nx_wasmemit_guard_gate.nx source

1// nx_wasmemit_guard_gate.nx -- EVERY ORGAN THAT EMITS A FRAMEBUFFER WASM PAGE MUST CALL THE FIT GUARD. 2// 3// WHY. /craft shipped BLACK twice because its framebuffer had outgrown the module's own declared 4// linear memory. The guard that refuses that (nx_wasmfit's wf_guard) used to live inside 5// nx_game_page_emit under a header claiming every wasm page in the estate was built through it. 6// nx_wasmpage_census then measured all 62,906 shipped pages: 25 carry an embedded module and only 9 7// reach that function. ★★★★★★A GUARD PLACED IN "THE" SHARED PATH IS ONLY AS BROAD AS THE CLAIM THAT 8// THE PATH IS SHARED, AND THAT CLAIM IS A MEASUREMENT NOBODY TOOK. 9// 10// The census is the after-the-fact audit -- it catches a bad page once it is already on disk. This is 11// the BEFORE: a static check that every emitter is wired to the one ruler, so a new emitter cannot be 12// written without the guard and pass unnoticed. ★A LAW I HAVE TO REMEMBER IS A LAW I WILL SKIP; PUT IT 13// IN THE PATH. 14// 15// THE SUBJECT IS DEFINED BY A CONJUNCTION, NOT A GUESS. An organ is a framebuffer-page emitter iff its 16// source carries all three literals of the blit shim it writes into the page: the instantiate call, 17// and the ww/fb_off accessor reads. That matters because organs which merely MENTION wasm must not be 18// swept in -- nx_sitegen_game_gate CHECKS emitted pages for "WebAssembly.instantiate" and would be a 19// false positive on that literal alone. ★A DETECTOR WITH FALSE POSITIVES IS WORSE THAN NONE, and 20// ★A SCANNER CANNOT TELL A CALL FROM A RENDERING OF A CALL -- so the rule is stated, narrow, and its 21// misses are declared rather than hidden: an emitter that builds the shim string in pieces is NOT 22// seen by this gate. That is a floor on coverage, printed as one. 23// license_tier: ORIGINAL 24import "nx_syscalls.nx" 25import "nx_gate_verdict.nx" 26 27// The three co-occurring literals of an emitted framebuffer blit shim. 28const WG_M_INST: *u8 = "WebAssembly.instantiate" 29const WG_M_WW: *u8 = "ex.ww()" 30const WG_M_FBO: *u8 = "ex.fb_off()" 31// The call that proves the emitter is wired to the one ruler. 32const WG_M_GUARD: *u8 = "wf_guard(" 33// ⚠⚠A DETECTOR THAT SCANS SOURCE WILL FIND ITSELF -- AND EXCLUDING ITSELF BY CONTENT EXCLUDES EVERY 34// FILE THAT MERELY MENTIONS IT. This started as a CONTENT match on the bare name, and the moment the 35// 21 emitters were wired their new comment said "nx_wasmemit_guard_gate enforces that it stays" -- 36// so all 21 matched the self-test and were skipped. The census read `emitters=22 -> 1` and the gate 37// went GREEN on its main tooth while measuring almost nothing. ★PROSE IS SOURCE BYTES TOO. 38// A file's IDENTITY is its PATH, which no other file can contain; the tooth below asserts the 39// exclusion fired EXACTLY ONCE, which is what caught this. 40const WG_SELF: *u8 = "nx_wasmemit_guard_gate.nx" 41 42const WG_DIRBUF: i64 = 131072 43const WG_PATHBUF: i64 = 4096 44const WG_MAXDEPTH: i64 = 12 45const WG_ROOT: *u8 = "buildroot/runtime" 46 47// tallies: [0]=.nx seen [1]=emitters found [2]=guarded [3]=UNGUARDED [4]=depth-capped [5]=self seen 48const WG_TAL_SLOTS: i64 = 16 49static WG_TAL: i64 50func wg_tal() -> *i64 { if WG_TAL == 0 { WG_TAL = sys_mmap(WG_TAL_SLOTS * 8) as i64 } return WG_TAL as *i64 } 51 52func wg_puts(s: *u8) -> i64 { return gv_puts(s) } 53func wg_num(v: i64) -> i64 { return gv_num(v) } 54 55func wg_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 56 57func wg_is_nx(nm: *u8) -> i64 { 58 let n: i64 = wg_slen(nm) 59 if n < 4 { return 0 } 60 if nm[n-3] != (46 as u8) { return 0 } 61 if nm[n-2] != (110 as u8) { return 0 } 62 if nm[n-1] != (120 as u8) { return 0 } 63 return 1 64} 65 66func wg_find(buf: *u8, len: i64, needle: *u8) -> i64 { 67 let m: i64 = wg_slen(needle) 68 if m == 0 { return 0 - 1 } 69 if m > len { return 0 - 1 } 70 var i: i64 = 0 71 let last: i64 = len - m 72 while i <= last { 73 var j: i64 = 0 74 var ok: i64 = 1 75 while j < m { 76 if buf[i+j] != needle[j] { ok = 0; j = m } else { j = j + 1 } 77 } 78 if ok == 1 { return i } 79 i = i + 1 80 } 81 return 0 - 1 82} 83 84static WG_LEN: i64 85func wg_lenbox() -> *i64 { if WG_LEN == 0 { WG_LEN = sys_mmap(16) as i64 } return WG_LEN as *i64 } 86 87// Identity by PATH: a file cannot be another file, but any file can quote another's name. 88func wg_ends_with(path: *u8, suf: *u8) -> i64 { 89 let n: i64 = wg_slen(path) 90 let m: i64 = wg_slen(suf) 91 if m > n { return 0 } 92 var i: i64 = 0 93 while i < m { 94 if path[n-m+i] != suf[i] { return 0 } 95 i = i + 1 96 } 97 return 1 98} 99 100func wg_check(path: *u8) -> i64 { 101 let tal: *i64 = wg_tal() 102 103 // Self-exclusion FIRST, on the PATH, and counted so the tooth below can prove it fired exactly once. 104 if wg_ends_with(path, WG_SELF) == 1 { 105 tal[5] = tal[5] + 1 106 return 0 107 } 108 109 let lp: *i64 = wg_lenbox() 110 let buf: *u8 = sys_read_file(path, lp) 111 if (buf as i64) == 0 { return 0 } 112 113 var isemit: i64 = 0 114 if wg_find(buf, lp[0], WG_M_INST) >= 0 { 115 if wg_find(buf, lp[0], WG_M_WW) >= 0 { 116 if wg_find(buf, lp[0], WG_M_FBO) >= 0 { isemit = 1 } 117 } 118 } 119 if isemit == 0 { sys_munmap(buf, lp[0]); return 0 } 120 121 tal[1] = tal[1] + 1 122 if wg_find(buf, lp[0], WG_M_GUARD) >= 0 { 123 tal[2] = tal[2] + 1 124 } else { 125 tal[3] = tal[3] + 1 126 // ★A COUNT WITHOUT A WORKLIST IS NOT ACTIONABLE. 127 wg_puts(" UNGUARDED " as *u8); wg_puts(path) 128 wg_puts("\n emits a framebuffer wasm page and never calls wf_guard -- it can ship a\n" as *u8) 129 wg_puts(" module whose framebuffer does not fit the memory it declares.