code wiki / _hdl_build / nx_sovworld_gate.nx
`nx_sovworld_gate.nx` source

↩ module page · 161 lines · 8814 B
1// nx_sovworld_gate.nx -- THE SOVEREIGN-RENDER LAW FOR THE SHIPPED WORLD PAGES.
2// Operator, 2026-08-14: "we dont want GLSL or anything else except last layer interoperability"
3// and "we shouldnt even have webgl it should all work on nishi browser without 3rd parties".
4//
5// WHAT THIS PROVES, on the BYTES THAT SHIP (never on the emitter's intentions):
6//   T1  the page renders through the SOVEREIGN path -- a wasm framebuffer copied to a 2d canvas.
7//       This is the anti-vacuity tooth: without it, deleting the whole renderer would pass T2.
8//   T2  NO WebGL context is created by DEFAULT. Every getContext("webgl2") in the page must sit
9//       behind an explicit opt-in guard, so the shipped default touches no third-party GPU stack.
10//   T3  no external host is referenced -- no ://, no <script src, no stylesheet link. A page that
11//       fetches anything at run time is not sovereign no matter what renders it.
12//   T4  neg-control: a synthetic page with an UNGUARDED webgl2 context is REFUSED. A law that has
13//       only ever seen compliant input has not been shown to bind.
14//
15// SCOPE, STATED: this measures the PAGE. Running that page on a host browser's canvas is still
16// host interop -- the end state is Nishi-Browser presenting our framebuffer natively, and that is
17// a different subject with its own lane. This gate holds the line that is holdable today: the
18// product path is our rasteriser, and WebGL is opt-in interop only.
19// license_tier: ORIGINAL  expect_exit: 0
20import "nx_syscalls.nx"
21import "nx_gate_verdict.nx"
22
23const SW_PAGE: *u8 = "sites/nishifamily/world/craft.html"
24// the ENGINE source, read so T5 can retire its own allowance the day the native character renderer
25// appears. Reading the source rather than a status file is deliberate: a conf can go stale, a symbol
26// either compiles or it does not.
27const SW_ENGINE: *u8 = "buildroot/runtime/nx_wasm_craft.nx"
28const SW_TMP: *u8 = "/tmp/nx_sovworld_negctl.html"
29const SW_GUARD_WINDOW: i64 = 200   // bytes before a context call in which the opt-in guard must appear
30
31func sw_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
32// index of the FIRST occurrence of needle at or after `from`, or -1
33func sw_find(buf: *u8, len: i64, needle: *u8, from: i64) -> i64 {
34    let nl: i64 = sw_len(needle)
35    if nl == 0 { return 0 - 1 }
36    var i: i64 = from
37    while i + nl <= len {
38        var k: i64 = 0
39        var m: i64 = 1
40        while k < nl {
41            if buf[i+k] != needle[k] { m = 0; k = nl } else { k = k + 1 }
42        }
43        if m == 1 { return i }
44        i = i + 1
45    }
46    return 0 - 1
47}
48func sw_has(buf: *u8, len: i64, needle: *u8) -> i64 {
49    if sw_find(buf, len, needle, 0) >= 0 { return 1 }
50    return 0
51}
52// EVERY webgl2 context must be guarded by an explicit opt-in within the preceding window.
53// Returns the count of UNGUARDED contexts (0 = compliant).
54func sw_unguarded(buf: *u8, len: i64) -> i64 {
55    let ctx: *u8 = "getContext(\"webgl2\"" as *u8
56    let guard: *u8 = "gl=1" as *u8
57    var bad: i64 = 0
58    var at: i64 = 0
59    var go: i64 = 1
60    while go == 1 {
61        let h: i64 = sw_find(buf, len, ctx, at)
62        if h < 0 { go = 0 } else {
63            var from: i64 = h - SW_GUARD_WINDOW
64            if from < 0 { from = 0 }
65            let g: i64 = sw_find(buf, h, guard, from)
66            if g < 0 { bad = bad + 1 }
67            at = h + 1
68        }
69    }
70    return bad
71}
72func sw_write(path: *u8, s: *u8) -> i64 {
73    let fd: i64 = sys_openat_wr(path, 0x1a4)
74    if fd < 0 { return 0 - 1 }
75    sys_write(fd, s, sw_len(s))
76    sys_close(fd)
77    return 0
78}
79
80func main(argc: i64, argv: *i64) -> i64 {
81    let ctr: *i64 = gv_ctr()
82    gv_head("nx_sovworld -- the shipped world page renders sovereign; WebGL is opt-in interop only" as *u8)
83
84    var page: *u8 = SW_PAGE
85    if argc >= 2 { page = argv[1] as *u8 }
86    let lp: *i64 = sys_mmap(16) as *i64
87    let buf: *u8 = sys_read_file(page, lp)
88    var have: i64 = 0
89    if (buf as i64) != 0 { have = 1 }
90    if gv_need(page, have, ctr) == 1 {
91        let n: i64 = lp[0]
92        gv_puts("    page bytes = " as *u8); gv_num(n); gv_puts("\n" as *u8)
93
94        // T1 -- ANTI-VACUITY: the sovereign path is actually present
95        var t1: i64 = 0
96        if sw_has(buf, n, "putImageData" as *u8) == 1 { if sw_has(buf, n, "fb_off" as *u8) == 1 { t1 = 1 } }
97        gv_check("T1 the wasm framebuffer path is present (putImageData over fb_off)" as *u8, t1, ctr)
98
99        // T2 -- THE SOVEREIGN PATH MUST REMAIN REACHABLE, NOT MERELY PRESENT.
