nx_sov_endpoint_gate.nx source
↩ module page · 182 lines · 7415 B
1// nx_sov_endpoint_gate.nx -- proves the endpoint policy matches the measurement.
2//
3// T1 is the whole point: every 8443 endpoint must rank ahead of every 443 one.
4// That ordering is not taste, it is the 2026-07-31 measurement (8443: 5/5 from
5// our client; 443: 0/5, flapping between our real cert and actively refusing).
6// A future edit that restores :443 to the front has to make this gate RED
7// first, which is the point of writing the policy down as code.
8//
9// T5 requires every endpoint to carry a non-empty note. A silent reordering is
10// the failure mode this module exists to prevent, so an endpoint with no stated
11// reason is itself a defect.
12//
13// T6/T7 are the non-vacuity controls: a bad index must be REFUSED, not served a
14// plausible default URL, and the degraded-port judgement must actually
15// discriminate rather than answering the same thing for every port.
16//
17// license_tier: ORIGINAL
18import "nx_syscalls.nx"
19import "nx_sov_endpoint.nx"
20
21func g_puts(s: *u8) -> i64 {
22 var i: i64 = 0
23 while s[i] != (0 as u8) { i = i + 1 }
24 sys_write(1, s, i)
25 return i
26}
27
28func g_putn(v: i64) -> i64 {
29 let buf: *u8 = sys_mmap(32)
30 let tmp: *u8 = sys_mmap(32)
31 var x: i64 = v
32 var d: i64 = 0
33 var i: i64 = 0
34 if x < 0 { g_puts("-" as *u8); x = 0 - x }
35 if x == 0 { buf[0] = 0x30 as u8; sys_write(1, buf, 1); return 1 }
36 while x > 0 { tmp[d] = ((x % 10) + 0x30) as u8; x = x / 10; d = d + 1 }
37 while i < d { buf[i] = tmp[d - 1 - i]; i = i + 1 }
38 sys_write(1, buf, d)
39 return d
40}
41
42func main() -> i64 {
43 var fails: i64 = 0
44 var mark: i64 = 0
45 var i: i64 = 0
46 var j: i64 = 0
47 var last_8443: i64 = 0 - 1
48 var first_443: i64 = 0 - 1
49
50 let url: *u8 = sys_mmap(512)
51 let url2: *u8 = sys_mmap(512)
52
53 // ---- T1: 8443 ALWAYS ranks ahead of 443 (the measurement) ----
54 i = 0
55 while i < NX_SOV_N_ENDPOINT {
56 if nx_sov_endpoint_port(i) == 8443 { last_8443 = i }
57 if nx_sov_endpoint_port(i) == 443 {
58 if first_443 < 0 { first_443 = i }
59 }
60 i = i + 1
61 }
62 // both kinds must actually be present, or the ordering claim is vacuous
63 if last_8443 < 0 { fails = fails + 1 }
64 if first_443 < 0 { fails = fails + 1 }
65 if last_8443 >= first_443 { fails = fails + 1 }
66 if fails > 0 { if mark == 0 { mark = 1 } }
67
68 // ---- T2: loopback is rank 0, and is the only loopback ----
69 if nx_sov_endpoint_is_loopback(0) != 1 { fails = fails + 1 }
70 i = 1
71 while i < NX_SOV_N_ENDPOINT {
72 if nx_sov_endpoint_is_loopback(i) != 0 { fails = fails + 1 }
73 i = i + 1
74 }
75 // the preferred endpoint IS rank 0
76 nx_sov_endpoint_preferred(url)
77 nx_sov_endpoint_url(0, url2)
78 i = 0
79 while i < 64 {
80 if url[i] != url2[i] { fails = fails + 1; i = 64 } else {
81 if url[i] == (0 as u8) { i = 64 } else { i = i + 1 }
82 }
83 }
84 if fails > 0 { if mark == 0 { mark = 2 } }
85
86 // ---- T3: URL construction is exact ----
87 nx_sov_endpoint_url(0, url)
88 if nx_sov_len(url) != 22 { fails = fails + 1 }
89 // "https://127.0.0.1:8443" -- check the pieces rather than the whole,
90 // so a host change does not falsely fail the structure test
91 if url[0] != (0x68 as u8) { fails = fails + 1 }
92 if url[4] != (0x73 as u8) { fails = fails + 1 }
93 if url[5] != (0x3a as u8) { fails = fails + 1 }
94 if url[6] != (0x2f as u8) { fails = fails + 1 }
95 if url[7] != (0x2f as u8) { fails = fails + 1 }
96 // the port digits land at the tail, colon-separated
97 if url[17] != (0x3a as u8) { fails = fails + 1 }
98 if url[18] != (0x38 as u8) { fails = fails + 1 }
