code wiki / _hdl_build / nx_toolatency_staged_cli_gate.nx
nx_toolatency_staged_cli_gate.nx source
↩ module page · 158 lines · 11900 B
1// Subject execution only in fresh private CWDs, with complete retained captures.
2// The shared timed runner owns its child/watchdog lifecycle; no production signal/config writes.
3import "nx_toolatency_observation_lib.nx"
4import "nx_tool_run.nx"
5import "nx_gate_verdict.nx"
6const OC_ARGS: i64 = 6
7const OC_DIR_MODE: i64 = 448
8const OC_FILE_MODE: i64 = 384
9const OC_RETAINED_BYTES: i64 = 8165
10const OC_RETAINED_ROWS: i64 = 23
11const OC_SETUP_FAILURE: i64 = 126
12
13func oc_copy(b: *u8, p: i64, s: *u8) -> i64 {
14 var i: i64=0; while s[i] != (0 as u8) { b[p+i]=s[i]; i=i+1 }; b[p+i]=0 as u8; return p+i
15}
16func oc_path_ok(s: *u8, directory: i64) -> i64 {
17 let n: i64=to_len(s)
18 if n < 2 || n >= SYS_PATH_MAX/2 || s[0] != (47 as u8) { return 0 }
19 var p: i64=0; while p < n { if s[p] < (33 as u8) || s[p] > (126 as u8) { return 0 }; p=p+1 }
20 if directory == 1 {
21 if n <= 5 || to_eq(s,0,5,"/tmp/" as *u8) != 1 { return 0 }
22 p=5
23 while p < n {
24 let c: i64=s[p] as i64
25 if (c < 48 || c > 57) && (c < 65 || c > 90) && (c < 97 || c > 122) && c != 45 && c != 95 { return 0 }; p=p+1
26 }
27 }; return 1
28}
29func oc_put(path: *u8, b: *u8, n: i64) -> i64 {
30 let fd: i64=sys_openat_exclusive(path,OC_FILE_MODE); if fd < 0 { return 0 }
31 var done: i64=0; var ok: i64=1
32 while done < n && ok == 1 {
33 let w: i64=sys_write(fd,((b as i64)+done) as *u8,n-done)
34 if w <= 0 { ok=0 } else { done=done+w }
35 }
36 if sys_fsync(fd) != 0 { ok=0 }; if sys_close(fd) != 0 { ok=0 }; return ok
37}
38func oc_read(path: *u8, b: *u8, cap: i64) -> i64 {
39 let fd: i64=sys_openat_rd(path); if fd < 0 { return 0-1 }
40 let n: i64=sys_lseek(fd,0,2); var ok: i64=1; var done: i64=0
41 if n < 0 || n > cap { ok=0 }
42 if sys_lseek(fd,0,0) != 0 { ok=0 }
43 while ok == 1 && done < n {
44 let got: i64=sys_read(fd,((b as i64)+done) as *u8,n-done)
45 if got <= 0 { ok=0 } else { done=done+got }
46 }
47 if sys_close(fd) != 0 { ok=0 }; if ok == 0 { return 0-1 }; return n
48}
49func oc_same(path: *u8, expected: *u8, n: i64, scratch: *u8, cap: i64) -> i64 {
50 if oc_read(path,scratch,cap) != n { return 0 }
51 var i: i64=0; while i < n { if scratch[i] != expected[i] { return 0 }; i=i+1 }; return 1
52}
53func oc_capture(subject: *u8, av: *i64, cwd: *u8, name: *u8, b: *u8, cap: i64, timeout: i64, expected_exit: i64, empty: i64, ctr: *i64) -> i64 {
54 let len: *i64=sys_mmap(TO_WORD_BYTES) as *i64
55 if (len as i64) <= 0 { gv_check("capture length allocation" as *u8,0,ctr); return 0-1 }
56 len[0]=0
57 let rc: i64=tr_run_capture_cwd(subject,av,b,cap,len,timeout,cwd); let n: i64=len[0]
58 gv_puts("case=" as *u8); gv_puts(name); gv_puts(" exit=" as *u8); gv_num(rc); gv_puts(" bytes=" as *u8); gv_num(n); gv_puts("\n" as *u8)
59 gv_check("actual staged exit" as *u8,rc == expected_exit,ctr)
60 var fit: i64=0
61 if n >= 0 && n < cap { if empty == 1 { fit=1 } else { if n > 0 { fit=1 } } }
62 gv_check("entire capture fits caller capacity" as *u8,fit,ctr)
63 var saved: i64=0; if n >= 0 && n <= cap { saved=oc_put(name,b,n) }
64 gv_check("exclusive capture retained with checked writes and close" as *u8,saved,ctr)
65 sys_munmap(len as *u8,TO_WORD_BYTES)
66 if fit != 1 || saved != 1 { return 0-1 }; return n
67}
68// Called only through this gate's verified /proc/self/exe path by the timed runner.
