code wiki / _hdl_build / nx_wflow_connect_gate.nx
`nx_wflow_connect_gate.nx` source

↩ module page · 150 lines · 6705 B
1// nx_wflow_connect_gate.nx -- R3 CONNECTOR layer gate: the exec-organ action over the GREEN fail-closed
2// connector catalog (rows name<TAB>elf<TAB>GREEN, the tool_allowlist.conf shape). Proves: a workflow step
3// runs a REAL blessed organ (nx_tool_argecho + nx_vizsla_ics composing an actual .ics export), child exit 0
4// = step OK; unknown connector / RED flag / missing catalog all refuse FAIL-CLOSED (run FAILED, no fork);
5// a dead elf path exits 127 = honest step failure. Kept to 3 forks total (the degraded-box ~5-fork flake
6// lesson: fork-heavy gates stay SMALL). license_tier: ORIGINAL  expect_exit: 0
7import "nx_wflow_engine.nx"
8
9// catalog row writer: name TAB elf TAB flag NL (real bytes -- no \t escape reliance)
10func cg_row(conf: *u8, name: *u8, elf: *u8, flag: *u8) -> i64 {
  let ln: *u8 = sys_mmap(600)
  var o: i64 = 0
  o = wf_cat(ln, o, name)
  ln[o] = 9 as u8
  o = o + 1
  o = wf_cat(ln, o, elf)
  ln[o] = 9 as u8
  o = o + 1
  o = wf_cat(ln, o, flag)
  ln[o] = 10 as u8
  ln[o+1] = 0 as u8
  return wf_append(conf, ln)
23}
24func cg_unlink(path: *u8) -> i64 { return __syscall(263, 0 - 100, path as i64, 0, 0, 0, 0) }
25// count ledger lines for run token with given status needle
26func cg_n(led: *u8, ridtok: *u8, st: *u8) -> i64 {
  let szp: *i64 = sys_mmap(8) as *i64
  let b: *u8 = wf_readall(led, szp)
  if (b as i64) == 0 { return 0 - 1 }
  return wf_lines_with2(b, szp[0], ridtok, st)
31}
32func cg_file_has(path: *u8, needle: *u8) -> i64 {
  let szp: *i64 = sys_mmap(8) as *i64
  let b: *u8 = wf_readall(path, szp)
  if (b as i64) == 0 { return 0 }
  if szp[0] == 0 { return 0 }
  return wf_lines_with2(b, szp[0], needle, needle)
38}
39
40func main() -> i64 {
  p("=== NX-WFLOW-CONNECT GATE (R3: GREEN fail-closed connector catalog -- any blessed organ as a step) ===\n" as *u8)
  var ok: i64 = 1
  let now: i64 = wf_now()
44
  let conf: *u8 = sys_mmap(128)
  var co: i64 = 0
  co = wf_cat(conf, co, "/tmp/wfconn_" as *u8)
  co = wf_catn(conf, co, now)
  co = wf_cat(conf, co, ".conf" as *u8)
  conf[co] = 0 as u8
  let led: *u8 = sys_mmap(128)
  var lo: i64 = 0
  lo = wf_cat(led, lo, "/tmp/wfconn_led_" as *u8)
  lo = wf_catn(led, lo, now)
  lo = wf_cat(led, lo, ".log" as *u8)
  led[lo] = 0 as u8
57
  cg_row(conf, "argecho" as *u8, "./_offc/nx_tool_argecho.elf" as *u8, "GREEN" as *u8)
  cg_row(conf, "redorg" as *u8, "./_offc/nx_tool_argecho.elf" as *u8, "RED" as *u8)
  cg_row(conf, "ghost" as *u8, "/tmp/wflow_no_such_elf_ever" as *u8, "GREEN" as *u8)
  cg_row(conf, "vizsla_ics" as *u8, "./_offc/nx_vizsla_ics.elf" as *u8, "GREEN" as *u8)
62
  let flows: *i64 = sys_mmap(8 * 8) as *i64
  flows[0] = "fx1|conn-echo|-" as *u8 as i64
  flows[1] = "fx2|conn-miss|-" as *u8 as i64
  flows[2] = "fx3|conn-red|-" as *u8 as i64
  flows[3] = "fx4|conn-ghost|-" as *u8 as i64
  flows[4] = "fx5|conn-ics|-" as *u8 as i64
  let steps: *i64 = sys_mmap(8 * 8) as *i64
  steps[0] = "fx1|1|exec-organ|argecho|alpha~bravo|2" as *u8 as i64
  steps[1] = "fx2|1|exec-organ|nosuch|x|1" as *u8 as i64
  steps[2] = "fx3|1|exec-organ|redorg|x|1" as *u8 as i64
  steps[3] = "fx4|1|exec-organ|ghost|x|1" as *u8 as i64
  steps[4] = "fx5|1|exec-organ|vizsla_ics|export~knowledge/vizsla/demo/cal-~2026-07-01~2026-12-31~/tmp/wflow_demo.ics|1" as *u8 as i64
