nx_sota_why_gate.nx source
↩ module page · 188 lines · 10500 B
1// nx_sota_why_gate.nx -- proves the per-domain board reader, BOTH POLARITIES.
2//
3// WHAT IS ACTUALLY UNDER TEST HERE IS THE REFUSALS. nx_sota_why has one job people will trust it for --
4// "where does this domain stand" -- and five ways to be wrong about it that all look like an answer:
5// answering from a ledger that is absent, truncated, self-inconsistent or stale, or answering about a
6// DIFFERENT domain whose name merely contains this one. Each gets a tooth with the EXIT CODE pinned,
7// because the exit code is the contract for every caller that is not a human reading prose.
8//
9// FIXTURES ARE ASSEMBLED AT RUNTIME under /tmp/<gate>_<clock>/ via gk_fixture_dir, never in
10// knowledge/store: a gate that shares a directory with a production beat measures the STATE OF THAT
11// DIRECTORY and reports it as a verdict about the code. The subject is located from /proc/self/exe, not
12// from the CWD, because the end-to-end teeth deliberately chdir into the fixture tree and a relative elf
13// path would then resolve to nothing -- which reads as a crashed subject rather than as a moved harness.
14// license_tier: ORIGINAL expect_exit: 0 No hw writes (Rule 26).
15import "nx_syscalls.nx"
16import "nx_gatekit_lib.nx"
17import "nx_gate_verdict.nx"
18import "nx_string_ops.nx"
19import "nx_sota_why_lib.nx"
20
21const SG_PATH: i64 = 512
22const SG_OUT: i64 = 65536
23const SG_BIG: i64 = 1048576
24const SG_SLASH: i64 = 47
25const SG_BIGROWS: i64 = 3200
26const SG_LEDGER_CAP: i64 = 262144 // must equal SW_CAP in the subject; T11 asserts we exceeded it
27const SG_ROW1_END: i64 = 33 // end of the first fixture row -- MEASURED by T2, not guessed: my first draft said 34 and the fixture-reached tooth caught it
28
29// Absolute directory holding THIS binary, read from /proc/self/exe. Returns the length, or -1.
30func sg_selfdir(out: *u8) -> i64 {
31 let n: i64 = sys_readlinkat("/proc/self/exe" as *u8, out, SG_PATH - 1)
32 if n <= 0 { return 0 - 1 }
33 var cut: i64 = 0 - 1
34 var i: i64 = 0
35 while i < n { if (out[i] as i64) == SG_SLASH { cut = i } i = i + 1 }
36 if cut < 0 { return 0 - 1 }
37 out[cut] = 0 as u8
38 return cut
39}
40
41func main() -> i64 {
42 let ctr: *i64 = gv_ctr()
43 gv_head("nx_sota_why_gate -- the per-domain board reader, and every way it must refuse" as *u8)
44
45 // ---- IN-PROCESS: the pure helpers the organ and this gate share ------------------------------
46 let nb: *u8 = sys_mmap(SG_PATH)
47 var o: i64 = 0
48 o = sw_cat(nb, o, "domain= " as *u8)
49 o = sw_cat(nb, o, "lang" as *u8)
50 o = sw_cat(nb, o, " class=" as *u8)
51 var t1: i64 = 0
52 if nx_str_find(nb, o, "domain= lang class=" as *u8, 19) == 0 { t1 = 1 }
53 gv_check_eq("T1 the needle is an EXACT field-delimited token, not a bare domain name" as *u8, o, 19, ctr)
54 gv_check("T1b and it reads back byte-for-byte as that token" as *u8, t1, ctr)
55
56 let rb: *u8 = sys_mmap(SG_OUT)
57 let rn: i64 = sw_cat(rb, 0, "domain= alpha class=MECH-OK cov=1\ndomain= beta class=RED cov=2\n" as *u8)
58 gv_check_eq("T2-fixture-reached-the-first-row-ends-where-this-tooth-assumes" as *u8,
59 sw_row_end(rb, 0, rn), SG_ROW1_END, ctr)
60 gv_check("T2b sw_row_has finds the class token INSIDE the row it was given" as *u8,
61 sw_row_has(rb, 0, SG_ROW1_END, " class=MECH-OK" as *u8), ctr)
62 var t3bad: i64 = 0
63 if sw_row_has(rb, 0, SG_ROW1_END, " class=RED" as *u8) == 0 { t3bad = 1 }
64 var t3good: i64 = 1
65 if sw_row_has(rb, 0, rn, " class=RED" as *u8) == 1 { t3good = 0 }
