code wiki / _hdl_build / nx_wiki_versioned_publish_gate.nx
`nx_wiki_versioned_publish_gate.nx` source

↩ module page · 287 lines · 16097 B
1// nx_wiki_versioned_publish_gate.nx -- TEETH for A4a (versioned-publish + multi-point rollback).
2//
3// HERMETIC: a fresh per-run archive/index store prefix in /tmp; EVERY publish/restore uses do_push_flag=0
4// so the gate NEVER touches the network/vault/SSH -- but it DOES exercise the archive + version-index +
5// restore BYTE-PATH fully (read blob back by CID, write to a local file, re-read). No fake-green: exit 0
6// iff every assertion passes; a PASS line is appended to knowledge/status/ only on all-pass.
7//
8// WHAT IS PROVEN (each asserts EXACT bytes/identities, not merely "ok"):
9//   C1  publish v1,v2,v3 (3 DISTINCT contents) -> each vpub returns VP_OK and assigns v#=1,2,3.
10//   C2  MULTI-POINT: vp_list(slug) returns exactly 3 retained rollback points with 3 DISTINCT CIDs
11//       (not just the latest) -- the core "MULTIPLE rollback points" guarantee.
12//   C3  restore -> v1 yields the EXACT v1 bytes (byte-for-byte) live-staged.
13//   C4  restore -> the MIDDLE v2 yields the EXACT v2 bytes (proves rollback to ANY point, not just last).
14//   C5  restore -> an unknown v# (99) is REFUSED (VR_NOT_FOUND) and push is NOT invoked (fail-closed).
15//   C6  APPEND-ONLY: after v2 AND v3 were published, v1's retained record (its CID and the bytes that CID
16//       resolves to) is BYTE-IDENTICAL to what it was right after v1 -- a new publish never mutates/deletes
17//       an older version.
18//   C7  the 3 distinct contents are pairwise distinct (sanity: distinct CIDs require distinct bytes).
19// license_tier: ORIGINAL
20import "nx_wiki_versioned_publish.nx"
21import "nx_wiki_restore.nx"
22import "nx_syscalls.nx"
23
24func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
25func g_num(v: i64) -> i64 {
  let bb: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m; sys_write(1, "-" as *u8, 1) }
  let t: *u8 = sys_mmap(28); var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 }
  sys_write(1, bb, k); return 0
32}
33func g_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64 = off; var k: i64 = 0; while s[k] != (0 as u8) { dst[o] = s[k]; o = o + 1; k = k + 1 } return o }
34func g_catnum(dst: *u8, off: i64, v: i64) -> i64 {
  var o: i64 = off; let t: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m }
  var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0; while i < k { dst[o] = t[k - 1 - i]; o = o + 1; i = i + 1 } return o
39}
40func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
41
42// byte-equal two buffers of given lengths.
43func g_byteq(a: *u8, an: i64, b: *u8, bn: i64) -> i64 {
  if an != bn { return 0 }
  var i: i64 = 0
  while i < an { if a[i] != b[i] { return 0 } i = i + 1 }
  return 1
48}
49// NUL-terminated string equal.
50func g_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while 1 == 1 {
      if a[i] != b[i] { return 0 }
      if a[i] == (0 as u8) { return 1 }
      i = i + 1
  }
  return 1
58}
59
60// write buf to a per-run /tmp file so vpub/restore read it like a production page.
61func g_stage(path: *u8, buf: *u8, n: i64) -> i64 {
  let fd: i64 = sys_openat_wr(path, 0x1a4)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, buf, n)
  sys_close(fd)
  return 0
67}
68
69// emit a PASS/FAIL row; returns 1 if ok.
70func g_row(id: i64, ok: i64, what: *u8) -> i64 {
  g_w("VPROW " as *u8); g_num(id); g_w(" " as *u8)
  if ok == 1 { g_w("PASS " as *u8) } else { g_w("FAIL " as *u8) }
  g_w(what); g_w("\n" as *u8)
  return ok
75}
76
77// build a guard-PASSING page body into buf: freshness stamp + only-corpus /wiki link + a resolvable
78// [[cite:<cid>]] + a distinguishing marker string. Returns the byte length.