75
  let cx: *i64 = sys_mmap(32) as *i64
  cx[0] = steps as i64
  cx[1] = 5
  cx[2] = led as i64
  cx[3] = conf as i64
81
  // T0 load validation incl the exec-organ needs-a-connector rule
  let l0: i64 = wf_load(steps, 5)
  let badc: *i64 = sys_mmap(16) as *i64
  badc[0] = "f9|1|exec-organ|-|x|1" as *u8 as i64
  let lb: i64 = wf_load(badc, 1)
  p("  T0 load=" as *u8); pn(l0); p(" badDashConnector=" as *u8); pn(lb); p("\n" as *u8)
  if l0 != 5 { ok = 0 }
  if lb != (0 - 1) { ok = 0 }
90
  // T1 real fork-exec step: argecho runs with argv alpha bravo, exit 0 -> run DONE
  let r1: i64 = wf_fire(cx, flows, 5, "conn-echo~id=C1" as *u8)
  let d1: i64 = cg_n(led, " rid=C1.fx1 " as *u8, "status=DONE" as *u8)
  p("  T1 echo started=" as *u8); pn(r1); p(" done=" as *u8); pn(d1); p("\n" as *u8)
  if r1 != 1 { ok = 0 }
  if d1 != 1 { ok = 0 }
97
  // T2 unknown connector -> fail-closed refuse pre-fork -> run FAILED
  wf_fire(cx, flows, 5, "conn-miss~id=C2" as *u8)
  let f2: i64 = cg_n(led, " rid=C2.fx2 " as *u8, "status=FAILED" as *u8)
  let d2: i64 = cg_n(led, " rid=C2.fx2 " as *u8, "status=DONE" as *u8)
  p("  T2 unknown failed=" as *u8); pn(f2); p(" done=" as *u8); pn(d2); p("\n" as *u8)
  if f2 != 1 { ok = 0 }
  if d2 != 0 { ok = 0 }
105
  // T3 RED-flagged connector -> refused (only GREEN rows runnable)
  wf_fire(cx, flows, 5, "conn-red~id=C3" as *u8)
  let f3: i64 = cg_n(led, " rid=C3.fx3 " as *u8, "status=FAILED" as *u8)
  p("  T3 red failed=" as *u8); pn(f3); p("\n" as *u8)
  if f3 != 1 { ok = 0 }
111
  // T4 GREEN row but dead elf path -> child exit 127 -> honest step failure
  wf_fire(cx, flows, 5, "conn-ghost~id=C4" as *u8)
  let f4: i64 = cg_n(led, " rid=C4.fx4 " as *u8, "status=FAILED" as *u8)
  p("  T4 ghost failed=" as *u8); pn(f4); p("\n" as *u8)
  if f4 != 1 { ok = 0 }
117
  // T5 THE COMPOSED PROOF: a workflow step runs the real vizsla ICS organ over the demo calendar store
  // and the run only goes DONE if the organ exited 0; the exported .ics is then verified byte-real
  cg_unlink("/tmp/wflow_demo.ics" as *u8)
  let r5: i64 = wf_fire(cx, flows, 5, "conn-ics~id=C5" as *u8)
  let d5: i64 = cg_n(led, " rid=C5.fx5 " as *u8, "status=DONE" as *u8)
  let ics: i64 = cg_file_has("/tmp/wflow_demo.ics" as *u8, "BEGIN:VCALENDAR" as *u8)
  p("  T5 ics started=" as *u8); pn(r5); p(" done=" as *u8); pn(d5); p(" icsReal=" as *u8); pn(ics); p("\n" as *u8)
  if r5 != 1 { ok = 0 }
  if d5 != 1 { ok = 0 }
  if ics < 1 { ok = 0 }
128
  // T6 fail-closed DEFAULT: no catalog loaded (cx[3]=0) -> exec-organ refuses, run FAILED
  let led2: *u8 = sys_mmap(128)
  var l2: i64 = 0
  l2 = wf_cat(led2, l2, "/tmp/wfconn_led2_" as *u8)
  l2 = wf_catn(led2, l2, now)
  l2 = wf_cat(led2, l2, ".log" as *u8)
  led2[l2] = 0 as u8
  let cx2: *i64 = sys_mmap(32) as *i64
  cx2[0] = steps as i64
  cx2[1] = 5
  cx2[2] = led2 as i64
  cx2[3] = 0
  wf_fire(cx2, flows, 5, "conn-echo~id=C6" as *u8)
  let f6: i64 = cg_n(led2, " rid=C6.fx1 " as *u8, "status=FAILED" as *u8)
  p("  T6 nocatalog failed=" as *u8); pn(f6); p("\n" as *u8)
  if f6 != 1 { ok = 0 }
145
  p("NX-WFLOW-CONNECT-GATE conf=" as *u8); p(conf); p(" forks=3 " as *u8)
  if ok == 1 { p("verdict=GREEN\n" as *u8); return 0 }
  p("verdict=RED\n" as *u8)
  return 1
150}
nx_wflow_connect_gate.nx source

`nx_wflow_connect_gate.nx` source
