nx_warden_paths_test.nx source

1// nx_warden_paths_test.nx -- proves the Warden's real protected-path safety AND 2// that the crew council's Warden leg, fed by it, protects the canonical assets. 3// Known answer: classifier 8/8 + governed 2/2 correct, exit 0. 4 5import "nx_warden_paths.nx" 6import "nx_crew_council.nx" 7 8func wpt_putn(v: i64) -> i64 { 9 let b: *u8 = sys_mmap(24); var n: i64 = v; if n < 0 { n = 0 - n } 10 let t: *u8 = sys_mmap(24); var k: i64 = 0 11 if n == 0 { t[0] = 48; k = 1 } 12 while n > 0 { t[k] = 48 + (n % 10); n = n / 10; k = k + 1 } 13 var i: i64 = 0; while i < k { b[i] = t[k - 1 - i]; i = i + 1 } 14 sys_write(1, b, k); return 0 15} 16 17func wpt_check(action: i64, path: *u8, expect: i64) -> i64 { 18 let got: i64 = nx_warden_path_safe(action, path) 19 cc_puts(" " as *u8) 20 if got == WP_SAFE { cc_puts("SAFE " as *u8) } else { cc_puts("DENY " as *u8) } 21 cc_puts(path); cc_puts("\n" as *u8) 22 if got == expect { return 1 } 23 return 0 24} 25 26func main() -> i64 { 27 cc_puts("================================================================\n" as *u8) 28 cc_puts(" WARDEN protected-path safety -- the canonical assets are sacred\n" as *u8) 29 cc_puts("================================================================\n" as *u8) 30 31 var pass: i64 = 0 32 pass = pass + wpt_check(WP_OVERWRITE, "_offc/nx_cc_known_good.elf" as *u8, WP_DENY) 33 pass = pass + wpt_check(WP_DELETE, "runtime/nx_eqsat.nx" as *u8, WP_DENY) 34 pass = pass + wpt_check(WP_OVERWRITE, "runtime/_hdl_build/nx_alu_divider.nx" as *u8, WP_DENY) 35 pass = pass + wpt_check(WP_CREATE, "runtime/_hdl_build/nx_newcap_test.nx" as *u8, WP_SAFE) 36 pass = pass + wpt_check(WP_APPEND, "win_ledger.journal" as *u8, WP_SAFE) 37 pass = pass + wpt_check(WP_OVERWRITE, "_offc/scratch.s" as *u8, WP_SAFE) 38 pass = pass + wpt_check(WP_READ, "runtime/nx_eqsat.nx" as *u8, WP_SAFE) 39 pass = pass + wpt_check(WP_DELETE, "_offc/aludiv_test.elf" as *u8, WP_SAFE) 40 41 cc_puts("\n governed: the council's WARDEN leg derives `safe` from the path\n" as *u8) 42 let a: *CrewAction = sys_mmap(64) as *CrewAction 43 let why: *i64 = sys_mmap(8) as *i64 44 var gpass: i64 = 0 45 46 // heal that would clobber the canonical compiler -> Warden DENY via the path 47 let s1: i64 = nx_warden_path_safe(WP_OVERWRITE, "_offc/nx_cc_known_good.elf" as *u8) 48 cc_set(a, "heal: rebuild over the known-good compiler" as *u8, 1, 1, 1, s1, 1) 49 let v1: i64 = cc_council(a, why) 50 cc_puts(" " as *u8); cc_puts(cc_verdict_name(v1)); cc_puts(" " as *u8); cc_puts(a.name as *u8); cc_puts("\n -> " as *u8); cc_puts(why[0] as *u8); cc_puts("\n" as *u8) 51 if v1 == CC_DENY { gpass = gpass + 1 } 52 53 // additive fix: a NEW gate file -> Warden SAFE -> council ACT 54 let s2: i64 = nx_warden_path_safe(WP_CREATE, "runtime/_hdl_build/nx_fix_test.nx" as *u8) 55 cc_set(a, "fix: add a new additive regression gate" as *u8, 1, 1, 1, s2, 1) 56 let v2: i64 = cc_council(a, why) 57 cc_puts(" " as *u8); cc_puts(cc_verdict_name(v2)); cc_puts(" " as *u8); cc_puts(a.name as *u8); cc_puts("\n -> " as *u8); cc_puts(why[0] as *u8); cc_puts("\n" as *u8) 58 if v2 == CC_ACT { gpass = gpass + 1 } 59 60 cc_puts("----------------------------------------------------------------\n" as *u8) 61 cc_puts(" classifier " as *u8); wpt_putn(pass); cc_puts("/8, governed " as *u8); wpt_putn(gpass) 62 cc_puts("/2 -- the known-good compiler + sources are protected from any\n" as *u8) 63 cc_puts(" autonomous overwrite; additive fixes flow. real teeth on the Warden.\n" as *u8) 64 cc_puts("----------------------------------------------------------------\n" as *u8) 65 66 if pass != 8 { sys_exit(1); return 1 } 67 if gpass != 2 { sys_exit(2); return 2 } 68 sys_exit(0) 69 return 0 70}