69// Closing stdout induces EBADF in the actual subject, without relying on /dev/full or pipe timing.
70func oc_closed(argc: i64, argv: *i64) -> i64 {
71 if argc != 5 { return OC_SETUP_FAILURE }
72 let subject: *u8=argv[2] as *u8
73 if oc_path_ok(subject,0) != 1 { return OC_SETUP_FAILURE }
74 let av: *i64=sys_mmap(OC_ARGS*TO_WORD_BYTES) as *i64; let env: *i64=sys_mmap(TO_WORD_BYTES) as *i64
75 if (av as i64) <= 0 || (env as i64) <= 0 { return OC_SETUP_FAILURE }
76 let mode: *u8="observations" as *u8; let zero: *u8="0" as *u8
77 av[0]=subject as i64; av[1]=mode as i64; av[2]=zero as i64; av[3]=argv[3]; av[4]=argv[4]; av[5]=0; env[0]=0
78 if sys_close(1) != 0 { return OC_SETUP_FAILURE }
79 sys_execve_clean(subject,av,env); return OC_SETUP_FAILURE
80}
81func main(argc: i64, argv: *i64) -> i64 {
82 if argc > 1 { let mode: *u8=argv[1] as *u8; if to_eq(mode,0,to_len(mode),"__closed_stdout" as *u8) == 1 { return oc_closed(argc,argv) } }
83 if argc != 8 { gv_puts("usage: gate absolute-staged-subject absolute-retained-journal /tmp/fresh-dir read_capacity row_capacity capture_capacity timeout_ms\n" as *u8); return 3 }
84 let subject: *u8=argv[1] as *u8; let source: *u8=argv[2] as *u8; let dir: *u8=argv[3] as *u8
85 if oc_path_ok(subject,0) != 1 || oc_path_ok(source,0) != 1 || oc_path_ok(dir,1) != 1 { return 3 }
86 let nums: *i64=sys_mmap(4*TO_WORD_BYTES) as *i64; if (nums as i64) <= 0 { return 3 }
87 var i: i64=0
88 while i < 4 { let s: *u8=argv[i+4] as *u8; if to_int(s,0,to_len(s),((nums as i64)+i*TO_WORD_BYTES) as *i64) != 1 { return 3 }; i=i+1 }
89 let readcap: i64=nums[0]; let rowcap: i64=nums[1]; let cap: i64=nums[2]; let timeout: i64=nums[3]
90 if readcap < OC_RETAINED_BYTES || readcap >= TO_MAX/2 || rowcap < OC_RETAINED_ROWS || rowcap > TO_MAX/(TO_ROW_SLOTS*TO_WORD_BYTES) || cap <= 0 || cap >= TO_MAX/2 || timeout <= 0 || timeout >= TO_MAX/2 { return 3 }
91 let ctr: *i64=gv_ctr(); gv_head("TOOL-OBSERVATIONS-STAGED / private executable captures" as *u8)
92 let raw: *u8=sys_mmap(readcap); let scratch: *u8=sys_mmap(readcap); let out: *u8=sys_mmap(cap)
93 let av: *i64=sys_mmap(OC_ARGS*TO_WORD_BYTES) as *i64; let self: *u8=sys_mmap(SYS_PATH_MAX)
94 if (raw as i64) <= 0 || (scratch as i64) <= 0 || (out as i64) <= 0 || (av as i64) <= 0 || (self as i64) <= 0 { return 3 }
95 let selfn: i64=sys_readlinkat("/proc/self/exe" as *u8,self,SYS_PATH_MAX)
96 if selfn <= 0 || selfn >= SYS_PATH_MAX { return 3 }; self[selfn]=0 as u8
97 let rn: i64=oc_read(source,raw,readcap)
98 gv_check("exact retained source length" as *u8,rn == OC_RETAINED_BYTES,ctr)
99 if rn != OC_RETAINED_BYTES { return gv_verdict("TOOL-OBSERVATIONS-STAGED" as *u8,ctr,"wrong fixture refused" as *u8) }
100 if sys_mkdir(dir,OC_DIR_MODE) != 0 { return 3 }; if sys_chdir(dir) != 0 { return 3 }
101 if sys_mkdir("knowledge" as *u8,OC_DIR_MODE) != 0 { return 3 }
