code wiki / _hdl_build / nx_vault_rotation_test.nx
`nx_vault_rotation_test.nx` source

1// nx_vault_rotation_test.nx -- ROTATIONGATE: proves lease-driven auto-rotation. GREEN iff: not due before
2// the interval; DUE at/after it; version bumps monotonically; the OLD version stays valid during the grace
3// overlap (zero-downtime) then EXPIRES; the NEW version is valid from its rotation time then expires. 7/7.
4import "nx_vault_rotation.nx"
5import "nx_syscalls.nx"
6
7func rg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
8func rg_num(v: i64) -> i64 { let b: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {b[i]=t[k-1-i]; i=i+1}; sys_write(1,b,k); return 0 }
9
10func main() -> i64 {
11    rg_puts("=== SOVEREIGN LEASE-DRIVEN AUTO-ROTATION (zero-downtime grace overlap) ===\n" as *u8)
12    let issued: i64 = 1000
13    let interval: i64 = 200
14    let ttl: i64 = 250
15    let grace: i64 = 50
16
17    let due_before: i64 = rot_due(1100, issued, interval)       // 1100 < 1200 -> not due
18    let due_at:     i64 = rot_due(1200, issued, interval)       // >= 1200 -> due
19    let v_next:     i64 = rot_next_version(3)                   // 4
20    // rotate at now=1200: old(issued=1000,ttl=250 -> expires 1250)+grace 50 -> accepted < 1300
21    let old_ovl:    i64 = rot_overlap_valid(1240, issued, ttl, grace)   // 1240 < 1300 -> valid
22    let old_gone:   i64 = rot_overlap_valid(1300, issued, ttl, grace)   // 1300 < 1300 false -> expired
23    // new version validity from rotated_at=1200, ttl=250 -> valid < 1450
24    let new_mid:    i64 = rot_new_valid(1240, 1200, ttl)        // valid
25    let new_exp:    i64 = rot_new_valid(1460, 1200, ttl)        // expired
26
27    rg_puts(" due@1100=" as *u8); rg_num(due_before); rg_puts(" due@1200=" as *u8); rg_num(due_at)
28    rg_puts(" v3->v" as *u8); rg_num(v_next); rg_puts(" | old-overlap@1240=" as *u8); rg_num(old_ovl)
29    rg_puts(" old-gone@1300=" as *u8); rg_num(old_gone); rg_puts(" | new@1240=" as *u8); rg_num(new_mid); rg_puts(" new@1460=" as *u8); rg_num(new_exp); rg_puts("\n" as *u8)
30
31    let r: *i64 = sys_mmap(8*8) as *i64
32    r[0] = 0; if due_before == 0 { r[0] = 1 }                 // not due before interval
33    r[1] = 0; if due_at == 1 { r[1] = 1 }                     // due at/after interval
34    r[2] = 0; if v_next == 4 { if v_next > 3 { r[2] = 1 } }   // monotonic version bump
35    r[3] = 0; if old_ovl == 1 { r[3] = 1 }                    // old version valid during grace overlap (zero-downtime)
36    r[4] = 0; if old_gone == 0 { r[4] = 1 }                   // old version expires after grace
37    r[5] = 0; if new_mid == 1 { r[5] = 1 }                    // new version valid from rotation
38    r[6] = 0; if new_exp == 0 { r[6] = 1 }                    // new version expires per its ttl
39
40    var pass: i64 = 0; var i: i64 = 0
41    while i < 7 { pass = pass + r[i]; i = i + 1 }
42    rg_puts("----\n passed " as *u8); rg_num(pass); rg_puts("/7\n" as *u8)
43    if pass == 7 {
44        rg_puts("ROTATIONGATE due_detection=1 monotonic_version=1 grace_overlap_zero_downtime=1 old_expires=1 new_lease_bound=1 exceed[sovereign lease-driven auto-rotation = HashiCorp rotation-class; grace overlap = no dropped in-flight users; composes nx_vault_lease] verdict=GREEN\n" as *u8)
45        sys_exit(0); return 0
46    }
47    rg_puts("ROTATIONGATE verdict=RED\n" as *u8); sys_exit(1); return 1
48}
nx_vault_rotation_test.nx source

`nx_vault_rotation_test.nx` source
