nx_ui_ship_gate.nx source
↩ module page · 119 lines · 5911 B
1// nx_ui_ship_gate.nx -- the S-class LOCK-IN gate (wire into emitter/CI compile-gates).
2// Reads the data-driven manifest web_assets/ui_ship.conf (mode|path|label) and enforces:
3// require -> the page MUST be S-class-compliant (sce_violations==0) or the gate goes RED (exit 1) = ship BLOCKED.
4// debt -> a known legacy page: audited + reported, but NON-blocking until retrofitted onto nx_sclass_kit.
5// Composes the ONE canonical check (nx_sclass_enforce_lib) -> no duplicated logic. So once a page is S-class,
6// it can NEVER silently regress: any emitter change that breaks a required page fails this gate.
7// license_tier: ORIGINAL expect_exit: 0
8import "nx_syscalls_x86_64.nx"
9import "nx_sclass_enforce_lib.nx"
10
11func sw(s: *u8) -> i64 { var n: i64=0; while s[n]!=0 { n=n+1 } sys_write(1,s,n); return 0 }
12func sn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m-(m/10)*10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 }
13func wslice(base: *u8, off: i64, len: i64) -> i64 { sys_write(1, ((base as i64) + off) as *u8, len); return 0 }
14
15// field equals a NUL-terminated literal
16func feq(base: *u8, off: i64, len: i64, lit: *u8) -> i64 {
17 var i: i64=0
18 while lit[i] != 0 { if i>=len { return 0 } if base[off+i] != lit[i] { return 0 } i=i+1 }
19 if i != len { return 0 }
20 return 1
21}
22// copy base[off..off+len) to a fresh NUL-terminated buffer
23func slice_z(base: *u8, off: i64, len: i64) -> *u8 {
24 let out: *u8 = sys_mmap(1024)
25 var i: i64=0
26 while i<len { out[i]=base[off+i]; i=i+1 }
27 out[i]=0 as u8
28 return out
29}
30// split base[ls..le) on '|' into foff[]/flen[] (up to 4). returns field count.
31func splitp(base: *u8, ls: i64, le: i64, foff: *i64, flen: *i64) -> i64 {
32 var fi: i64=0; var s: i64=ls; var i: i64=ls
33 while i<le {
34 if (base[i] as i64)==0x7c { if fi<4 { foff[fi]=s; flen[fi]=i-s; fi=fi+1 } s=i+1 }
35 i=i+1
36 }
37 if fi<4 { foff[fi]=s; flen[fi]=le-s; fi=fi+1 }
38 return fi
39}
40// print the specific missing invariants for a page
41func list_gaps(h: *u8, n: i64) -> i64 {
42 if sce_tokens(h,n)==0 { sw(" canonical-tokens" as *u8) }
43 if sce_responsive(h,n)==0 { sw(" responsive" as *u8) }
44 if sce_motion(h,n)==0 { sw(" reduced-motion" as *u8) }
45 if sce_focus(h,n)==0 { sw(" focus-visible" as *u8) }
46 if sce_sovereign(h,n)==0 { sw(" sovereign" as *u8) }
47 if sce_landmarks(h,n)==0 { sw(" landmarks" as *u8) }
48 if sce_skiplink(h,n)==0 { sw(" (warn:skip-link)" as *u8) }
49 return 0
50}
51
52func main() -> i64 {
53 let len_p: *i64 = sys_mmap(8) as *i64
54 let data: *u8 = sys_read_file_x86_64("web_assets/ui_ship.conf" as *u8, len_p)
55 if data == (0 as *u8) { sw("cannot read web_assets/ui_ship.conf\n" as *u8); sys_exit(1); return 1 }
56 let dn: i64 = len_p[0]
57
58 let foff: *i64 = sys_mmap(64) as *i64
59 let flen: *i64 = sys_mmap(64) as *i64
60 let tot: *i64 = sys_mmap(64) as *i64
61 tot[0]=0; tot[1]=0; tot[2]=0; tot[3]=0 // req_ok, req_fail, debt_ok, debt_bad
62
63 sw("=== nx_ui_ship_gate -- S-class lock-in over web_assets/ui_ship.conf ===\n" as *u8)
64
65 var ls: i64=0
66 while ls < dn {
67 var le: i64 = 0-1
68 var k: i64 = ls
69 while k < dn { if le<0 { if (data[k] as i64)==0x0a { le=k } } k=k+1 }
70 if le<0 { le=dn }
71 var skip: i64=0
72 if le<=ls { skip=1 }
73 if skip==0 { if (data[ls] as i64)==0x23 { skip=1 } } // '#' comment
74 if skip==0 {
75 let nf: i64 = splitp(data, ls, le, foff, flen)
76 if nf>=2 {
77 let is_req: i64 = feq(data, foff[0], flen[0], "require" as *u8)
78 let pathz: *u8 = slice_z(data, foff[1], flen[1])
79 let hp: *i64 = sys_mmap(8) as *i64
80 let h: *u8 = sys_read_file_x86_64(pathz, hp)
81 sw(" " as *u8)
82 if nf>=3 { wslice(data, foff[2], flen[2]) } else { wslice(data, foff[1], flen[1]) }
83 sw(" -> " as *u8)
84 if h == (0 as *u8) {
85 sw("MISSING" as *u8)
86 if is_req==1 { tot[1]=tot[1]+1; sw(" [REQUIRED-FAIL]" as *u8) } else { tot[3]=tot[3]+1 }
87 } else {
88 let v: i64 = sce_violations(h, hp[0])
89 if is_req==1 {
90 if v==0 { sw("PASS" as *u8); tot[0]=tot[0]+1 } else { sw("FAIL viol=" as *u8); sn(v); sw(" [REQUIRED]->" as *u8); list_gaps(h, hp[0]); tot[1]=tot[1]+1 }
91 } else {
92 sw("debt viol=" as *u8); sn(v)
93 if v==0 { tot[2]=tot[2]+1; sw(" (already compliant!)" as *u8) } else { tot[3]=tot[3]+1; sw(" ->" as *u8); list_gaps(h, hp[0]) }
94 }
95 }
96 sw("\n" as *u8)
97 }
98 }
99 ls = le+1
100 }
101
102 // NEG-CONTROL: a synthetic bare page must be caught (the check is live, not vacuous)
103 let bare: *u8 = "<!DOCTYPE html><html><head><title>x</title></head><body><p>hi</p></body></html>" as *u8
104 var bn: i64=0
105 while bare[bn] != 0 { bn=bn+1 }
106 let v_bare: i64 = sce_violations(bare, bn)
107
108 sw("--- SUMMARY ---\n" as *u8)
109 sw(" REQUIRED: pass=" as *u8); sn(tot[0]); sw(" fail=" as *u8); sn(tot[1]); sw("\n" as *u8)
110 sw(" DEBT: compliant=" as *u8); sn(tot[2]); sw(" outstanding=" as *u8); sn(tot[3]); sw(" (non-blocking; retrofit onto nx_sclass_kit)\n" as *u8)
111 sw(" NEG-CONTROL bare page viol=" as *u8); sn(v_bare); sw(" (must be >=5)\n" as *u8)
112
113 var green: i64=0
114 if tot[1]==0 { if v_bare>=5 { green=1 } }
115 if green==1 { sw("VERDICT: GREEN (all required pages S-class; regression would BLOCK the ship; debt tracked)\n" as *u8); sys_exit(0) }
116 sw("VERDICT: RED (a required page is not S-class -> ship BLOCKED)\n" as *u8)
117 sys_exit(1)
118 return 1
119}