code wiki / _hdl_build / nx_sov_guard_gate.nx
`nx_sov_guard_gate.nx` source

1// nx_sov_guard_gate.nx -- SOVEREIGN gate for the no-new-tsv guard.
2//   T1 mixed dir (ok.tsv allowlisted, new.tsv NOT, notes.txt non-tsv) + allow=[ok.tsv] -> exactly 1 violation
3//      (proves: new tsv CAUGHT, allowlisted PASSED, non-tsv IGNORED)
4//   T2 clean dir (only ok.tsv) + allow=[ok.tsv] -> 0 violations (GREEN, neg-control)
5//   T3 LIAR-KILL: mixed dir + EMPTY allowlist -> 2 violations (the guard isn't silently passing)
6// license_tier: ORIGINAL
7import "nx_syscalls.nx"
8import "nx_sov_guard.nx"   // sg_scan / sg_w / sg_wn
9import "nx_gate_verdict.nx"
10
11func gg_uw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12func gg_touch(path: *u8) -> i64 { let fd: i64=sys_openat_wr(path, 0x1a4); if fd>=0 { sys_close(fd) } return 0 }
13func gg_write(path: *u8, s: *u8, len: i64) -> i64 { let fd: i64=sys_openat_wr(path, 0x1a4); if fd>=0 { sys_write(fd,s,len); sys_close(fd) } return 0 }
14
15func main(argc: i64, argv: *i64) -> i64 {
16    var pass: i64=0; var total: i64=0
17
18    sys_mkdir("/tmp/sg_t1" as *u8, 0x1ff)
19    gg_touch("/tmp/sg_t1/ok.tsv" as *u8); gg_touch("/tmp/sg_t1/new.tsv" as *u8); gg_touch("/tmp/sg_t1/notes.txt" as *u8)
20    sys_mkdir("/tmp/sg_t2" as *u8, 0x1ff)
21    gg_touch("/tmp/sg_t2/ok.tsv" as *u8)
22    gg_write("/tmp/sg_allow" as *u8, "ok.tsv\n" as *u8, 7)
23    gg_write("/tmp/sg_empty" as *u8, "" as *u8, 0)
24
25    let v1: i64 = sg_scan("/tmp/sg_t1" as *u8, "/tmp/sg_allow" as *u8)
26    total=total+1; if v1==1 { pass=pass+1; gg_uw("[PASS] " as *u8) } else { gg_uw("[FAIL] " as *u8) }
27    gg_uw("T1 mixed dir + allow -> violations=" as *u8); sg_wn(v1); gg_uw(" (want 1: new.tsv caught, ok.tsv passed, notes.txt ignored)\n" as *u8)
28
29    let v2: i64 = sg_scan("/tmp/sg_t2" as *u8, "/tmp/sg_allow" as *u8)
30    total=total+1; if v2==0 { pass=pass+1; gg_uw("[PASS] " as *u8) } else { gg_uw("[FAIL] " as *u8) }
31    gg_uw("T2 clean dir -> violations=" as *u8); sg_wn(v2); gg_uw(" (want 0: GREEN neg-control)\n" as *u8)
32
33    let v3: i64 = sg_scan("/tmp/sg_t1" as *u8, "/tmp/sg_empty" as *u8)
34    total=total+1; if v3==2 { pass=pass+1; gg_uw("[PASS] " as *u8) } else { gg_uw("[FAIL] " as *u8) }
35    gg_uw("T3 empty allowlist -> violations=" as *u8); sg_wn(v3); gg_uw(" (want 2: liar-kill, both tsv flagged)\n" as *u8)
36
37    gg_uw("=== nx_sov_guard_gate " as *u8); sg_wn(pass); gg_uw("/" as *u8); sg_wn(total)
38    // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
39    // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
40    // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
41    let ctr__dry: *i64 = gv_ctr()
42    ctr__dry[0] = pass
43    ctr__dry[1] = total
44    let rc__dry: i64 = gv_verdict("SOV-GUARD-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
45    sys_exit(rc__dry)
46    return rc__dry
47}
nx_sov_guard_gate.nx source

`nx_sov_guard_gate.nx` source
