code wiki / _hdl_build / nx_sov_guard.nx
`nx_sov_guard.nx` source

1// nx_sov_guard.nx -- SOVEREIGNTY / NO-NEW-TSV guard (hardware-rung-up). Enumerates a data dir with its OWN
2// getdents64 (no find/ls/grep = no non-nishi tooling) and flags every *.tsv file NOT in the allowlist
3// (knowledge/registry/tsv_allow.list -- grandfathered legacy/other-ws stores, owner-noted). Enforces "stop the
4// creation of new tsv": a NEW non-allowlisted .tsv -> VIOLATION -> RED. As a workstream migrates its tsv ->
5// sovereign seg-store, it removes that line. The sovereign seg-store (knowledge/store/<ns>-*) is the preferred
6// store; this guard is the ratchet that keeps it the default.
7// usage: nx_sov_guard [dir=knowledge/status] [allowlist=knowledge/registry/tsv_allow.list]
8//   exit 0 GREEN (no new tsv) / 1 RED (a new unallowlisted tsv) / 2 ERROR (dir unopenable)
9// license_tier: ORIGINAL
10import "nx_syscalls.nx"
11import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
12const SG_MAGIC_262144: i64 = 262144
13const SG_MAGIC_65536: i64 = 65536
14
15const SG_DIR_DEF:   *u8 = "knowledge/status"
16const SG_ALLOW_DEF: *u8 = "knowledge/registry/tsv_allow.list"
17
18func sg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
19// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
20// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
21// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
22// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
23func sg_wn(v: i64) -> i64 { nxi_out(v); return 0 }
24func sg_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
25func sg_ends(name: *u8, suf: *u8) -> i64 {
26    let n: i64=sg_slen(name); let s: i64=sg_slen(suf); if n<s {return 0}
27    var i: i64=0; while i<s { if name[n-s+i]!=suf[i] {return 0} i=i+1 } return 1
28}
29func sg_read(path: *u8, buf: *u8, cap: i64) -> i64 {
30    let fd: i64=sys_openat_rd(path); if fd<0 {return 0}
31    var off: i64=0; var go: i64=1
32    while go==1 { if off>=cap {go=0} else { let r: i64=sys_read(fd, buf+off, cap-off); if r<=0 {go=0} else {off=off+r} } }
33    sys_close(fd); return off
34}
35// is `name` an exact non-# line in the allowlist buffer?
36func sg_line_in(buf: *u8, n: i64, name: *u8) -> i64 {
37    let nl: i64=sg_slen(name); var ls: i64=0; var i: i64=0
38    while i <= n {
39        var eol: i64=0; if i>=n {eol=1} else { if buf[i]==(10 as u8){eol=1} }
40        if eol==1 {
41            let llen: i64=i-ls
42            if llen==nl { if buf[ls]!=(0x23 as u8) {
43                var m: i64=0; var ok: i64=1
44                while m<nl { if buf[ls+m]!=name[m] {ok=0;m=nl} else {m=m+1} }
45                if ok==1 { return 1 }
46            } }
47            ls=i+1
48        }
49        i=i+1
50    }
51    return 0
52}
53// scan dir for *.tsv not in allowlist. returns violation count (-1 = dir unopenable). prints each.
54func sg_scan(dir: *u8, allowpath: *u8) -> i64 {
55    let allow: *u8 = sys_mmap(SG_MAGIC_262144); let an: i64 = sg_read(allowpath, allow, SG_MAGIC_262144)
56    let dfd: i64 = __syscall(257, 0-100, dir, 0x10000, 0, 0, 0)   // openat AT_FDCWD O_RDONLY|O_DIRECTORY
57    if dfd < 0 { sg_w("sov-guard: cannot open dir " as *u8); sg_w(dir); sg_w("\n" as *u8); return 0-1 }
58    let buf: *u8 = sys_mmap(SG_MAGIC_65536); let nm: *u8 = sys_mmap(512)
59    var total: i64=0; var viol: i64=0; var go: i64=1
60    while go==1 {
61        let nread: i64 = __syscall(217, dfd, buf, SG_MAGIC_65536, 0, 0, 0)
62        if nread<=0 {go=0} else {
63            var pos: i64=0
64            while pos<nread {
65                let reclen: i64 = (buf[pos+16] as i64) | ((buf[pos+17] as i64) << 8)
66                let dtype: i64 = buf[pos+18] as i64
67                var nl: i64=0; while buf[pos+19+nl]!=(0 as u8){ nm[nl]=buf[pos+19+nl]; nl=nl+1 } nm[nl]=0 as u8
68                if dtype==8 { if sg_ends(nm, ".tsv" as *u8)==1 {
69                    total=total+1
70                    if sg_line_in(allow, an, nm)==1 { sg_w("  [allow] " as *u8); sg_w(nm); sg_w("\n" as *u8) }
71                    else { sg_w("  [VIOLATION new-tsv] " as *u8); sg_w(nm); sg_w("\n" as *u8); viol=viol+1 }
72                } }
73                if reclen<=0 {pos=nread} else {pos=pos+reclen}
74            }
75        }
76    }
77    sys_close(dfd)
78    sg_w("=== sov-guard " as *u8); sg_w(dir); sg_w(": " as *u8); sg_wn(total); sg_w(" tsv, " as *u8); sg_wn(viol); sg_w(" violation(s) ===\n" as *u8)
79    return viol
80}
81
82func main(argc: i64, argv: *i64) -> i64 {
83    var dir: *u8 = SG_DIR_DEF; if argc>=2 { dir = argv[1] as *u8 }
84    var allow: *u8 = SG_ALLOW_DEF; if argc>=3 { allow = argv[2] as *u8 }
85    let v: i64 = sg_scan(dir, allow)
86    if v < 0 { return 2 }
87    if v == 0 { sg_w("GREEN: no new/unallowlisted tsv (sovereign seg-store is the default)\n" as *u8); return 0 }
88    sg_w("RED: migrate the violation(s) to the sovereign seg-store (knowledge/store/<ns>-*), or allowlist with an owner note\n" as *u8); return 1
89}
nx_sov_guard.nx source

`nx_sov_guard.nx` source
