp[0]=0 44 let buf: *u8 = sys_read_file(path, lp) 45 if (buf as i64)==0 { gp(" (skip, unreadable) " as *u8); gp(path); gp("\n" as *u8); return 0 } 46 let n: i64 = lp[0] 47 var i: i64=0; var t: i64=0; var bad: i64=0 48 while i < n { 49 if is_import_at(buf, n, i)==1 { 50 let j: i64 = i+8 51 var k: i64=j 52 var found: i64=0 53 while found==0 { if k<n { if buf[k]==(34 as u8){ found=1 } else { k=k+1 } } else { found=1 } } 54 t=t+1 55 if is_sovereign(buf, j, k)==0 { bad=bad+1 } 56 i = k+1 57 } else { i=i+1 } 58 } 59 gp(" " as *u8); gp(path); gp(" imports=" as *u8); gn(t); gp(" third-party=" as *u8); gn(bad); gp("\n" as *u8) 60 totp[0]=totp[0]+t; badp[0]=badp[0]+bad 61 return 1 62} 63 64func main() -> i64 { 65 gp("=== nx_recycler_sov_gate: left-pad (supply-chain) recycled -> zero-third-party-dep invariant, locked ===\n" as *u8) 66 let totp: *i64 = sys_mmap(16) as *i64; totp[0]=0 67 let badp: *i64 = sys_mmap(16) as *i64; badp[0]=0 68 var files: i64=0 69 // audit the recycler + its network path (the most "tempted to use a library" code: HTTPS-fetch + TLS-1.3) 70 files = files + audit("runtime/nx_recycler_fetch.nx" as *u8, totp, badp) 71 files = files + audit("runtime/nx_https_fetch_follow.nx" as *u8, totp, badp) 72 files = files + audit("runtime/nx_tls13.nx" as *u8, totp, badp) 73 files = files + audit("runtime/nx_x509_trust_store.nx" as *u8, totp, badp) 74 files = files + audit("runtime/_hdl_build/nx_recycler_assess.nx" as *u8, totp, badp) 75 files = files + audit("runtime/_hdl_build/nx_recycler_bounds.nx" as *u8, totp, badp) 76 77 gp(" AUDIT: files=" as *u8); gn(files); gp(" imports=" as *u8); gn(totp[0]); gp(" third-party=" as *u8); gn(badp[0]); gp("\n" as *u8) 78 79 var pass: i64=0; var fail: i64=0 80 if files >= 4 { pass=pass+1 } else { fail=fail+1; gp(" FAIL too-few-files-audited\n" as *u8) } 81 if totp[0] >= 8 { pass=pass+1 } else { fail=fail+1; gp(" FAIL too-few-imports (audit not meaningful)\n" as *u8) } 82 if badp[0] == 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL THIRD-PARTY-DEP-FOUND (sovereignty breached)\n" as *u8) } 83 // self-check the predicate: a synthetic third-party import IS flagged (liar-kill -- the gate can actually fail) 84 let probe: *u8 = "import \"https://evil.example/x\"" as *u8 85 var pn: i64=0; while probe[pn]!=(0 as u8){pn=pn+1} 86 if is_import_at(probe, pn, 0)==1 { if is_sovereign(probe, 8, pn-1)==0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL predicate-blind-to-url\n" as *u8) } } else { fail=fail+1; gp(" FAIL probe-not-detected\n" as *u8) } 87 // grounding: the recycled bug exists as a real fetched artifact 88 if have_file("knowledge/fetched/recyc_leftpad.raw" as *u8)==1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL ungrounded (recyc_leftpad.raw missing)\n" as *u8) } 89 90 gp("RECYCLER-SOV-GATE pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 91 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 92 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 93 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 94 let ctr__dry: *i64 = gv_ctr() 95 ctr__dry[0] = pass 96 ctr__dry[1] = pass + fail 97 let rc__dry: i64 = gv_verdict("RECYCLER-SOV-GATE" as *u8, ctr__dry, "every import across the recycler + TLS/HTTPS stack is sovereign .nx; a URL import WOULD be caught; recycled from real left-pad artifact)" as *u8) 98 sys_exit(rc__dry) 99 return rc__dry 100}