102 if sys_mkdir("knowledge/status" as *u8,OC_DIR_MODE) != 0 { return 3 }
103 if sys_mkdir("missing" as *u8,OC_DIR_MODE) != 0 { return 3 }
104 if sys_mkdir("unicode" as *u8,OC_DIR_MODE) != 0 { return 3 }
105 if sys_mkdir("unicode/knowledge" as *u8,OC_DIR_MODE) != 0 { return 3 }
106 if sys_mkdir("unicode/knowledge/status" as *u8,OC_DIR_MODE) != 0 { return 3 }
107 let journal: *u8="knowledge/status/actlog.jrnl" as *u8
108 let config: *u8="auto_route=1\n" as *u8; let sentinel: *u8="PRIVATE-UNCHANGED\n" as *u8
109 if oc_put(journal,raw,rn) != 1 { return 3 }
110 if oc_put("knowledge/toolatency.conf" as *u8,config,to_len(config)) != 1 { return 3 }
111 if oc_put("async_only_tools.conf" as *u8,sentinel,to_len(sentinel)) != 1 { return 3 }
112 if oc_put("knowledge/status/toolatency.log" as *u8,sentinel,to_len(sentinel)) != 1 { return 3 }
113 let unicode: *u8="1789023687\tmcp\tnx_é€😀\tobserve\tpromoted_capture_return_unreaped\ttools/timing timing_v=1 lane=sync-promoted job=-1 request_pid=-1 request_begin_us=-1 clock=monotonic_us clock_scope=same_process_tree begin_us=-1 end_us=-1 elapsed_us=-1 code=-9223372036854775808 bytes=-1 client_first_byte=unobserved result_first_byte=unobserved\n" as *u8
114 if oc_put("unicode/knowledge/status/actlog.jrnl" as *u8,unicode,to_len(unicode)) != 1 { return 3 }
115 let mode: *u8="observations" as *u8; let zero: *u8="0" as *u8; let one: *u8="1" as *u8; let bad: *u8="12x" as *u8
116 let over: *u8="9223372036854775808" as *u8; let closed_mode: *u8="__closed_stdout" as *u8
117 av[0]=subject as i64; av[1]=mode as i64; av[2]=zero as i64; av[3]=argv[4]; av[4]=argv[5]; av[5]=0
118 var n: i64=oc_capture(subject,av,dir,"complete.json" as *u8,out,cap,timeout,0,0,ctr)
119 gv_check("COMPLETE contains actual23 observations" as *u8,to_has(out,0,n,"\"status\":\"COMPLETE\"" as *u8) && to_has(out,0,n,"\"returned_rows\":23," as *u8),ctr)
120 gv_check("first byte remains explicitly unobserved" as *u8,to_has(out,0,n,"\"client_first_byte\":null,\"result_first_byte\":null" as *u8),ctr)
121 av[4]=zero as i64
122 n=oc_capture(subject,av,dir,"row-zero.json" as *u8,out,cap,timeout,2,0,ctr)
123 gv_check("row-zero stops rather than silently dropping evidence" as *u8,to_has(out,0,n,"\"status\":\"WINDOW\"" as *u8) && to_has(out,0,n,"\"returned_rows\":0," as *u8),ctr)
124 av[4]=one as i64
125 n=oc_capture(subject,av,dir,"row-one.json" as *u8,out,cap,timeout,2,0,ctr)
126 gv_check("row-one reports bounded window" as *u8,to_has(out,0,n,"\"status\":\"WINDOW\"" as *u8) && to_has(out,0,n,"\"returned_rows\":1," as *u8),ctr)
127 av[4]=argv[5]; av[3]=one as i64
128 n=oc_capture(subject,av,dir,"read-one.json" as *u8,out,cap,timeout,2,0,ctr)
129 gv_check("one-byte read cannot certify a timing record" as *u8,to_has(out,0,n,"\"unconsumed_trailing_bytes\":1" as *u8) && to_has(out,0,n,"\"returned_rows\":0," as *u8),ctr)
