code wiki / _hdl_build / nx_wiki_publish_guard_gate.nx
`nx_wiki_publish_guard_gate.nx` source

↩ module page · 157 lines · 8982 B
1// nx_wiki_publish_guard_gate.nx -- TEETH for the pre-publish guard (nx_wiki_publish_guard). Proves the
2// fail-closed "liar-kill": a page is ALLOWED only when it is fresh-stamped AND every [[cite:<cid>]]
3// resolves in the content-addressed archive AND every internal /wiki/<x>.html link is in the corpus
4// AND the body is real content. Positive control (well-formed page -> ALLOW) + FOUR negative controls,
5// each asserting the EXACT machine-readable reason code (not merely "rejected"):
6//   (i)   well-formed page                         -> PG_ALLOW
7//   (ii)  no freshness stamp                       -> PG_REJECT_NO_FRESHNESS
8//   (iii) a dangling [[cite:<cid>]] (cid absent)   -> PG_REJECT_DANGLING_CITE
9//   (iv)  href to a /wiki page NOT in the corpus   -> PG_REJECT_DEAD_LINK
10//   (v)   empty / placeholder body                 -> PG_REJECT_PLACEHOLDER
11// The positive control PLANTS a real resolvable citation: it archives a source body into a fresh
12// per-run seg_store (ss_begin -> war_archive_page -> ss_commit), gets back the REAL cid, and embeds
13// [[cite:<that cid>]] in the page -- so the guard's archive resolution is exercised end-to-end, not
14// mocked. Appends "PUBGUARD ... verdict=PASS" to knowledge/status/pubguard_gate.log on all-pass.
15// Exit 0 iff all pass (no fake-green). license_tier: ORIGINAL
16import "nx_wiki_publish_guard.nx"
17import "nx_syscalls.nx"
18
19func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
20func g_num(v: i64) -> i64 {
  let bb: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m }
  let t: *u8 = sys_mmap(28); var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 }
  sys_write(1, bb, k); return 0
27}
28func g_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64 = off; var k: i64 = 0; while s[k] != (0 as u8) { dst[o] = s[k]; o = o + 1; k = k + 1 } return o }
29func g_catnum(dst: *u8, off: i64, v: i64) -> i64 {
  var o: i64 = off; let t: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m }
  var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0; while i < k { dst[o] = t[k - 1 - i]; o = o + 1; i = i + 1 } return o
34}
35func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
36
37// name a reject code for the human-readable row (keeps the assertion legible).
38func g_codename(v: i64) -> *u8 {
  if v == PG_ALLOW { return "ALLOW" as *u8 }
  if v == PG_REJECT_NO_FRESHNESS { return "REJECT NO_FRESHNESS" as *u8 }
  if v == PG_REJECT_DANGLING_CITE { return "REJECT DANGLING_CITE" as *u8 }
  if v == PG_REJECT_DEAD_LINK { return "REJECT DEAD_LINK" as *u8 }
  if v == PG_REJECT_PLACEHOLDER { return "REJECT PLACEHOLDER" as *u8 }
  return "UNKNOWN" as *u8
45}
46
47// emit one gate row: got vs want (the EXACT code). pass iff got==want.
48func g_row(id: i64, got: i64, want: i64, what: *u8) -> i64 {
  var ok: i64 = 0
  if got == want { ok = 1 }
  g_w("PGROW " as *u8); g_num(id); g_w(" " as *u8)
  if ok == 1 { g_w("PASS " as *u8) } else { g_w("FAIL " as *u8) }
  g_w(what); g_w(" [want=" as *u8); g_w(g_codename(want)); g_w(" got=" as *u8); g_w(g_codename(got)); g_w("]\n" as *u8)
  return ok
55}
56
57func main() -> i64 {
  // ---- a fresh per-run archive store prefix (flat files in /tmp; no mkdir needed) ----
  let prefix: *u8 = sys_mmap(128)
  var po: i64 = 0
  po = ss_cat(prefix, po, "/tmp/pgds" as *u8)
  po = ss_catn(prefix, po, sys_now_us())
  po = ss_cat(prefix, po, "-" as *u8)
  prefix[po] = 0 as u8
65
  // ---- PLANT a real resolvable source: archive a body, get back its REAL cid ----
  let srcbody: *u8 = "NIST SP 800-207: a zero-trust architecture denies by default." as *u8
  let srcn: i64 = g_slen(srcbody)
  let goodcid: *u8 = sys_mmap(80)
  let w: *i64 = ss_begin()
  let ar: i64 = war_archive_page(w, "src_ztna" as *u8, srcbody, srcn, goodcid)
  if ar != 0 { g_w("PGGATE FATAL: archive add failed\n" as *u8); sys_exit(2); return 2 }
  let cr: i64 = ss_commit(prefix, w, 1)
  if cr != 0 { g_w("PGGATE FATAL: archive commit failed\n" as *u8); sys_exit(2); return 2 }
  // sanity: the cid must now resolve (proves the fixture before we test the guard)
  let pp: *i64 = sys_mmap(16) as *i64
  let chk: i64 = war_get_by_cid(prefix, goodcid, pp, PG_SCAN_CAP)
  if chk <= 0 { g_w("PGGATE FATAL: planted cid did not resolve\n" as *u8); sys_exit(2); return 2 }
