nx_trusted_flag.nx source

1// nx_trusted_flag.nx -- the TRUSTED scope's write side (operator's 3-scope model 2026-07-04): a client 2// FLAGS an external web resource as a GOOD reference. Fetches the exact page (sovereign TLS, NO crawl -- 3// trusted = curated, not discovered), extracts text, and ingests it into the shared "trusted" seg_store 4// shard (dp-trusted-pub-): doc:<cid> = text, url:<cid> = the real url, trust:<cid> = the flagging client(s) 5// (append-only provenance; a second flagger's name is appended, never clobbered). Idempotent by content cid. 6// usage: nx_trusted_flag <url> <flagger> 7// The READ side is scope=trusted in dss_serve/dss_api_search (a plain shard swap -- same engine). 8// license_tier: ORIGINAL 9import "nx_corpus_ingest.nx" // ci_hash / ci_mkurlkey / dss_prefix / dss_mkkey / seg_store / nx_html_to_text 10import "nx_x509_trust_store.nx" 11import "nx_trust_store_load_from_certdata.nx" 12import "nx_https_fetch_follow.nx" 13const K_MAGIC_4194304: i64 = 4194304 14const K_MAGIC_4096: i64 = 4096 15const K_MAGIC_8388608: i64 = 8388608 16const K_MAGIC_1048576: i64 = 1048576 17const K_MAGIC_4090: i64 = 4090 18 19func tf_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 20func tf_num(v: i64) -> i64 { 21 let bb: *u8 = sys_mmap(28); var m: i64 = v 22 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m } 23 let t: *u8 = sys_mmap(28); var k: i64 = 0 24 if m == 0 { t[0] = 48 as u8; k = 1 } 25 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 26 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } 27 sys_write(1, bb, k); return 0 28} 29func tf_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 30// trust:<cid> provenance key 31func tf_mktrustkey(cid: i64, out: *u8) -> i64 { 32 out[0] = 116 as u8; out[1] = 114 as u8; out[2] = 117 as u8; out[3] = 115 as u8; out[4] = 116 as u8; out[5] = 58 as u8 // "trust:" 33 var o: i64 = 6 34 if cid == 0 { out[o] = 48 as u8; o = o + 1; out[o] = 0 as u8; return o } 35 let t: *u8 = sys_mmap(24) 36 var k: i64 = 0 37 var m: i64 = cid 38 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 39 var j: i64 = 0 40 while j < k { out[o] = t[k - 1 - j]; o = o + 1; j = j + 1 } 41 out[o] = 0 as u8 42 return o 43} 44// is `flagger` already a comma-token in the trust value `val`[0..vl)? (idempotent provenance) 45func tf_has_flagger(val: *u8, vl: i64, flagger: *u8, fl: i64) -> i64 { 46 var i: i64 = 0 47 while i + fl <= vl { 48 var m: i64 = 1 49 var k: i64 = 0 50 while k < fl { if val[i + k] != flagger[k] { m = 0; k = fl } else { k = k + 1 } } 51 if m == 1 { 52 // boundaries: start-of-string or ',' before; end-of-string or ',' after 53 var lok: i64 = 0 54 if i == 0 { lok = 1 } else { if val[i - 1] == (44 as u8) { lok = 1 } } 55 var rok: i64 = 0 56 if i + fl == vl { rok = 1 } else { if val[i + fl] == (44 as u8) { rok = 1 } } 57 if lok == 1 { if rok == 1 { return 1 } } 58 } 59 i = i + 1 60 } 61 return 0 62} 63 64func main(argc: i64, argv: *i64) -> i64 { 65 if argc < 3 { tf_puts("usage: nx_trusted_flag <url> <flagger>\n" as *u8); return 1 } 66 let url: *u8 = argv[1] as *u8 67 let flagger: *u8 = argv[2] as *u8 68 let ul: i64 = tf_len(url) 69 let fl: i64 = tf_len(flagger) 70 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, K_MAGIC_4194304) 71 if r <= 0 { tf_puts("certdata load failed\n" as *u8); return 2 } 72 let store: *TrustStore = r as *TrustStore 73 tf_puts("=== nx_trusted_flag: " as *u8); tf_puts(url); tf_puts(" (by " as *u8); tf_puts(flagger); tf_puts(") -> dp-trusted-pub- ===\n" as *u8) 74 75 let prefix: *u8 = sys_mmap(512) 76 dss_prefix("trusted" as *u8, prefix) 77 let segs: *i64 = sys_mmap(K_MAGIC_4096 * 8) as *i64 78 let nseg: i64 = ss_manifest_cap(prefix, segs, K_MAGIC_4096) 79 var segid: i64 = 1 80 var si: i64 = 0 81 // ROOT FIX seq1730 (id 1785450987): segs[] holds POINTERS to seg-<id> name strings 82 // (nx_seg_store.nx:1234 stores segs[cnt] = name as i64), NOT ids -- so segs[si] + 1 produced 83 // MMAP_ADDRESS+1 (~1.4e14), the pointer-shaped poison that PINS a plane forever: every later 84 // epoch id sorts BELOW it in supersede order and its rows are silently shadowed while rc=0. 