66 gv_bite("neg-control-T3 a class in the NEXT row is invisible inside these bounds and visible outside" as *u8,
67 t3bad, t3good, ctr)
68
69 // ---- END TO END: the exit-code contract, against a fixture tree ------------------------------
70 let selfd: *u8 = sys_mmap(SG_PATH)
71 let sdn: i64 = sg_selfdir(selfd)
72 gv_need("subject binary locatable via /proc/self/exe" as *u8, sdn > 0, ctr)
73 let elf: *u8 = sys_mmap(SG_PATH)
74 var eo: i64 = 0
75 if sdn > 0 { eo = sw_cat(elf, 0, selfd) }
76 eo = sw_cat(elf, eo, "/nx_sota_why.elf" as *u8)
77
78 let fix: *u8 = sys_mmap(SG_PATH)
79 gk_fixture_dir("nx_sota_why_gate" as *u8, fix)
80 let kdir: *u8 = sys_mmap(SG_PATH)
81 let sdir: *u8 = sys_mmap(SG_PATH)
82 gk_join(kdir, fix, "knowledge" as *u8)
83 gk_mkdir(kdir)
84 gk_join(sdir, kdir, "status" as *u8)
85 gk_mkdir(sdir)
86 let led: *u8 = sys_mmap(SG_PATH)
87 gk_join(led, sdir, "sota_board.ledger" as *u8)
88
89 sys_chdir(fix)
90 let ob: *u8 = sys_mmap(SG_OUT)
91 let ol: *i64 = sys_mmap(64) as *i64
92
93 // T4 -- no argument at all. A reader that answered SOMETHING here would be inventing a subject.
94 let r4: i64 = gk_run_capture(elf, 0 as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
95 gv_check_eq("T4 no domain argument exits USAGE and answers about nothing" as *u8, r4, 2, ctr)
96
97 // T5 -- absent ledger. This must NOT read as "the domain is not on the board": one is a fact about
98 // the EVIDENCE and the other about the ARGUMENT, and they have opposite remedies.
99 let r5: i64 = gk_run_capture(elf, "lang" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
100 gv_check_eq("T5 an ABSENT ledger exits UNUSABLE, not NOT-FOUND" as *u8, r5, 3, ctr)
101 gv_check("T5b and it names LEDGER-ABSENT so the remedy is not guessed" as *u8,
102 gk_out_has(ob, ol[0], "LEDGER-ABSENT" as *u8), ctr)
103
104 // T6/T7 -- a ledger whose own reconciliation line reads RED must never be quoted, and the SAME row in
105 // an otherwise identical GREEN ledger must answer. Two fixtures differing only in that one line.
106 gk_write(led, "run_epoch=1788470000\ndomain= lang class=MECH-OK cov=887 exceed=5 gaps=8 stamp_epoch=1788400000 stamp_age_s=70000\nLEDGER-PARTITION proven=0 red=0 mech_ok=1 sum=1 domains=1\nverdict=RED the ledger classes DISAGREE with the printed buckets\n" as *u8)
107 let r6: i64 = gk_run_capture(elf, "lang" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
108 var t6bad: i64 = 0
109 if r6 == 3 { if gk_out_has(ob, ol[0], "LEDGER-SELF-INCONSISTENT" as *u8) == 1 { t6bad = 1 } }
110 gk_write(led, "run_epoch=1788470000\ndomain= lang class=MECH-OK cov=887 exceed=5 gaps=8 stamp_epoch=1788400000 stamp_age_s=70000\nLEDGER-PARTITION proven=0 red=0 mech_ok=1 sum=1 domains=1\nverdict=GREEN the ledger classes reconcile with the printed buckets\n" as *u8)
111 let r7: i64 = gk_run_capture(elf, "lang" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
112 var t6good: i64 = 1
113 if r7 == 0 { t6good = 0 }
114 gv_bite("T6 a SELF-INCONSISTENT ledger refuses, while the same row in a GREEN ledger answers" as *u8,
115 t6bad, t6good, ctr)
116 var t7: i64 = 0
117 if r7 == 0 {
118 if gk_out_has(ob, ol[0], "class=MECH-OK" as *u8) == 1 {
119 if gk_out_has(ob, ol[0], "SECOND INDEPENDENT METHOD CLASS" as *u8) == 1 { t7 = 1 }
120 }
121 }
122 gv_check("T7 a known domain answers with its class AND the one thing standing between it and PROVEN" as *u8, t7, ctr)
123
124 // T8 -- THE PREFIX NEIGHBOUR. Without field delimiters in the needle this is the defect that reports
125 // one domain as another, and it produces a confident answer rather than an error.
