nx_sov_guard2_gate.nx source

1// nx_sov_guard2_gate.nx -- gates the no-new-tsv RATCHET on the behaviour that makes it a tooth rather than a 2// slogan. The v1 organ failed silently because it only ever scanned ONE directory and nothing proved otherwise; 3// so T2 exists specifically to prove MULTI-DIR coverage -- the exact blind spot that let 3 new tsv land today. 4// T1 snapshot arms the ratchet at the current count · T2 a violation in the SECOND configured dir is still seen 5// (single-dir blindness cannot regress) · T3 a NEW tsv above baseline = RED exit 1 and is NAMED · T4 removing it 6// returns GREEN (the ratchet releases, so it is silenceable by real work) · T5 an allowlisted tsv is NOT counted. 7// license_tier: ORIGINAL expect_exit: 0 8import "nx_store_seed_lib.nx" 9import "nx_seg_store.nx" 10import "nx_syscalls.nx" 11 12func gg_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 13func gg_pn(v: i64) -> i64 { let b: *u8=sys_mmap(32) as *u8; var x: i64=v; var ng: i64=0; if x<0{ng=1;x=0-x} var i: i64=31; if x==0{b[i]=48 as u8;i=i-1} while x>0{b[i]=(48+x%10) as u8;x=x/10;i=i-1} if ng==1{b[i]=45 as u8;i=i-1} sys_write(1,(b as i64+i+1) as *u8,31-i); return 0 } 14func gg_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 15func gg_wfile(path: *u8, content: *u8) -> i64 { 16 let fd: i64=sys_openat_wr(path, 0x1a4) 17 if fd<0 { return 0-1 } 18 sys_write(fd, content, gg_slen(content)) 19 sys_close(fd) 20 return 0 21} 22func gg_unlink(path: *u8) -> i64 { return sys_unlinkat(path) } 23func gg_has(buf: *u8, n: i64, needle: *u8) -> i64 { 24 let nl: i64=gg_slen(needle) 25 if nl==0 { return 0 } 26 var i: i64=0 27 while i+nl<=n { 28 var k: i64=0; var ok: i64=1 29 while k<nl { if buf[i+k]!=needle[k] { ok=0; k=nl } else { k=k+1 } } 30 if ok==1 { return 1 } 31 i=i+1 32 } 33 return 0 34} 35func gg_run(dir: *u8, verb: *u8) -> i64 { 36 let pid: i64=sys_fork() 37 if pid<0 { return 201 } 38 if pid==0 { 39 sys_chdir(dir) 40 let av: *i64=sys_mmap(32) as *i64 41 av[0]="/tmp/nx_sov_guard2.sov.elf\x00" as *u8 as i64 42 av[1]=verb as i64; av[2]=0 43 sys_execve("/tmp/nx_sov_guard2.sov.elf\x00" as *u8, av, 0 as *i64) 44 sys_exit(127) 45 return 127 46 } 47 let stp: *i64=sys_mmap(16) as *i64 48 sys_wait4(pid, stp, 0) 49 return (stp[0]>>8)&255 50} 51 52func main() -> i64 { 53 gg_puts("=== nx_sov_guard2_gate -- no-new-tsv ratchet: multi-dir coverage + rise=verdict=RED + release=GREEN ===\n" as *u8) 54 var fails: i64=0 55 sys_mkdir("/tmp/sg2\x00" as *u8, 0x1ed) 56 sys_mkdir("/tmp/sg2/knowledge\x00" as *u8, 0x1ed) 57 sys_mkdir("/tmp/sg2/knowledge/registry\x00" as *u8, 0x1ed) 58 sys_mkdir("/tmp/sg2/knowledge/status\x00" as *u8, 0x1ed) 59 sys_mkdir("/tmp/sg2/knowledge/store\x00" as *u8, 0x1ed) 60 sys_mkdir("/tmp/sg2/dirA\x00" as *u8, 0x1ed) 61 sys_mkdir("/tmp/sg2/dirB\x00" as *u8, 0x1ed) 62 // allowlist grandfathers exactly one name 63 gg_wfile("/tmp/sg2/knowledge/registry/tsv_allow.list\x00" as *u8, "# hdr\ngrandfathered.tsv\n\x00" as *u8) 64 // scan-set = TWO dirs (the v1 blind spot made