85 // Parse the DIGITS, as nx_web_shard_compact.nx:55-58 already does on this SAME array. 86 while si < nseg { 87 let sg_nm: *u8 = segs[si] as *u8 88 var sg_v: i64 = 0 89 var sg_ci: i64 = 0 90 while sg_nm[sg_ci] != (0 as u8) { let sg_c: i64 = sg_nm[sg_ci] as i64; if sg_c >= 48 { if sg_c <= 57 { sg_v = sg_v * 10 + (sg_c - 48) } } sg_ci = sg_ci + 1 } 91 if sg_v >= segid { segid = sg_v + 1 } 92 si = si + 1 93 } 94 let h: *i64 = ss_open(prefix) 95 96 let cap: i64 = K_MAGIC_8388608 97 let out: *u8 = sys_mmap(cap) 98 let tcap: i64 = K_MAGIC_1048576 99 let text: *u8 = sys_mmap(tcap) 100 let status: *i64 = sys_mmap(8) as *i64 101 let n: i64 = nx_https_fetch_follow_best(url, store, out, cap, 6, status) 102 if n <= 0 { tf_puts("FETCH-FAIL (n<=0)\n" as *u8); return 3 } 103 if status[0] != 200 { tf_puts("FETCH-FAIL status=" as *u8); tf_num(status[0]); tf_puts("\n" as *u8); return 3 } 104 let tlen: i64 = nx_html_to_text(out, n, text, tcap) 105 if tlen < CI_MINDOC { tf_puts("EXTRACT-EMPTY (tlen<min)\n" as *u8); return 4 } 106 var tn: i64 = tlen 107 if tn > CI_DOCCAP { tn = CI_DOCCAP } 108 let cid: i64 = ci_hash(text, tn) 109 110 let key: *u8 = sys_mmap(64) 111 let ukey: *u8 = sys_mmap(64) 112 let tkey: *u8 = sys_mmap(64) 113 let pbox: *i64 = sys_mmap(16) as *i64 114 let lbox: *i64 = sys_mmap(16) as *i64 115 dss_mkkey(cid, key) 116 tf_mktrustkey(cid, tkey) 117 118 let w: *i64 = ss_begin() 119 var already: i64 = 0 120 if (h as i64) != 0 { if ss_hget(h, key, pbox, lbox) == 1 { already = 1 } } 121 if already == 0 { 122 ss_add(w, 1, key, text, tn) 123 ci_mkurlkey(cid, ukey) 124 ss_add(w, 1, ukey, url, ul) 125 ss_add(w, 1, tkey, flagger, fl) 126 ss_commit(prefix, w, segid) 127 tf_puts("FLAGGED (new): cid=" as *u8); tf_num(cid); tf_puts(" chars=" as *u8); tf_num(tn); tf_puts("\n" as *u8) 128 tf_puts("TRUSTED-FLAG GREEN\n" as *u8) 129 return 0 130 } 131 // already present: append this flagger to the provenance IF not already listed (additive, no clobber) 132 var flagged: i64 = 0 133 if ss_hget(h, tkey, pbox, lbox) == 1 { if tf_has_flagger(pbox[0] as *u8, lbox[0], flagger, fl) == 1 { flagged = 1 } } 134 if flagged == 1 { 135 tf_puts("ALREADY-FLAGGED by " as *u8); tf_puts(flagger); tf_puts(" (idempotent no-op)\n" as *u8) 136 tf_puts("TRUSTED-FLAG GREEN\n" as *u8) 137 return 0 138 } 139 // build "<existing>,<flagger>" and append a fresh trust: row (ss_hget last-wins = the merged provenance) 140 var newlen: i64 = 0 141 let newval: *u8 = sys_mmap(K_MAGIC_4096) 142 if ss_hget(h, tkey, pbox, lbox) == 1 { 143 let ex: *u8 = pbox[0] as *u8 144 var i: i64 = 0 145 while i < lbox[0] { if newlen < K_MAGIC_4090 { newval[newlen] = ex[i]; newlen = newlen + 1 } i = i + 1 } 146 newval[newlen] = 44 as u8; newlen = newlen + 1 // ',' 147 } 148 var j: i64 = 0 149 while j < fl { if newlen < K_MAGIC_4090 { newval[newlen] = flagger[j]; newlen = newlen + 1 } j = j + 1 } 150 ss_add(w, 1, tkey, newval, newlen) 151 ss_commit(prefix, w, segid) 152 tf_puts("RE-FLAGGED (doc present): provenance += " as *u8); tf_puts(flagger); tf_puts("\n" as *u8) 153 tf_puts("TRUSTED-FLAG GREEN\n" as *u8) 154 return 0 155}