nx_seat_gate.nx source

1// nx_seat_gate.nx -- makes nx_seat's OWN proof reachable by the ship loop. 2// 3// THE GAP THIS CLOSES, measured 2026-08-22: nx_seat IS gated -- `nx_seat selftest` runs 29 gv_check 4// teeth and prints "NX-SEAT-GATE passed 29/29 verdict=GREEN". But that proof lives behind a VERB, and 5// osl_gate_resolve resolves only gate BINARIES (<target>_gate by convention, or a declared row in 6// knowledge/organ_gate.conf whose value is a gate NAME). So every ship of nx_seat reported 7// `prove=NO-GATE-FOUND UNPROVEN` while a 29-tooth gate sat one argument away. 8// *A PROOF THAT THE SHIP LOOP CANNOT REACH IS, TO THE SHIP LOOP, A PROOF THAT DOES NOT EXIST. 9// 10// WHY A THIN GATE AND NOT A RESOLVER CHANGE: organ_gate.conf already treats SPACE as a field 11// separator, so encoding "<binary> <verb>" there needs a NEW SYNTAX DECISION, not a mechanical fix -- 12// and the resolver is the path every organ in the estate ships through. Satisfying the existing 13// convention costs one small binary and changes nothing anyone else depends on. 14// *WHEN A CONVENTION AND A SUBJECT DISAGREE, THE CHEAPER AND SAFER MOVE IS USUALLY TO SATISFY THE 15// CONVENTION, NOT TO REDESIGN THE CONTRACT EVERY OTHER CALLER SHARES. 16// 17// This is a PASS-THROUGH, deliberately: it does not re-implement or re-judge anything. It runs the 18// real selftest and requires BOTH that the process exited 0 AND that its verdict line says GREEN -- 19// because an exit code alone cannot distinguish "green" from "the binary was replaced by something 20// that exits 0", and a string alone cannot see a crash after printing. 21import "nx_syscalls.nx" 22import "nx_gate_verdict.nx" 23import "nx_tool_run.nx" 24 25const SG_OUT: i64 = 262144 26const SG_SUBJ_A: *u8 = "./nx_seat.elf" 27const SG_SUBJ_B: *u8 = "_offc/nx_seat.elf" 28 29func sg_has(buf: *u8, n: i64, needle: *u8) -> i64 { 30 var nl: i64 = 0 31 while needle[nl] != (0 as u8) { nl = nl + 1 } 32 if nl == 0 { return 0 } 33 var i: i64 = 0 34 while i + nl <= n { 35 var j: i64 = 0 36 var hit: i64 = 1 37 while j < nl { if buf[i + j] != needle[j] { hit = 0; j = nl } else { j = j + 1 } } 38 if hit == 1 { return 1 } 39 i = i + 1 40 } 41 return 0 42} 43func sg_exists(p: *u8) -> i64 { 44 let fd: i64 = sys_openat_rd(p) 45 if fd < 0 { return 0 } 46 sys_close(fd) 47 return 1 48} 49 50func main() -> i64 { 51 let ctr: *i64 = gv_ctr() 52 gv_head("nx_seat_gate -- run nx_seat's own 29-tooth selftest and carry its verdict to the ship loop" as *u8) 53 54 var subj: *u8 = SG_SUBJ_A 55 if sg_exists(subj) == 0 { subj = SG_SUBJ_B } 56 gv_need("a promoted nx_seat binary to run the selftest against" as *u8, sg_exists(subj), ctr) 57 58 var rc: i64 = 0 - 999 59 var n: i64 = 0 60 let out: *u8 = sys_mmap(SG_OUT) 61 let olen: *i64 = sys_mmap(16) as *i64 62 if sg_exists(subj) == 1 { 63 let av: *i64 = sys_mmap(8 * 3) as *i64 64 av[0] = subj as i64 65 av[1] = "selftest" as *u8 as i64 66 av[2] = 0 67 rc = tr_run_capture(subj, av, out, SG_OUT - 8, olen) 68 n = olen[0] 69 } 70 71 // T1 the run HAPPENED. Without this, T2/T3 would pass vacuously on a zero-byte capture. 72 var t1: i64 = 0 73 if n > 0 { t1 = 1 } 74 gv_subjects("bytes captured from the selftest" as *u8, n, ctr) 75 if sg_exists(subj) == 1 { gv_check("T1 fixture-reached-the-condition: the selftest actually produced output" as *u8, t1, ctr) } 76 77 // T2 the subject's own verdict line says GREEN. 78 var t2: i64 = 0 79 if n > 0 { if sg_has(out, n, "NX-SEAT-GATE" as *u8) == 1 { if sg_has(out, n, "verdict=GREEN" as *u8) == 1 { t2 = 1 } } } 80 if sg_exists(subj) == 1 { gv_check("T2 the selftest's own verdict line reports NX-SEAT-GATE ... verdict=GREEN" as *u8, t2, ctr) } 81 82 // T3 the EXIT CODE agrees. A gate whose exit code does not carry its verdict silently blesses every 83 // failure it finds -- so the string and the status must BOTH say pass, and disagreement is RED. 84 var t3: i64 = 0 85 if rc == 0 { t3 = 1 } 86 if sg_exists(subj) == 1 { gv_check("T3 the selftest EXITED 0 -- string and status agree, neither alone is trusted" as *u8, t3, ctr) } 87 88 // T4 neg-control: a verdict this gate must never claim to have seen. Proves T2 reads the real 89 // capture rather than returning a constant. 90 var t4: i64 = 0 91 if n > 0 { if sg_has(out, n, "zzz_not_in_seat_selftest_zzz" as *u8) == 0 { t4 = 1 } } 92 if sg_exists(subj) == 1 { gv_check("T4 neg-control-capture-scanner-does-not-report-an-absent-string" as *u8, t4, ctr) } 93 94 return gv_verdict("SEAT-GATE-WRAPPER" as *u8, ctr, "nx_seat's 29-tooth selftest is now reachable by name, and its verdict is required on BOTH the printed line and the exit code" as *u8) 95}