code wiki / _hdl_build / nx_shard_guardrail_gate.nx
`nx_shard_guardrail_gate.nx` source

1// nx_shard_guardrail_gate.nx -- hermetic gate for CAP-SHARD-GUARDRAIL (R4). Proves the tighten-only inheritance:
2// a shard can RAISE the required level but a shard's attempt to LOWER it below the org floor is ignored -- a tenant
3// can never weaken an org-wide guardrail. Sovereign: nx_syscalls + nx_shard_guardrail. expect_exit: 0
4import "nx_syscalls.nx"
5import "nx_shard_guardrail.nx"
6import "nx_gate_verdict.nx"
7
8func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
9func gn(v: i64) -> i64 { var t: i64=v; if t<0{sys_write(1,"-" as *u8,1);t=0-t} let tm:*u8=sys_mmap(24); var k:i64=0; if t==0{tm[0]=48 as u8;k=1} while t>0{tm[k]=(48+(t%10)) as u8;t=t/10;k=k+1} let b:*u8=sys_mmap(24); var j:i64=0; while j<k{b[j]=tm[k-1-j];j=j+1} sys_write(1,b,k); return 0 }
10
11func main(argc: i64, argv: *i64) -> i64 {
12    gp("=== nx_shard_guardrail_gate (R4: org policy inheritance, tighten-only) ===\n" as *u8)
13    let ORG: i64 = 2   // org floor = member
14    var pass: i64 = 0; var fail: i64 = 0
15
16    // T1 shard tightens -> effective rises
17    if gi_effective_required(ORG, 3) == 3 { pass=pass+1; gp("  T1 shard tightens 2->3 -> effective 3 PASS\n" as *u8) } else { fail=fail+1; gp("  T1 FAIL\n" as *u8) }
18
19    // T2 shard tries to loosen -> org floor holds
20    if gi_effective_required(ORG, 1) == 2 { pass=pass+1; gp("  T2 shard tries to loosen to 1 -> floor holds at 2 PASS\n" as *u8) } else { fail=fail+1; gp("  T2 FAIL floor breached\n" as *u8) }
21
22    // T3 shard == org
23    if gi_effective_required(ORG, 2) == 2 { pass=pass+1; gp("  T3 shard == org -> effective 2 PASS\n" as *u8) } else { fail=fail+1; gp("  T3 FAIL\n" as *u8) }
24
25    // T4 operator meets the tightened requirement
26    if gi_allowed(3, ORG, 3) == 1 { pass=pass+1; gp("  T4 operator(3) meets tightened(3) -> allow PASS\n" as *u8) } else { fail=fail+1; gp("  T4 FAIL\n" as *u8) }
27
28    // T5 member fails the shard-tightened requirement
29    if gi_allowed(2, ORG, 3) == 0 { pass=pass+1; gp("  T5 member(2) fails tightened(3) -> deny PASS\n" as *u8) } else { fail=fail+1; gp("  T5 FAIL\n" as *u8) }
30
31    // T6 member meets the floor even when a shard tried to loosen
32    if gi_allowed(2, ORG, 1) == 1 { pass=pass+1; gp("  T6 member(2) meets floor(2) despite shard loosen-to-1 PASS\n" as *u8) } else { fail=fail+1; gp("  T6 FAIL\n" as *u8) }
33
34    // T7 THE guarantee: a shard cannot drop the bar below the floor -> viewer still denied
35    if gi_allowed(1, ORG, 0) == 0 { pass=pass+1; gp("  T7 viewer(1) denied even if shard requires 0 (floor 2 wins) PASS\n" as *u8) } else { fail=fail+1; gp("  T7 FAIL tenant weakened org guardrail\n" as *u8) }
36
37    gp("RESULT pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail)
38    // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
39    // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
40    // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
41    let ctr__dry: *i64 = gv_ctr()
42    ctr__dry[0] = pass
43    ctr__dry[1] = pass + fail
44    let rc__dry: i64 = gv_verdict("SHARD-GUARDRAIL-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
45    sys_exit(rc__dry)
46    return rc__dry
47}
nx_shard_guardrail_gate.nx source

`nx_shard_guardrail_gate.nx` source