99 if url[19] != (0x34 as u8) { fails = fails + 1 }
100 if url[20] != (0x34 as u8) { fails = fails + 1 }
101 if url[21] != (0x33 as u8) { fails = fails + 1 }
102 if fails > 0 { if mark == 0 { mark = 3 } }
103
104 // ---- T4: the off-box preference skips loopback but keeps the order ----
105 if nx_sov_endpoint_preferred_remote(url) < 0 { fails = fails + 1 }
106 nx_sov_endpoint_url(1, url2)
107 i = 0
108 while i < 64 {
109 if url[i] != url2[i] { fails = fails + 1; i = 64 } else {
110 if url[i] == (0 as u8) { i = 64 } else { i = i + 1 }
111 }
112 }
113 // and it must NOT be the degraded port
114 if nx_sov_port_is_degraded(nx_sov_endpoint_port(1)) != 0 { fails = fails + 1 }
115 if fails > 0 { if mark == 0 { mark = 4 } }
116
117 // ---- T5: every endpoint states WHY it sits where it does ----
118 i = 0
119 while i < NX_SOV_N_ENDPOINT {
120 if nx_sov_len(nx_sov_endpoint_note(i)) < 16 { fails = fails + 1 }
121 if nx_sov_len(nx_sov_endpoint_host(i)) == 0 { fails = fails + 1 }
122 if nx_sov_endpoint_port(i) <= 0 { fails = fails + 1 }
123 i = i + 1
124 }
125 // no duplicate host:port rows -- a duplicate is a silent retry, not a
126 // fallback, and would hide a dead endpoint behind an identical one
127 i = 0
128 while i < NX_SOV_N_ENDPOINT {
129 j = i + 1
130 while j < NX_SOV_N_ENDPOINT {
131 nx_sov_endpoint_url(i, url)
132 nx_sov_endpoint_url(j, url2)
133 if nx_sov_len(url) == nx_sov_len(url2) {
134 if nx_sov_len(url) > 0 {
135 if url[8] == url2[8] {
136 if nx_sov_endpoint_port(i) == nx_sov_endpoint_port(j) {
137 fails = fails + 1
138 }
139 }
140 }
141 }
142 j = j + 1
143 }
144 i = i + 1
145 }
146 if fails > 0 { if mark == 0 { mark = 5 } }
147
148 // ---- T6 NEG: a bad index is REFUSED, never given a default ----
149 if nx_sov_endpoint_url(0 - 1, url) != (0 - 1) { fails = fails + 1 }
150 if nx_sov_endpoint_url(NX_SOV_N_ENDPOINT, url) != (0 - 1) { fails = fails + 1 }
151 if nx_sov_endpoint_url(9999, url) != (0 - 1) { fails = fails + 1 }
152 if nx_sov_endpoint_host(9999) != (0 as *u8) { fails = fails + 1 }
153 if nx_sov_endpoint_note(9999) != (0 as *u8) { fails = fails + 1 }
154 if nx_sov_endpoint_port(9999) != 0 { fails = fails + 1 }
155 if fails > 0 { if mark == 0 { mark = 6 } }
156
157 // ---- T7 NEG: the degraded judgement DISCRIMINATES ----
158 if nx_sov_port_is_degraded(443) != 1 { fails = fails + 1 }
159 if nx_sov_port_is_degraded(8443) != 0 { fails = fails + 1 }
160 if nx_sov_port_is_degraded(80) != 0 { fails = fails + 1 }
161 if nx_sov_port_is_degraded(0) != 0 { fails = fails + 1 }
162 if fails > 0 { if mark == 0 { mark = 7 } }
163
164 if fails == 0 {
165 g_puts("GATE nx_sov_endpoint verdict=GREEN pass=7/7 (8443 is proven to rank ahead of 443 with BOTH kinds present so the ordering claim is not vacuous -- that order is the 2026-07-31 measurement, 5/5 vs 0/5 from our own client; loopback is rank 0 and the sole loopback; URL construction exact to the byte; the off-box preference skips loopback, keeps the order and lands on a non-degraded port; every endpoint carries a stated reason and no two duplicate a host:port; a bad index is REFUSED rather than defaulted; the degraded-port judgement discriminates instead of answering yes to everything)\n" as *u8)
166 sys_exit(0)
167 return 0
168 }
169 g_puts("GATE nx_sov_endpoint verdict=RED fails=" as *u8)
170 g_putn(fails)
171 g_puts(" first_stage=" as *u8)
172 g_putn(mark)
173 g_puts("\n" as *u8)
174 nx_sov_endpoint_url(0, url)
175 g_puts(" rank0=" as *u8)
176 g_puts(url)
177 g_puts(" len=" as *u8)
178 g_putn(nx_sov_len(url))
179 g_puts("\n" as *u8)
180 sys_exit(1)
181 return 1
182}