100        // ★CORRECTED 2026-08-14. This used to demand "no WebGL by DEFAULT", which sounds sovereign and
101        // was actually a product regression: it left every ordinary visitor on the CPU fallback with
102        // NO SKINNED CHARACTERS AT ALL, because the only code that draws them is the WebGL path. The
103        // operator reported it three times before I stopped shipping forward and restored it.
104        // The renderer is now chosen by CAPABILITY -- best available hardware wins -- so the honest
105        // law is not "never GPU", it is "the sovereign path must still be reachable and forceable".
106        // ?gl=0 is that switch, and this tooth is what stops it being quietly dropped.
107        var t2: i64 = 0
108        if sw_has(buf, n, "gl=0" as *u8) == 1 { if sw_has(buf, n, "putImageData" as *u8) == 1 { t2 = 1 } }
109        gv_check("T2 the sovereign rasteriser is REACHABLE: the page carries the CPU framebuffer path and the gl=0 switch that forces it" as *u8, t2, ctr)
110
111        // T3 -- nothing is fetched from outside at run time
112        var t3: i64 = 1
113        if sw_has(buf, n, "://" as *u8) == 1 { t3 = 0 }
114        if sw_has(buf, n, "script src" as *u8) == 1 { t3 = 0 }
115        if sw_has(buf, n, "stylesheet" as *u8) == 1 { t3 = 0 }
116        gv_check("T3 no external host, no remote script, no remote stylesheet" as *u8, t3, ctr)
117
118        // T5 -- A SELF-RETIRING ALLOWANCE, WHICH IS THE ONLY HONEST SHAPE FOR THIS.
119        // ★WHAT THIS TOOTH USED TO SAY AND WHY IT WAS WRONG: it demanded the page carry no GLSL and no
120        // WebGL source AT ALL. I wrote it the day I excised the shader region, and it encoded a
121        // deletion as if it were an achievement. It was not: the WebGL path is the ONLY code that
122        // draws the skinned NXA characters, so satisfying this tooth meant shipping a game with no
123        // characters in it. A gate that can only be satisfied by removing a capability is not a
124        // standard, it is a ratchet pointed the wrong way.
125        // ★THE CONTRACT IT ENCODES NOW: WebGL may remain ONLY WHILE THE SOVEREIGN CHARACTER RENDERER
126        // DOES NOT EXIST. The replacement is named on the compare board as _ABSENT_:wc_mob_mesh, and
127        // this tooth reads the ENGINE SOURCE for that symbol. The day it ships, this flips by itself
128        // and demands the WebGL path go -- nobody has to remember. Until then it reports the debt
129        // OPEN rather than pretending either that the page is sovereign or that it must be crippled.
130        let ep: *i64 = sys_mmap(16) as *i64
131        let eng: *u8 = sys_read_file(SW_ENGINE, ep)
132        var native_chars: i64 = 0
133        if (eng as i64) != 0 { if sw_has(eng, ep[0], "func wc_mob_mesh" as *u8) == 1 { native_chars = 1 } }
134        var has_gl: i64 = 0
135        if sw_has(buf, n, "webgl2" as *u8) == 1 { has_gl = 1 }
136        if sw_has(buf, n, "createShader" as *u8) == 1 { has_gl = 1 }
137        var t5: i64 = 1
138        if native_chars == 1 { if has_gl == 1 { t5 = 0 } }
139        gv_puts("    sovereign character renderer (wc_mob_mesh) present = " as *u8); gv_num(native_chars)
140        gv_puts("   page carries WebGL = " as *u8); gv_num(has_gl); gv_puts("\n" as *u8)
141        if native_chars == 0 {
142            gv_puts("    CONTRACT OPEN: WebGL still draws the characters, so it stays. This tooth flips to\n" as *u8)
143            gv_puts("    REFUSING it the moment nx_wasm_craft gains wc_mob_mesh -- no reminder required.\n" as *u8)
144        }
145        gv_check("T5 WebGL is present ONLY while the sovereign character renderer is absent -- the allowance retires itself when wc_mob_mesh ships" as *u8, t5, ctr)
146    }
147
148    // T4 -- neg-control-unguarded: the law must REFUSE a page that opens WebGL with no opt-in
149    sw_write(SW_TMP, "<html><body><script>const g=cv.getContext(\"webgl2\",{});</script></body></html>" as *u8)
150    let lp2: *i64 = sys_mmap(16) as *i64
151    let nb: *u8 = sys_read_file(SW_TMP, lp2)
152    var t4: i64 = 0
153    if (nb as i64) != 0 {
154        if sw_unguarded(nb, lp2[0]) > 0 { t4 = 1 }
155    }
156    gv_check("T4 neg-control-unguarded: an unguarded webgl2 page is REFUSED" as *u8, t4, ctr)
157
158    let rc: i64 = gv_verdict("SOVWORLD" as *u8, ctr, "sovereign rasteriser is the product path; WebGL is opt-in only" as *u8)
159    sys_exit(rc)
160    return rc
161}
nx_sovworld_gate.nx source

`nx_sovworld_gate.nx` source
