nx_tokgate_gate.nx source

1// nx_tokgate_gate.nx -- the REFEREE for nx_tokgate (engineshift ES17, 2026-09-02). Its whole input arrives on 2// fd 0, so every tooth drives it through gk_run_capture_in with a real PreToolUse payload on stdin. 3// u2605 A HOOK ORGAN TESTED WITHOUT ITS STDIN IS TESTED WITHOUT ITS INPUT. 4// nx_tokgate_gate [subject-elf] default _build/nx_tokgate.sov.elf (cwd nxc2) 5// Fixtures are assembled at runtime under /tmp/nx_tokgate_gate/. license_tier: ORIGINAL. No hw writes. 6import "nx_syscalls.nx" 7import "nx_gate_verdict.nx" 8import "nx_gatekit_lib.nx" 9 10const TGG_CAP: i64 = 131072 11const TGG_BIG: i64 = 4096 // above the bootstrap floor (3072) and above the fixture conf floor (1000) 12const TGG_MID: i64 = 1500 // above the fixture conf floor (1000), below the bootstrap floor (3072) 13const TGG_SMALL: i64 = 400 // below every floor 14const TGG_ROOT: *u8 = "/tmp/nx_tokgate_gate" 15const TGG_CONF: *u8 = "/tmp/nx_tokgate_gate/tokgate.conf" 16const TGG_NOCONF: *u8 = "/tmp/nx_tokgate_gate/absent.conf" 17const TGG_BIGF: *u8 = "/tmp/nx_tokgate_gate/big.txt" 18const TGG_MIDF: *u8 = "/tmp/nx_tokgate_gate/mid.txt" 19const TGG_SMALLF: *u8 = "/tmp/nx_tokgate_gate/small.txt" 20// ---- ES22 shell interlock fixtures ---- 21const TGG_SHELLCONF: *u8 = "/tmp/nx_tokgate_gate/shellverb.conf" 22const TGG_NOSHELLCONF: *u8 = "/tmp/nx_tokgate_gate/absent_shellverb.conf" 23const TGG_TREE: *u8 = "/tmp/nx_tokgate_gate/tree" 24const TGG_TREE_FS: *u8 = "/tmp/nx_tokgate_gate/tree/nx_fs.nx" 25const TGG_TREE_TXT: *u8 = "/tmp/nx_tokgate_gate/tree/nx_txtscan.nx" 26const TGG_TREE_JOB: *u8 = "/tmp/nx_tokgate_gate/tree/nx_job_run.nx" // deliberately NEVER written: the source=ABSENT control 27 28// a file of exactly n bytes of 'x' 29func tgg_fill(path: *u8, n: i64) -> i64 { 30 let b: *u8 = sys_mmap(n + 1) 31 var i: i64 = 0 32 while i < n { b[i] = 120 as u8; i = i + 1 } 33 b[n] = 0 as u8 34 gk_write(path, b) 35 return 0 36} 37 38// {"session_id":"s","tool_name":"<tool>","tool_input":{<inner>}} 39func tgg_payload(path: *u8, tool: *u8, inner: *u8) -> i64 { 40 let b: *u8 = sys_mmap(8192) 41 var o: i64 = gk_cat(b, 0, "{\"session_id\":\"s\",\"tool_name\":\"" as *u8) 42 o = gk_cat(b, o, tool) 43 o = gk_cat(b, o, "\",\"tool_input\":{" as *u8) 44 o = gk_cat(b, o, inner) 45 o = gk_cat(b, o, "}}" as *u8) 46 b[o] = 0 as u8 47 gk_write(path, b) 48 return 0 49} 50 51func tgg_run(elf: *u8, conf: *u8, payload: *u8, buf: *u8, ln: *i64) -> i64 { 52 return gk_run_capture_in(elf, conf, 0 as *u8, 0 as *u8, 0 as *u8, payload, buf, TGG_CAP, ln) 53} 54// the ES22 form: argv[2] is the shellverb conf 55func tgg_run2(elf: *u8, conf: *u8, shellconf: *u8, payload: *u8, buf: *u8, ln: *i64) -> i64 { 56 return gk_run_capture_in(elf, conf, shellconf, 0 as *u8, 0 as *u8, payload, buf, TGG_CAP, ln) 57} 58 59func tgg_wellformed(buf: *u8, n: i64) -> i64 { 60 if n < 2 { return 0 } 61 if buf[0] != 123 as u8 { return 0 } 62 if buf[n - 1] != 125 as u8 { return 0 } 63 var i: i64 = 0 64 while i < n { if buf[i] == 10 as u8 { return 0 } i = i + 1 } 65 return 1 66} 67 68func main(argc: i64, argv: *i64) -> i64 { 69 var elf: *u8 = "_build/nx_tokgate.sov.elf" as *u8 70 if argc >= 2 { elf = argv[1] as *u8 } 71 gv_head("NX-TOKGATE-GATE: the token pre-flight, driven through real stdin payloads" as *u8) 72 let ctr: *i64 = gv_ctr() 73 gv_need("subject elf present" as *u8, gk_exists(elf), ctr) 74 75 gk_mkdir(TGG_ROOT) 