nx_trusted_flag_gate.nx source

1// nx_trusted_flag_gate.nx -- network-free KATs for the TRUSTED scope's provenance mechanics: the trust:<cid> 2// key builder, the flagger-membership check (comma-token boundaries), and the store round trip (a flagged 3// doc is searchable in the trusted shard; re-flag by a 2nd client APPENDS, never clobbers; idempotent for a 4// repeat flagger). The fetch/ingest spine is nx_web_ingest's, already proven live. /tmp shard. license_tier: ORIGINAL 5import "nx_trusted_flag.nx" 6 7func gt_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 8func gt_num(v: i64) -> i64 { 9 let bb: *u8 = sys_mmap(28); var m: i64 = v 10 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m } 11 let t: *u8 = sys_mmap(28); var k: i64 = 0 12 if m == 0 { t[0] = 48 as u8; k = 1 } 13 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 14 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } 15 sys_write(1, bb, k); return 0 16} 17func gt_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 18func gt_check(name: *u8, cond: i64, pass: *i64, total: *i64) -> i64 { 19 total[0] = total[0] + 1 20 gt_puts(name) 21 if cond == 1 { pass[0] = pass[0] + 1; gt_puts(" PASS\n" as *u8) } else { gt_puts(" FAIL\n" as *u8) } 22 return 0 23} 24 25func main() -> i64 { 26 gt_puts("=== nx_trusted_flag gate (provenance mechanics; store round trip) ===\n" as *u8) 27 let pass: *i64 = sys_mmap(16) as *i64; pass[0] = 0 28 let total: *i64 = sys_mmap(16) as *i64; total[0] = 0 29 30 // T1 trust: key builder 31 let tk: *u8 = sys_mmap(64) 32 let kl: i64 = tf_mktrustkey(1234, tk) 33 var t1: i64 = 0 34 if kl == 10 { if tk[0] == (116 as u8) { if tk[5] == (58 as u8) { if tk[6] == (49 as u8) { t1 = 1 } } } } 35 gt_check("T1 trust:<cid> key builder (trust:1234)" as *u8, t1, pass, total) 36 37 // T2 flagger membership: comma-token boundaries (andelinwest in "family,andelinwest"; NOT "west" in it) 38 let val: *u8 = "family,andelinwest" as *u8 39 var t2: i64 = 0 40 if tf_has_flagger(val, 18, "andelinwest" as *u8, 11) == 1 { 41 if tf_has_flagger(val, 18, "family" as *u8, 6) == 1 { 42 if tf_has_flagger(val, 18, "west" as *u8, 4) == 0 { 43 if tf_has_flagger(val, 18, "fam" as *u8, 3) == 0 { t2 = 1 } 44 } 45 } 46 } 47 gt_check("T2 flagger membership (token boundaries, no substring false-hit)" as *u8, t2, pass, total) 48 49 // store round trip: hand-build a trusted shard the way nx_trusted_flag commits (skip the network fetch). 50 // dss_search resolves the domain via dss_prefix, so write to that same path (the seg-gate convention). 51 let prefix: *u8 = sys_mmap(512) 52 dss_prefix("trustgatetest" as *u8, prefix) 53 let cid1: i64 = 777001 54 let key1: *u8 = sys_mmap(64); dss_mkkey(cid1, key1) 55 let uk1: *u8 = sys_mmap(64); ci_mkurlkey(cid1, uk1) 56 let tk1: *u8 = sys_mmap(64); tf_mktrustkey(cid1, tk1) 57 let w: *i64 = ss_begin() 58 ss_add(w, 1, key1, "estate planning trust probate reference" as *u8, 39) 59 ss_add(w, 1, uk1, "https://en.wikipedia.org/wiki/Estate_planning" as *u8, 45) 60 ss_add(w, 1, tk1, "andelinwest" as *u8, 11) 61 ss_commit(prefix, w, 1) 62 // T3 the flagged doc is searchable in the trusted shard 63 let cids: *i64 = sys_mmap(8 * 8) as *i64 64 let scores: *i64 = sys_mmap(8 * 8) as *i64 65 let n3: i64 = dss_search("trustgatetest" as *u8, "probate" as *u8, 7, cids, scores, 8) 66 var t3: i64 = 0 67 if n3 == 1 { if cids[0] == cid1 { t3 = 1 } } 68 gt_check("T3 flagged doc searchable in trusted shard" as *u8, t3, pass, total) 69 70 // T4 re-flag by a 2nd client APPENDS provenance (append-only, last-wins merged value) 71 let w2: *i64 = ss_begin() 72 ss_add(w2, 1, tk1, "andelinwest,family" as *u8, 18) 73 ss_commit(prefix, w2, 2) 74 let h: *i64 = ss_open(prefix) 75 let pp: *i64 = sys_mmap(16) as *i64 76 let pl: *i64 = sys_mmap(16) as *i64 77 var t4: i64 = 0 78 if ss_hget(h, tk1, pp, pl) == 1 { 79 if pl[0] == 18 { if tf_has_flagger(pp[0] as *u8, pl[0], "family" as *u8, 6) == 1 { if tf_has_flagger(pp[0] as *u8, pl[0], "andelinwest" as *u8, 11) == 1 { t4 = 1 } } } 80 } 81 gt_check("T4 multi-flagger provenance merged (andelinwest,family)" as *u8, t4, pass, total) 82 83 gt_puts("=== trusted-flag gate: " as *u8); gt_num(pass[0]); gt_puts("/" as *u8); gt_num(total[0]); gt_puts(" " as *u8) 84 if pass[0] == total[0] { gt_puts("GREEN\n" as *u8); return 0 } 85 gt_puts("RED\n" as *u8); return 1 86}