nx_wall_triage.nx source
↩ module page · 157 lines · 7157 B
1// nx_wall_triage.nx -- the WALL ROOT-CAUSE organ (Doctor verb: DIAGNOSE).
2//
3// module: nishi-core.search.wall_triage
4// depends: nx_guarded_run.nx, /tmp/_wt_probe_one.sov.elf
5// capability: DIAGNOSTIC + EVIDENCE
6//
7// WHY (2026-06-10 census finding): rumble.com + archive.ph refused our fetch
8// with a flat rc=2 -- which stage refused us was INVISIBLE, so "TLS
9// fingerprint?" stayed a guess. This organ stages the probe per host and
10// NAMES the wall from the child's exit code:
11// HTTP-REACHED(status) the wall (if any) is HTTP-level -- status recorded
12// CONNECT-REFUSED DNS/TCP layer -- host gone, blocked IP, or filter
13// TLS-REFUSED handshake rejected = ClientHello-fingerprint
14// suspect -> a BROWSER-lane defect (our CH shape),
15// auto-filed as a finding row
16// FETCH-FAIL TLS up, HTTP send/read failed
17// TIMEOUT-REAPED hang (named, reaped, never a wedge)
18// Re-runnable on ANY host list; durable rows -> knowledge/status/wall_triage.log.
19// Controls included (example.com must be HTTP-REACHED for the run to be
20// trusted -- a red control means OUR stack/egress is sick, not the target).
21
22import "nx_str.nx"
23import "nx_syscalls.nx"
24import "nx_guarded_run.nx"
25
26const NX_WT_HOSTS: i64 = 4
27const NX_WT_DEADLINE: i64 = 15000
28
29func wtp(s: *u8) -> i64 { sys_write(1, s, nx_str_len(s)); return 0 }
30func wtn(v: i64) -> i64 {
31 if v == 0 { sys_write(1, "0" as *u8, 1); return 0 }
32 var m: i64 = v; if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
33 let t: *u8 = sys_mmap(28); var k: i64 = 0
34 while m > 0 { t[k] = 0x30 + (m - (m/10)*10); m = m/10; k = k + 1 }
35 while k > 0 { k = k - 1; sys_write(1, (((t as i64)+k) as *u8), 1) }
36 return 0
37}
38func wtf(fd: i64, s: *u8) -> i64 { sys_write(fd, s, nx_str_len(s)); return 0 }
39func wtfn(fd: i64, v: i64) -> i64 {
40 let b: *u8 = sys_mmap(28); let t: *u8 = sys_mmap(28)
41 var m: i64 = v; if m < 0 { m = 0 - m }
42 var k: i64 = 0
43 if m == 0 { t[0] = 48; k = 1 }
44 while m > 0 { t[k] = 48 + (m % 10); m = m / 10; k = k + 1 }
45 var i: i64 = 0
46 while i < k { b[i] = t[k-1-i]; i = i + 1 }
47 sys_write(fd, b, k)
48 return 0
49}
50
51func wt_url(e: i64) -> *u8 {
52 if e == 0 { return "https://example.com/" } // CONTROL: must reach
53 if e == 1 { return "https://rumble.com/" } // census wall 1
54 if e == 2 { return "https://archive.ph/" } // census wall 2
55 if e == 3 { return "https://www.bitchute.com/" } // thin-text host (JS shell?)
56 return "?"
57}
58func wt_out(e: i64) -> *u8 {
59 if e == 0 { return "/tmp/wt_hdr_0.txt\x00" }
60 if e == 1 { return "/tmp/wt_hdr_1.txt\x00" }
61 if e == 2 { return "/tmp/wt_hdr_2.txt\x00" }
62 if e == 3 { return "/tmp/wt_hdr_3.txt\x00" }
63 return "/tmp/wt_hdr_x.txt\x00"
64}
65
66func wt_read_head(path: *u8, buf: *u8, cap: i64) -> i64 {
67 let fd: i64 = sys_openat_rd(path)
68 if fd < 0 { return 0 }
69 let n: i64 = sys_read(fd, buf, cap)
70 sys_close(fd)
71 if n < 0 { return 0 }
72 return n
73}
74
75// first line of resp (status line), sanitized, to fd
76func wt_status_line(fd: i64, b: *u8, n: i64) -> i64 {
77 var i: i64 = 0
78 while i < n {
79 var c: i64 = b[i] as i64
80 if c == 0x0D { i = n } else {
81 if c < 0x20 { c = 0x20 }
82 if c > 0x7E { c = 0x3F }
83 let o: *u8 = sys_mmap(1)
84 o[0] = c
85 sys_write(fd, o, 1)
86 i = i + 1
87 }
88 }
89 return 0
90}
91