explicit), configured via the NATIVE plane 65 let cfg: *u8="dir\x09dirA\ndir\x09dirB\n\x00" as *u8 66 sts_seed("/tmp/sg2/knowledge/store/sovguard-\x00" as *u8, cfg, gg_slen(cfg)) 67 // baseline population: 1 legacy in dirA + 1 allowlisted (must NOT count) 68 gg_wfile("/tmp/sg2/dirA/legacy_one.tsv\x00" as *u8, "x\n\x00" as *u8) 69 gg_wfile("/tmp/sg2/dirA/grandfathered.tsv\x00" as *u8, "x\n\x00" as *u8) 70 // T1 snapshot arms the ratchet 71 let rc1: i64=gg_run("/tmp/sg2\x00" as *u8, "snapshot\x00" as *u8) 72 let szp: *i64=sys_mmap(16) as *i64 73 var t1: i64=0 74 if rc1==0 { t1=1 } 75 if t1==1 { gg_puts("T1 PASS snapshot armed the ratchet at the current count\n" as *u8) } else { fails=fails+1; gg_puts("T1 FAIL rc="); gg_pn(rc1); gg_puts("\n" as *u8) } 76 // T5 allowlisted file must NOT be counted -- baseline should be 1, not 2 77 let lg0: *u8=sys_read_file("/tmp/sg2/knowledge/status/sov_guard.log\x00" as *u8, szp) 78 let rcq: i64=gg_run("/tmp/sg2\x00" as *u8, "check\x00" as *u8) 79 let lg1: *u8=sys_read_file("/tmp/sg2/knowledge/status/sov_guard.log\x00" as *u8, szp) 80 var t5: i64=0 81 if (lg1 as i64)!=0 { if gg_has(lg1, szp[0], "unallowlisted_tsv=1 \x00" as *u8)==1 { t5=1 } } 82 if t5==1 { gg_puts("T5 PASS allowlisted tsv excluded from the count (1 counted, not 2)\n" as *u8) } else { fails=fails+1; gg_puts("T5 FAIL allowlist not honoured\n" as *u8) } 83 // T2+T3 a NEW tsv in the SECOND dir must be SEEN (multi-dir) and trip RED, named 84 gg_wfile("/tmp/sg2/dirB/sneaky_new.tsv\x00" as *u8, "x\n\x00" as *u8) 85 let rc3: i64=gg_run("/tmp/sg2\x00" as *u8, "check\x00" as *u8) 86 let lg2: *u8=sys_read_file("/tmp/sg2/knowledge/status/sov_guard.log\x00" as *u8, szp) 87 var t2: i64=0 88 if (lg2 as i64)!=0 { if gg_has(lg2, szp[0], "dirB/sneaky_new.tsv\x00" as *u8)==1 { t2=1 } } 89 if t2==1 { gg_puts("T2 PASS SECOND configured dir is scanned -- v1's single-dir blindness cannot regress\n" as *u8) } else { fails=fails+1; gg_puts("T2 FAIL second dir not scanned (the exact v1 root)\n" as *u8) } 90 var t3: i64=0 91 if rc3==1 { if (lg2 as i64)!=0 { if gg_has(lg2, szp[0], "VERDICT=RED\x00" as *u8)==1 { t3=1 } } } 92 if t3==1 { gg_puts("T3 PASS count ROSE above baseline -> RED exit 1, offender named\n" as *u8) } else { fails=fails+1; gg_puts("T3 FAIL rc="); gg_pn(rc3); gg_puts("\n" as *u8) } 93 // T4 removing it releases the ratchet (silenceable by real work, not by editing the rule) 94 gg_unlink("/tmp/sg2/dirB/sneaky_new.tsv\x00" as *u8) 95 let rc4: i64=gg_run("/tmp/sg2\x00" as *u8, "check\x00" as *u8) 96 var t4: i64=0 97 if rc4==0 { t4=1 } 98 if t4==1 { gg_puts("T4 PASS removing the new tsv returns GREEN (ratchet releases to real work)\n" as *u8) } else { fails=fails+1; gg_puts("T4 FAIL rc="); gg_pn(rc4); gg_puts("\n" as *u8) } 99 if fails==0 { gg_puts("SOV-GUARD2 verdict=GREEN -- the no-new-tsv law now has a tooth that can actually bite\n" as *u8); sys_exit(0); return 0 } 100 gg_puts("SOV-GUARD2 verdict=RED fails="); gg_pn(fails); gg_puts("\n" as *u8) 101 sys_exit(1) 102 return 1 103}