130 av[3]=argv[4]; av[2]=bad as i64
131 n=oc_capture(subject,av,dir,"bad-number.json" as *u8,out,cap,timeout,3,0,ctr)
132 gv_check("malformed argument yields structured BAD_INPUT" as *u8,to_has(out,0,n,"\"status\":\"BAD_INPUT\"" as *u8),ctr)
133 av[2]=over as i64
134 n=oc_capture(subject,av,dir,"overflow.json" as *u8,out,cap,timeout,3,0,ctr)
135 gv_check("overflow argument refused" as *u8,to_has(out,0,n,"\"status\":\"BAD_INPUT\"" as *u8),ctr)
136 av[2]=0
137 n=oc_capture(subject,av,dir,"bad-arity.json" as *u8,out,cap,timeout,3,0,ctr)
138 gv_check("wrong arity does not enter legacy behavior" as *u8,to_has(out,0,n,"\"status\":\"BAD_INPUT\"" as *u8),ctr)
139 av[2]=zero as i64
140 let subdir: *u8=sys_mmap(SYS_PATH_MAX); if (subdir as i64) <= 0 { return 3 }
141 var p: i64=oc_copy(subdir,0,dir); oc_copy(subdir,p,"/missing" as *u8)
142 n=oc_capture(subject,av,subdir,"missing.json" as *u8,out,cap,timeout,1,0,ctr)
143 gv_check("missing private journal is UNKNOWN" as *u8,to_has(out,0,n,"\"status\":\"UNKNOWN\"" as *u8) && to_has(out,0,n,"\"initial_size\":null" as *u8),ctr)
144 p=oc_copy(subdir,0,dir); oc_copy(subdir,p,"/unicode" as *u8)
145 n=oc_capture(subject,av,subdir,"unicode-minimum.json" as *u8,out,cap,timeout,0,0,ctr)
146 gv_check("actual UTF8 and signed minimum emitted intact" as *u8,to_has(out,0,n,"\"tool\":\"nx_é€😀\"" as *u8) && to_has(out,0,n,"\"code\":-9223372036854775808" as *u8) && to_has(out,0,n,"\"begin_us\":null" as *u8),ctr)
147 av[0]=self as i64; av[1]=closed_mode as i64; av[2]=subject as i64; av[3]=argv[4]; av[4]=argv[5]; av[5]=0
148 n=oc_capture(self,av,dir,"closed-stdout.txt" as *u8,out,cap,timeout,4,1,ctr)
149 gv_check("closed actual stdout reports output failure with no success bytes" as *u8,n == 0,ctr)
150 gv_check("private source exact bytes unchanged" as *u8,oc_same(journal,raw,rn,scratch,readcap),ctr)
151 gv_check("original retained source exact bytes unchanged" as *u8,oc_same(source,raw,rn,scratch,readcap),ctr)
152 gv_check("routing policy config unchanged" as *u8,oc_same("knowledge/toolatency.conf" as *u8,config,to_len(config),scratch,readcap),ctr)
153 gv_check("async routing sentinel unchanged" as *u8,oc_same("async_only_tools.conf" as *u8,sentinel,to_len(sentinel),scratch,readcap),ctr)
154 gv_check("legacy journal sentinel unchanged" as *u8,oc_same("knowledge/status/toolatency.log" as *u8,sentinel,to_len(sentinel),scratch,readcap),ctr)
155 gv_check("Unicode source exact bytes unchanged" as *u8,oc_same("unicode/knowledge/status/actlog.jrnl" as *u8,unicode,to_len(unicode),scratch,readcap),ctr)
156 gv_puts("retained_capture_directory=" as *u8); gv_puts(dir); gv_puts("\n" as *u8)
157 return gv_verdict("TOOL-OBSERVATIONS-STAGED" as *u8,ctr,"complete native captures require independent JSON/rawspan validation; no production mutations" as *u8)
158}