79
  // ---- corpus set: the slugs that will be published together ----
  let cs_ptr: *i64 = sys_mmap(8 * 8) as *i64
  let cs_len: *i64 = sys_mmap(8 * 8) as *i64
  cs_ptr[0] = "start" as *u8 as i64;     cs_len[0] = 5
  cs_ptr[1] = "charter" as *u8 as i64;   cs_len[1] = 7
  cs_ptr[2] = "nist_stem" as *u8 as i64; cs_len[2] = 9
  let ncorpus: i64 = 3
87
  // ---- build the WELL-FORMED page: freshness + a RESOLVABLE cite + only corpus links + real body --
  // page = "...epoch=123... [[cite:<goodcid>]] ... <a href=\"/wiki/charter.html\">...\""
  let good: *u8 = sys_mmap(4096)
  var go: i64 = 0
  go = g_cat(good, go, "<h1>Zero Trust</h1><p class=\"fresh\">epoch=1781730256</p>" as *u8)
  go = g_cat(good, go, "<p>See <a href=\"/wiki/charter.html\">the charter</a> and " as *u8)
  go = g_cat(good, go, "<a href=\"/wiki/start.html#tasks\">tasks</a>.</p>" as *u8)
  go = g_cat(good, go, "<p>Evidence: [[cite:" as *u8)
  go = g_cat(good, go, goodcid)                          // the REAL resolvable cid
  go = g_cat(good, go, "]]</p>" as *u8)
  let goodn: i64 = go
99
  var pass: i64 = 0
  var rows: i64 = 0
  var v: i64 = 0
103
  // (i) POSITIVE CONTROL: well-formed page -> ALLOW
  v = pg_decide(prefix, good, goodn, cs_ptr, cs_len, ncorpus)
  rows = rows + 1; pass = pass + g_row(0, v, PG_ALLOW, "well-formed page (fresh+resolvable-cite+live-links+real-body)" as *u8)
107
  // (ii) NO FRESHNESS: same content shape but no epoch= stamp -> REJECT NO_FRESHNESS
  let nofresh: *u8 = sys_mmap(2048)
  var nf: i64 = 0
  nf = g_cat(nofresh, nf, "<h1>Zero Trust</h1><p>no stamp here</p>" as *u8)
  nf = g_cat(nofresh, nf, "<p>See <a href=\"/wiki/charter.html\">charter</a>.</p>" as *u8)
  let nofreshn: i64 = nf
  v = pg_decide(prefix, nofresh, nofreshn, cs_ptr, cs_len, ncorpus)
  rows = rows + 1; pass = pass + g_row(1, v, PG_REJECT_NO_FRESHNESS, "page missing freshness stamp" as *u8)
116
  // (iii) DANGLING CITE: fresh + a cite whose cid is NOT in the archive -> REJECT DANGLING_CITE
  let dang: *u8 = sys_mmap(2048)
  var dg: i64 = 0
  dg = g_cat(dang, dg, "<h1>Zero Trust</h1><p>epoch=1781730256</p>" as *u8)
  dg = g_cat(dang, dg, "<p>Evidence: [[cite:nxc1-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef]]</p>" as *u8)
  let dangn: i64 = dg
  v = pg_decide(prefix, dang, dangn, cs_ptr, cs_len, ncorpus)
  rows = rows + 1; pass = pass + g_row(2, v, PG_REJECT_DANGLING_CITE, "page with a dangling (unresolvable) cite" as *u8)
125
  // (iv) DEAD LINK: fresh + an href to a /wiki page NOT in the corpus -> REJECT DEAD_LINK
  let dead: *u8 = sys_mmap(2048)
  var dd: i64 = 0
  dd = g_cat(dead, dd, "<h1>Zero Trust</h1><p>epoch=1781730256</p>" as *u8)
  dd = g_cat(dead, dd, "<p>See <a href=\"/wiki/ghost_page.html\">a missing page</a>.</p>" as *u8)
  let deadn: i64 = dd
  v = pg_decide(prefix, dead, deadn, cs_ptr, cs_len, ncorpus)
  rows = rows + 1; pass = pass + g_row(3, v, PG_REJECT_DEAD_LINK, "page links to a /wiki page absent from the corpus" as *u8)
134
  // (v) PLACEHOLDER: fresh + an obvious placeholder marker -> REJECT PLACEHOLDER
  let ph: *u8 = sys_mmap(2048)
  var ph2: i64 = 0
  ph2 = g_cat(ph, ph2, "<h1>Zero Trust</h1><p>epoch=1781730256</p><p>TODO: write this section</p>" as *u8)
  let phn: i64 = ph2
  v = pg_decide(prefix, ph, phn, cs_ptr, cs_len, ncorpus)
  rows = rows + 1; pass = pass + g_row(4, v, PG_REJECT_PLACEHOLDER, "page with a TODO placeholder marker" as *u8)
142
  // ---- verdict ----
  g_w("NX-PUBGUARD-GATE rows=" as *u8); g_num(rows); g_w(" pass=" as *u8); g_num(pass); g_w("\n" as *u8)
  if pass == rows {
      let line: *u8 = sys_mmap(256)
      var off: i64 = g_cat(line, 0, "PUBGUARD row=nx_wiki_publish_guard pdp rows=" as *u8)
      off = g_catnum(line, off, rows); off = g_cat(line, off, " pass=" as *u8); off = g_catnum(line, off, pass)
      off = g_cat(line, off, " verdict=PASS\n" as *u8)
      let gf: i64 = sys_openat_append("knowledge/status/pubguard_gate.log" as *u8, 0x1a4)
      if gf >= 0 { sys_write(gf, line, off); sys_close(gf) }
      g_w("NX-PUBGUARD-GATE verdict=PASS -- fail-closed pre-publish guard recorded in pubguard_gate.log\n" as *u8)
      sys_exit(0); return 0
  }
  g_w("NX-PUBGUARD-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8)
  sys_exit(1); return 1
157}
nx_wiki_publish_guard_gate.nx source

`nx_wiki_publish_guard_gate.nx` source