76 gk_rm(TGG_NOCONF) 77 gk_write(TGG_CONF, "# fixture\nfloor_bytes|1000\n" as *u8) 78 tgg_fill(TGG_BIGF, TGG_BIG) 79 tgg_fill(TGG_MIDF, TGG_MID) 80 tgg_fill(TGG_SMALLF, TGG_SMALL) 81 gv_check("fixture-reached-the-condition: big is 4096 B, mid 1500 B, small 400 B on disk" as *u8, (gk_size(TGG_BIGF) == TGG_BIG) * (gk_size(TGG_MIDF) == TGG_MID) * (gk_size(TGG_SMALLF) == TGG_SMALL), ctr) 82 let buf: *u8 = sys_mmap(TGG_CAP) 83 let ln: *i64 = sys_mmap(16) as *i64 84 let p: *u8 = sys_mmap(256) 85 86 // ---- Read ---- 87 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p1.json" as *u8) 88 tgg_payload(p, "Read" as *u8, "\"file_path\":\"/tmp/nx_tokgate_gate/big.txt\"" as *u8) 89 let rc1: i64 = tgg_run(elf, TGG_CONF, p, buf, ln) 90 gv_check("T1 a whole-file Read above the floor draws the advisory, naming the file and its byte count" as *u8, gk_out_has(buf, ln[0], "TOKEN PRE-FLIGHT" as *u8) * gk_out_has(buf, ln[0], "big.txt is 4096 B" as *u8) * gk_out_has(buf, ln[0], "systemMessage" as *u8), ctr) 91 gv_check("T2 the advisory names cheaper verbs that exist (offset and limit, Grep -n)" as *u8, gk_out_has(buf, ln[0], "offset and limit" as *u8) * gk_out_has(buf, ln[0], "Grep -n" as *u8), ctr) 92 gv_check("T3 the floor is read from DATA and the message says so (floor 1000 B, floor_src=conf)" as *u8, gk_out_has(buf, ln[0], "floor 1000 B, floor_src=conf" as *u8), ctr) 93 gv_check("neg-control-never-blocks: no permissionDecision, no deny, exit 0" as *u8, (1 - gk_out_has(buf, ln[0], "permissionDecision" as *u8)) * (1 - gk_out_has(buf, ln[0], "deny" as *u8)) * (rc1 == 0), ctr) 94 gv_check("T4 the emitted payload is one well-formed JSON object with no raw newline" as *u8, tgg_wellformed(buf, ln[0]), ctr) 95 96 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p2.json" as *u8) 97 tgg_payload(p, "Read" as *u8, "\"file_path\":\"/tmp/nx_tokgate_gate/small.txt\"" as *u8) 98 tgg_run(elf, TGG_CONF, p, buf, ln) 99 gv_check("neg-control-a-Read-under-the-floor-is-SILENT (firing on small reads is how a pre-flight gets disabled)" as *u8, ln[0] == 0, ctr) 100 101 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p3.json" as *u8) 102 tgg_payload(p, "Read" as *u8, "\"file_path\":\"/tmp/nx_tokgate_gate/big.txt\",\"limit\":40" as *u8) 103 tgg_run(elf, TGG_CONF, p, buf, ln) 104 gv_check("T5 a bounded Read (limit given) is already the cheap form: silent" as *u8, ln[0] == 0, ctr) 105 106 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p4.json" as *u8) 107 tgg_payload(p, "Read" as *u8, "\"file_path\":\"/tmp/nx_tokgate_gate/mid.txt\"" as *u8) 108 tgg_run(elf, TGG_CONF, p, buf, ln) 109 let mid_conf: i64 = gk_out_has(buf, ln[0], "mid.txt is 1500 B" as *u8) 110 tgg_run(elf, TGG_NOCONF, p, buf, ln) 111 gv_check("T6 the floor discriminates: 1500 B fires under the conf floor (1000) and is silent under the bootstrap floor (3072)" as *u8, mid_conf * (ln[0] == 0), ctr) 112 113 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p5.json" as *u8) 114 tgg_payload(p, "Read" as *u8, "\"file_path\":\"/tmp/nx_tokgate_gate/big.txt\"" as *u8) 115 tgg_run(elf, TGG_NOCONF, p, buf, ln) 116 gv_check("T7 with the conf unreadable the bootstrap floor applies and the message NAMES floor_src=bootstrap" as *u8, gk_out_has(buf, ln[0], "big.txt is 4096 B" as *u8) * gk_out_has(buf, ln[0], "floor 3072 B, floor_src=bootstrap" as *u8), ctr) 117 118 // ---- nx_fs read ---- 119 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p6.json" as *u8) 120 tgg_payload(p, "mcp__nishi__nx_fs" as *u8, "\"argv\":[\"read\",\"buildroot/runtime/nx_big.nx\"]" as *u8) 121 tgg_run(elf, TGG_CONF, p, buf, ln) 122 gv_check("T8 an nx_fs read with NO byte cap draws the advisory and names nx_fs size first" as *u8, gk_out_has(buf, ln[0], "nx_fs read buildroot/runtime/nx_big.nx with NO byte cap" as *u8) * gk_out_has(buf, ln[0], "nx_fs size <path> first" as *u8), ctr) 123 124 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p7.json" as *u8) 125 tgg_payload(p, "mcp__nishi__nx_fs" as *u8, "\"argv\":[\"read\",\"buildroot/runtime/nx_big.nx\",\"800\"]" as *u8) 126 tgg_run(elf, TGG_CONF, p, buf, ln) 127 gv_check("T9 an nx_fs read capped under the floor is silent" as *u8, ln[0] == 0, ctr) 128 129 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p8.json" as *u8) 130 tgg_payload(p, "mcp__nishi__nx_fs" as *u8, "\"argv\":[\"read\",\"_jobs/job_1.out\",\"65536\"]" as *u8) 131 tgg_run(elf, TGG_CONF, p, buf, ln) 132 gv_check("T10 an nx_fs read capped above the floor fires with the cap named, and a job artifact is told to read its .claim first" as *u8, gk_out_has(buf, ln[0], "with cap 65536 B" as *u8) * gk_out_has(buf, ln[0], ".claim first" as *u8), ctr) 133 134 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p9.json" as *u8) 135 tgg_payload(p, "mcp__nishi__nx_fs" as *u8, "\"argv\":[\"size\",\"buildroot/runtime/nx_big.nx\"]" as *u8) 136 tgg_run(elf, TGG_CONF, p, buf, ln) 137 gv_check("neg-control-the-cheap-verb-itself-is-silent (nx_fs size draws nothing)" as *u8, ln[0] == 0, ctr) 138 139 // ---- other tools, garbage, empty ---- 140 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p10.json" as *u8) 141 tgg_payload(p, "Edit" as *u8, "\"file_path\":\"/tmp/nx_tokgate_gate/big.txt\",\"old_string\":\"a\",\"new_string\":\"b\"" as *u8) 142 tgg_run(elf, TGG_CONF, p, buf, ln) 143 gv_check("T11 a tool this organ neither sizes nor interlocks (Edit) is silent" as *u8, ln[0] == 0, ctr) 144 145 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p11.json" as *u8) 146 gk_write(p, "not json at all {{{ \"file_path\" " as *u8) 147 let rc11: i64 = tgg_run(elf, TGG_CONF, p, buf, ln) 148 gv_check("neg-control-garbage-in-silence-out-and-exit-0 (a hook that fails noisily poisons every tool call)" as *u8, (ln[0] == 0) * (rc11 == 0), ctr) 149 150 gk_cat(p, 0, "/tmp/nx_tokgate_gate/p12.json" as *u8) 151 gk_write(p, "" as *u8) 152 let rc12: i64 = tgg_run(elf, TGG_CONF, p, buf, ln) 153 gv_check("T12 empty stdin is survived silently with exit 0" as *u8, (ln[0] == 0) * (rc12 == 0), ctr) 154 155 // ---- ES22 shell interlock: driven through real Bash and PowerShell payloads against a fixture verb table ---- 156 gk_mkdir(TGG_TREE) 157 gk_write(TGG_TREE_FS, "// stub: the fixture tree holds nx_fs" as *u8) 158 gk_write(TGG_TREE_TXT, "// stub: the fixture tree holds nx_txtscan" as *u8) 159 gk_rm(TGG_TREE_JOB) 160 gk_rm(TGG_NOSHELLCONF) 161 gk_write(TGG_SHELLCONF, "tree|/tmp/nx_tokgate_gate/tree/\nallow|/mnt/c/Users/elder/nishi-core/nxc2/_offc/|launcher\nallow|nishi-ops/hooks/wslguard.ps1|hook launcher\nverb|cat |nx_fs|read\nverb|grep |nx_txtscan|find\nverb|Get-Content|nx_fs|read\nverb|Select-String|nx_txtscan|find\nverb|python|nx_fs|direct call\nverb|nxmcp|nx_fs|direct call\nverb|sleep|nx_job_run|claim\nverb|ssh |nx_mgmt|control plane|nx_fs\n" as *u8) 162 gv_check("fixture-reached-the-condition: the fixture tree holds