92func main() -> i64 {
93 wtp("=== WALL TRIAGE: name the stage that refuses us (control first) ===\n")
94 let child: *u8 = "/tmp/_wt_probe_one.sov.elf\x00"
95 let probe: i64 = sys_openat_rd(child)
96 if probe < 0 { wtp(" prereq missing: build _wt_probe_one first\n"); sys_exit(3); return 3 }
97 sys_close(probe)
98 let envp: *i64 = sys_mmap(16) as *i64
99 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0
100 let devnull: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
101 let lfd: i64 = sys_openat_append("knowledge/status/wall_triage.log" as *u8, 0x1a4)
102 if lfd < 0 { wtp(" log open failed\n"); sys_exit(1); return 1 }
103 wtf(lfd, "WT-RUN epoch=" as *u8); wtfn(lfd, sys_now_realtime_sec()); wtf(lfd, "\n" as *u8)
104
105 var control_ok: i64 = 0
106 var ntls: i64 = 0
107 var e: i64 = 0
108 while e < NX_WT_HOSTS {
109 let url: *u8 = wt_url(e)
110 let av: *i64 = sys_mmap(8 * 4) as *i64
111 av[0] = child as i64; av[1] = url as i64; av[2] = wt_out(e) as i64; av[3] = 0
112 let rc: i64 = nx_guarded_run(child, av, envp, NX_WT_DEADLINE, devnull, devnull)
113 wtp(" "); wtp(url); wtp(" -> ")
114 wtf(lfd, "WT-HOST url=" as *u8); wtf(lfd, url); wtf(lfd, " rc=" as *u8); wtfn(lfd, rc)
115 if rc == 0 {
116 let hb: *u8 = sys_mmap(400)
117 let hn: i64 = wt_read_head(wt_out(e), hb, 320)
118 wtp("HTTP-REACHED: "); wt_status_line(1, hb, hn); wtp("\n")
119 wtf(lfd, " diag=HTTP-REACHED status=\"" as *u8); wt_status_line(lfd, hb, hn); wtf(lfd, "\"\n" as *u8)
120 if e == 0 { control_ok = 1 }
121 } else {
122 if rc == 13 { wtp("CONNECT-REFUSED (DNS/TCP)\n"); wtf(lfd, " diag=CONNECT-REFUSED\n" as *u8) }
123 if rc == 14 {
124 ntls = ntls + 1
125 wtp("TLS-REFUSED (handshake rejected -> ClientHello-fingerprint suspect)\n")
126 wtf(lfd, " diag=TLS-REFUSED finding=BROWSER-LANE-CH-FINGERPRINT\n" as *u8)
127 }
128 if rc == 15 { wtp("FETCH-FAIL (TLS up, HTTP send/read failed)\n"); wtf(lfd, " diag=FETCH-FAIL\n" as *u8) }
129 if rc == 124 { wtp("TIMEOUT-REAPED\n"); wtf(lfd, " diag=TIMEOUT\n" as *u8) }
130 if rc == 12 { wtp("BAD-URL\n"); wtf(lfd, " diag=BAD-URL\n" as *u8) }
131 if rc == 127 { wtp("EXEC-FAIL\n"); wtf(lfd, " diag=EXEC-FAIL\n" as *u8) }
132 }
133 e = e + 1
134 }
135 // auto-file the browser-lane finding when TLS-fingerprint walls were named
136 if ntls > 0 {
137 if control_ok == 1 {
138 let pfd: i64 = sys_openat_append("knowledge/status/pm_plan_durable.log" as *u8, 0x1a4)
139 if pfd >= 0 {
140 wtf(pfd, "arc=BROWSER step=CH-FINGERPRINT-WALLS FILED-BY nx_wall_triage epoch=" as *u8)
141 wtfn(pfd, sys_now_realtime_sec())
142 wtf(pfd, " :: " as *u8); wtfn(pfd, ntls)
143 wtf(pfd, " host(s) reject our TLS handshake (control example.com GREEN -> our stack is healthy; the refusal is SHAPE-based). Evidence wall_triage.log. owner=Builder(browser-lane)\n" as *u8)
144 sys_close(pfd)
145 }
146 wtp(" finding auto-filed: BROWSER-lane ClientHello-fingerprint row -> pm_plan_durable.log\n")
147 }
148 }
149 wtf(lfd, "WT-VERDICT control_ok=" as *u8); wtfn(lfd, control_ok)
150 wtf(lfd, " tls_walls=" as *u8); wtfn(lfd, ntls)
151 if control_ok == 1 { wtf(lfd, " verdict=TRUSTED\n" as *u8) } else { wtf(lfd, " verdict=UNTRUSTED-CONTROL-RED\n" as *u8) }
152 sys_close(lfd)
153 if control_ok == 1 { wtp(" WALL-TRIAGE: TRUSTED (control green; every wall NAMED)\n"); sys_exit(0); return 0 }
154 wtp(" WALL-TRIAGE: UNTRUSTED (control red = our stack/egress is sick)\n")
155 sys_exit(1)
156 return 1
157}