\n" as *u8) 130 } 131 sys_munmap(buf, lp[0]) 132 return 0 133} 134 135func wg_walk(dir: *u8, depth: i64) -> i64 { 136 let tal: *i64 = wg_tal() 137 if depth > WG_MAXDEPTH { tal[4] = tal[4] + 1; return 0 } 138 let fd: i64 = sys_openat_rd(dir) 139 if fd < 0 { return 0 } 140 let dbuf: *u8 = sys_mmap(WG_DIRBUF) 141 var go: i64 = 1 142 while go == 1 { 143 // ⚠ONE getdents64 CALL IS NOT A DIRECTORY LISTING -- loop until it returns 0. 144 let nb: i64 = sys_getdents64(fd, dbuf, WG_DIRBUF) 145 if nb <= 0 { go = 0 } else { 146 var off: i64 = 0 147 while off < nb { 148 let rec: *u8 = ((dbuf as i64) + off) as *u8 149 let rl: i64 = dirent_reclen(rec) 150 if rl <= 0 { off = nb } else { 151 let nm: *u8 = dirent_name(rec) 152 let dt: i64 = dirent_type(rec) 153 var skip: i64 = 0 154 if nm[0] == (46 as u8) { skip = 1 } 155 if skip == 0 { 156 let p: *u8 = sys_mmap(WG_PATHBUF) 157 var c: i64 = 0 158 while dir[c] != (0 as u8) { p[c] = dir[c]; c = c + 1 } 159 p[c] = 47 as u8 160 c = c + 1 161 var d: i64 = 0 162 while nm[d] != (0 as u8) { p[c+d] = nm[d]; d = d + 1 } 163 p[c+d] = 0 as u8 164 if dt == 4 { wg_walk(p, depth + 1) } else { 165 if wg_is_nx(nm) == 1 { tal[0] = tal[0] + 1; wg_check(p) } 166 } 167 sys_munmap(p, WG_PATHBUF) 168 } 169 off = off + rl 170 } 171 } 172 } 173 } 174 sys_close(fd) 175 sys_munmap(dbuf, WG_DIRBUF) 176 return 0 177} 178 179func main(argc: i64, argv: *i64) -> i64 { 180 let ctr: *i64 = gv_ctr() 181 wg_puts("=== nx_wasmemit_guard_gate: every framebuffer-wasm-page emitter is wired to nx_wasmfit ===\n" as *u8) 182 183 let tal: *i64 = wg_tal() 184 var z: i64 = 0 185 while z < WG_TAL_SLOTS { tal[z] = 0; z = z + 1 } 186 wg_walk(WG_ROOT, 0) 187 188 wg_puts("\n nx_sources=" as *u8); wg_num(tal[0]) 189 wg_puts(" framebuffer_page_emitters=" as *u8); wg_num(tal[1]) 190 wg_puts("\n guarded=" as *u8); wg_num(tal[2]) 191 wg_puts(" UNGUARDED=" as *u8); wg_num(tal[3]) 192 let sum: i64 = tal[2] + tal[3] 193 wg_puts(" partition sum=" as *u8); wg_num(sum) 194 if sum == tal[1] { wg_puts(" RECONCILES\n" as *u8) } else { wg_puts(" LEAKS\n" as *u8) } 195 196 gv_check("the partition reconciles: every emitter found is either guarded or named" as *u8, (sum == tal[1]) as i64, ctr) 197 // ★A TOOTH THAT PASSES ON THE EMPTY SET IS NOT A TOOTH -- bind the assertion to its denominator, or 198 // a walk that enumerated nothing reads as a clean estate. 199 gv_check("every framebuffer-wasm-page emitter calls wf_guard" as *u8, ((tal[3] == 0) && (tal[1] > 0)) as i64, ctr) 200 // ★ASSERT THE EXCLUSION FIRED. If this gate stopped matching its own name the self-skip would 201 // silently become a hole any file could fall through. 202 gv_check("neg-control-self-exclusion: this gate's own source was seen and skipped exactly once" as *u8, (tal[5] == 1) as i64, ctr) 203 gv_check("the walk completed without hitting its depth cap, so this is a total and not a floor" as *u8, (tal[4] == 0) as i64, ctr) 204 205 return gv_verdict("WASMEMIT-GUARD" as *u8, ctr, "no organ can emit a framebuffer wasm page without the estate's one fit ruler" as *u8) 206}