126 let r8: i64 = gk_run_capture(elf, "lan" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
127 var t8bad: i64 = 0
128 if r8 == 1 { if gk_out_has(ob, ol[0], "DOMAIN-NOT-ON-THE-BOARD" as *u8) == 1 { t8bad = 1 } }
129 let r8b: i64 = gk_run_capture(elf, "lang" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
130 var t8good: i64 = 1
131 if r8b == 0 { t8good = 0 }
132 gv_bite("neg-control-T8 a PREFIX of a real domain is NOT-FOUND while the full name answers" as *u8,
133 t8bad, t8good, ctr)
134
135 // T9 -- STALENESS REFUSES ONLY WHEN A BAR IS DECLARED, and answers-with-its-age when none is. An
136 // unarmed freshness check that refused every question would be safe and useless; one that hid the age
137 // would let a stale claim propagate. The organ does neither, and both halves are pinned here.
138 let cfg: *u8 = sys_mmap(SG_PATH)
139 gk_join(cfg, sdir, "sota_why.conf" as *u8)
140 gk_write(cfg, "max-age-s=1\n" as *u8)
141 let r9: i64 = gk_run_capture(elf, "lang" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
142 var t9bad: i64 = 0
143 if r9 == 3 { if gk_out_has(ob, ol[0], "LEDGER-STALE" as *u8) == 1 { t9bad = 1 } }
144 gk_rm(cfg)
145 let r9b: i64 = gk_run_capture(elf, "lang" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
146 var t9good: i64 = 1
147 if r9b == 0 { if gk_out_has(ob, ol[0], "bar=UNDECLARED" as *u8) == 1 { t9good = 0 } }
148 gv_bite("T9 a DECLARED and blown staleness bar refuses, an UNDECLARED one answers and stamps the age" as *u8,
149 t9bad, t9good, ctr)
150
151 // T10 -- NO SILENT CAP. A ledger that exactly fills the read buffer may have been truncated, and a
152 // truncated ledger would let a PRESENT domain be reported ABSENT. The organ must say CAPPED instead.
153 let big: *u8 = sys_mmap(SG_BIG)
154 var bo: i64 = 0
155 bo = sw_cat(big, bo, "run_epoch=1788470000\nverdict=GREEN reconciles\n" as *u8)
156 var bi: i64 = 0
157 while bi < SG_BIGROWS {
158 bo = sw_cat(big, bo, "domain= filler" as *u8)
159 bo = gk_catn(big, bo, bi)
160 big[bo] = 0 as u8
161 bo = sw_cat(big, bo, " class=CLAIM-ONLY cov=0 exceed=0 gaps=0 stamp_epoch=0 stamp_age_s=0\n" as *u8)
162 bi = bi + 1
163 }
164 gk_write(led, big)
165 let lsz: i64 = gk_size(led)
166 gv_check("T10-fixture-reached-the-ledger-really-exceeds-the-subject-read-cap" as *u8,
167 (lsz > SG_LEDGER_CAP) as i64, ctr)
168 let r10: i64 = gk_run_capture(elf, "lang" as *u8, 0 as *u8, 0 as *u8, 0 as *u8, ob, SG_OUT, ol)
169 var t10: i64 = 0
170 if r10 == 3 { if gk_out_has(ob, ol[0], "LEDGER-CAPPED" as *u8) == 1 { t10 = 1 } }
171 gv_check("T10 an oversized ledger reports CAPPED, never a silent search of a prefix" as *u8, t10, ctr)
172
173 gv_values_head()
174 gv_kv("fixture_ledger_bytes" as *u8, lsz)
175 gv_kv("subject_read_cap" as *u8, SG_LEDGER_CAP)
176 gv_kv("exit_no_arg" as *u8, r4)
177 gv_kv("exit_absent_ledger" as *u8, r5)
178 gv_kv("exit_red_ledger" as *u8, r6)
179 gv_kv("exit_green_ledger" as *u8, r7)
180 gv_kv("exit_prefix_name" as *u8, r8)
181 gv_kv("exit_stale" as *u8, r9)
182 gv_kv("exit_capped" as *u8, r10)
183
184 let rc: i64 = gv_verdict("SOTA-WHY-GATE" as *u8, ctr,
185 "the per-domain reader answers only from a ledger that is present, whole, self-consistent and within its declared freshness, and refuses each of those with its own exit code" as *u8)
186 sys_exit(rc)
187 return rc
188}