nx_fs.nx and nx_txtscan.nx and NOT nx_job_run.nx; the fixture conf exists; the absent conf does not" as *u8, gk_exists(TGG_TREE_FS) * gk_exists(TGG_TREE_TXT) * (1 - gk_exists(TGG_TREE_JOB)) * gk_exists(TGG_SHELLCONF) * (1 - gk_exists(TGG_NOSHELLCONF)), ctr) 163 164 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s1.json" as *u8) 165 tgg_payload(p, "Bash" as *u8, "\"command\":\"cat notes.txt | grep needle\",\"description\":\"look\"" as *u8) 166 let rs1: i64 = tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 167 let s1_bytes: i64 = ln[0] 168 gv_check("S1 a Bash cat-pipe-grep draws SHELL PRE-FLIGHT naming mcp__nishi__nx_fs and mcp__nishi__nx_txtscan" as *u8, gk_out_has(buf, ln[0], "SHELL PRE-FLIGHT" as *u8) * gk_out_has(buf, ln[0], "mcp__nishi__nx_fs" as *u8) * gk_out_has(buf, ln[0], "mcp__nishi__nx_txtscan" as *u8), ctr) 169 gv_check("S2 every verb named is one the tree can show (nx_fs and nx_txtscan source=present, nothing ABSENT)" as *u8, gk_out_has(buf, ln[0], "mcp__nishi__nx_fs source=present" as *u8) * gk_out_has(buf, ln[0], "mcp__nishi__nx_txtscan source=present" as *u8) * (1 - gk_out_has(buf, ln[0], "source=ABSENT" as *u8)), ctr) 170 gv_check("S3 the verb count is DISTINCT (verbs=2) and the command is echoed back so the reader sees which call drew it" as *u8, gk_out_has(buf, ln[0], "verbs=2" as *u8) * gk_out_has(buf, ln[0], "command: cat notes.txt | grep needle" as *u8), ctr) 171 gv_check("neg-control-shell-never-blocks: no permissionDecision, no deny, exit 0, one well-formed JSON object" as *u8, (1 - gk_out_has(buf, ln[0], "permissionDecision" as *u8)) * (1 - gk_out_has(buf, ln[0], "deny" as *u8)) * (rs1 == 0) * tgg_wellformed(buf, ln[0]), ctr) 172 173 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s2.json" as *u8) 174 tgg_payload(p, "PowerShell" as *u8, "\"command\":\"Get-Content x.txt | Select-String y\"" as *u8) 175 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 176 gv_check("S4 a PowerShell Get-Content-pipe-Select-String draws the advisory naming nx_fs and nx_txtscan and says PowerShell" as *u8, gk_out_has(buf, ln[0], "mcp__nishi__nx_fs" as *u8) * gk_out_has(buf, ln[0], "mcp__nishi__nx_txtscan" as *u8) * gk_out_has(buf, ln[0], "this PowerShell call" as *u8), ctr) 177 178 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s3.json" as *u8) 179 tgg_payload(p, "Bash" as *u8, "\"command\":\"python nxmcp.py nx_fs read buildroot/x\"" as *u8) 180 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 181 gv_check("S5 a python wire client names the direct MCP call ONCE (python and nxmcp both map to nx_fs: verbs=1, deduped)" as *u8, gk_out_has(buf, ln[0], "mcp__nishi__nx_fs" as *u8) * gk_out_has(buf, ln[0], "verbs=1" as *u8), ctr) 182 183 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s4.json" as *u8) 184 tgg_payload(p, "Bash" as *u8, "\"command\":\"wsl -e /mnt/c/Users/elder/nishi-core/nxc2/_offc/nx_sov_build_run.elf nx_x --build-only\"" as *u8) 185 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 186 let s4_bytes: i64 = ln[0] 187 gv_check("neg-control-sanctioned-launcher-is-SILENT (wsl -e _offc/<organ>.elf draws nothing)" as *u8, ln[0] == 0, ctr) 188 189 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s5.json" as *u8) 190 tgg_payload(p, "PowerShell" as *u8, "\"command\":\"& C:/Users/elder/nishi-ops/hooks/wslguard.ps1 -TimeoutSec 25 -Argv @(/mnt/c/Users/elder/nishi-core/nxc2/_offc/nx_tokgate.elf); exit $LASTEXITCODE\"" as *u8) 191 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 192 gv_check("neg-control-hook-launcher-is-SILENT (the wslguard wrapper around the same organs draws nothing)" as *u8, ln[0] == 0, ctr) 193 194 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s6.json" as *u8) 195 tgg_payload(p, "Bash" as *u8, "\"command\":\"frobnicate --now\"" as *u8) 196 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 197 let s6_bytes: i64 = ln[0] 198 gv_check("neg-control-unknown-command-draws-GAP-never-a-guessed-verb" as *u8, gk_out_has(buf, ln[0], "GAP" as *u8) * (1 - gk_out_has(buf, ln[0], "mcp__nishi__" as *u8)) * gk_out_has(buf, ln[0], "engineshift" as *u8), ctr) 199 200 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s7.json" as *u8) 201 tgg_payload(p, "Bash" as *u8, "\"command\":\"sleep 5\"" as *u8) 202 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 203 gv_check("S6 a verb row whose source no tree holds is reported source=ABSENT (the existence check is a stat, not a claim)" as *u8, gk_out_has(buf, ln[0], "mcp__nishi__nx_job_run" as *u8) * gk_out_has(buf, ln[0], "source=ABSENT" as *u8), ctr) 204 205 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s8.json" as *u8) 206 tgg_payload(p, "Bash" as *u8, "\"command\":\"ssh elderwesto@west_nas uptime\"" as *u8) 207 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 208 gv_check("S7 the source column resolves a tool whose source file is named otherwise (nx_mgmt via nx_fs: source=present)" as *u8, gk_out_has(buf, ln[0], "mcp__nishi__nx_mgmt source=present" as *u8), ctr) 209 210 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s9.json" as *u8) 211 tgg_payload(p, "Bash" as *u8, "\"command\":\"grep \\\"needle\\\" notes.txt\"" as *u8) 212 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 213 gv_check("S8 an escaped quote inside the command does not end it (JSON escapes decoded: the file name after the quote is still read)" as *u8, gk_out_has(buf, ln[0], "mcp__nishi__nx_txtscan" as *u8) * gk_out_has(buf, ln[0], "notes.txt" as *u8), ctr) 214 215 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s10.json" as *u8) 216 tgg_payload(p, "Bash" as *u8, "\"command\":\"cat x\"" as *u8) 217 let rs10: i64 = tgg_run2(elf, TGG_CONF, TGG_NOSHELLCONF, p, buf, ln) 218 gv_check("neg-control-unreadable-verb-table-says-so-and-guesses-nothing (shellverb.conf unreadable, GAP, no mcp__nishi__, exit 0)" as *u8, gk_out_has(buf, ln[0], "shellverb.conf unreadable" as *u8) * gk_out_has(buf, ln[0], "GAP" as *u8) * (1 - gk_out_has(buf, ln[0], "mcp__nishi__" as *u8)) * (rs10 == 0), ctr) 219 220 gk_cat(p, 0, "/tmp/nx_tokgate_gate/s11.json" as *u8) 221 tgg_payload(p, "Read" as *u8, "\"file_path\":\"/tmp/nx_tokgate_gate/big.txt\"" as *u8) 222 tgg_run2(elf, TGG_CONF, TGG_SHELLCONF, p, buf, ln) 223 gv_check("S9 the ES17 path is untouched by the interlock: a whole-file Read above the floor still draws TOKEN PRE-FLIGHT" as *u8, gk_out_has(buf, ln[0], "TOKEN PRE-FLIGHT" as *u8) * (1 - gk_out_has(buf, ln[0], "SHELL PRE-FLIGHT" as *u8)), ctr) 224 225 gv_values_head() 226 gv_kv("shell_advisory_bytes_bash" as *u8, s1_bytes) 227 gv_kv("launcher_bytes" as *u8, s4_bytes) 228 gv_kv("gap_bytes" as *u8, s6_bytes) 229 let rc: i64 = gv_verdict("NX-TOKGATE-GATE" as *u8, ctr, "ES17 tg_advise and ES22 tg_shell_interlock, driven through real stdin payloads; every tooth states its own claim" as *u8) 230 sys_exit(rc) 231 return rc 232}