79func g_build_page(buf: *u8, marker: *u8, goodcid: *u8) -> i64 {
  var o: i64 = 0
  o = g_cat(buf, o, "<h1>Versioned</h1><p class=\"fresh\">epoch=1781730256</p>" as *u8)
  o = g_cat(buf, o, "<p>See <a href=\"/wiki/charter.html\">the charter</a>.</p>" as *u8)
  o = g_cat(buf, o, "<p>marker=" as *u8)
  o = g_cat(buf, o, marker)
  o = g_cat(buf, o, "</p><p>Evidence: [[cite:" as *u8)
  o = g_cat(buf, o, goodcid)
  o = g_cat(buf, o, "]]</p>" as *u8)
  return o
89}
90
91func main() -> i64 {
  // ---- a fresh per-run archive/index store prefix (flat files in /tmp; no mkdir) ----
  let prefix: *u8 = sys_mmap(128)
  var po: i64 = 0
  po = g_cat(prefix, po, "/tmp/vpds" as *u8)
  po = g_catnum(prefix, po, sys_now_us())
  po = g_cat(prefix, po, "-" as *u8)
  prefix[po] = 0 as u8
99
  // ---- PLANT a resolvable citation source so the guard's cite-resolution passes ----
  let srcbody: *u8 = "NIST SP 800-207 zero-trust: evidence-cited, versioned publishing with rollback." as *u8
  let srcn: i64 = g_slen(srcbody)
  let goodcid: *u8 = sys_mmap(80)
  let w0: *i64 = ss_begin()
  if war_archive_page(w0, "src_a4a" as *u8, srcbody, srcn, goodcid) != 0 { g_w("VPGATE FATAL: src archive failed\n" as *u8); sys_exit(2); return 2 }
  if ss_commit(prefix, w0, 0) != 0 { g_w("VPGATE FATAL: src commit failed\n" as *u8); sys_exit(2); return 2 }
  let chkpp: *i64 = sys_mmap(16) as *i64
  if war_get_by_cid(prefix, goodcid, chkpp, VR_SCAN_CAP) <= 0 { g_w("VPGATE FATAL: planted cite did not resolve\n" as *u8); sys_exit(2); return 2 }
109
  // ---- corpus set (only these /wiki links are allowed by the guard) ----
  let cs_ptr: *i64 = sys_mmap(8 * 8) as *i64
  let cs_len: *i64 = sys_mmap(8 * 8) as *i64
  cs_ptr[0] = "start" as *u8 as i64;   cs_len[0] = 5
  cs_ptr[1] = "charter" as *u8 as i64; cs_len[1] = 7
  let ncorpus: i64 = 2
116
  let slug: *u8 = "vptest" as *u8
118
  // ---- build the three DISTINCT page bodies and stage them ----
  let b1: *u8 = sys_mmap(4096)
  let b2: *u8 = sys_mmap(4096)
  let b3: *u8 = sys_mmap(4096)
  let n1: i64 = g_build_page(b1, "ALPHA-v1" as *u8, goodcid)
  let n2: i64 = g_build_page(b2, "BRAVO-v2-extra-bytes" as *u8, goodcid)
  let n3: i64 = g_build_page(b3, "CHARLIE-v3" as *u8, goodcid)
  let f1: *u8 = "/tmp/vp_v1.html" as *u8
  let f2: *u8 = "/tmp/vp_v2.html" as *u8
  let f3: *u8 = "/tmp/vp_v3.html" as *u8
  if g_stage(f1, b1, n1) != 0 { g_w("VPGATE FATAL: stage v1\n" as *u8); sys_exit(2); return 2 }
  if g_stage(f2, b2, n2) != 0 { g_w("VPGATE FATAL: stage v2\n" as *u8); sys_exit(2); return 2 }
  if g_stage(f3, b3, n3) != 0 { g_w("VPGATE FATAL: stage v3\n" as *u8); sys_exit(2); return 2 }
132
  var pass: i64 = 0
  var rows: i64 = 0
  let res: *PubResult = sys_mmap(64) as *PubResult
  let vout: *i64 = sys_mmap(16) as *i64
137
  // ============================================================================================
  // C1: publish v1,v2,v3 (do_push_flag=0). Each VP_OK, version# 1,2,3.
  // ============================================================================================
  let r1: i64 = vpub_ex(prefix, slug, f1, cs_ptr, cs_len, ncorpus, 1781730256, 0, res, vout)
  let v1n: i64 = vout[0]
  // capture v1's retained CID RIGHT NOW (tiny durable identity) for the append-only proof later.
  // We deliberately do NOT keep a RAM byte-snapshot across the later publishes/restores: the CID IS a
  // sha256 of v1's bytes, so "CID unchanged AFTER v2,v3 + the blob still resolves to the ORIGINAL v1
  // source bytes" is a cryptographically COMPLETE append-only proof (a mutated blob could not keep the
  // same CID). This proof reads from the DURABLE store, not from process memory.
  let v1cid_then: *u8 = sys_mmap(80)
  vp_cid_of_version(prefix, slug, 1, v1cid_then)
150
  let r2: i64 = vpub_ex(prefix, slug, f2, cs_ptr, cs_len, ncorpus, 1781730256, 0, res, vout)
  let v2n: i64 = vout[0]
  let r3: i64 = vpub_ex(prefix, slug, f3, cs_ptr, cs_len, ncorpus, 1781730256, 0, res, vout)
  let v3n: i64 = vout[0]
155
  var c1ok: i64 = 1
  if r1 != VP_OK { c1ok = 0 }
  if r2 != VP_OK { c1ok = 0 }
  if r3 != VP_OK { c1ok = 0 }
  if v1n != 1 { c1ok = 0 }
  if v2n != 2 { c1ok = 0 }
  if v3n != 3 { c1ok = 0 }
  rows = rows + 1
  g_w("  v1rc=" as *u8); g_w(vp_status_name(r1)); g_w(" v#=" as *u8); g_num(v1n)
  g_w(" | v2rc=" as *u8); g_w(vp_status_name(r2)); g_w(" v#=" as *u8); g_num(v2n)
  g_w(" | v3rc=" as *u8); g_w(vp_status_name(r3)); g_w(" v#=" as *u8); g_num(v3n); g_w("\n" as *u8)
  pass = pass + g_row(1, c1ok, "publish v1,v2,v3 -> VP_OK, version#=1,2,3" as *u8)
168
  // ============================================================================================
  // C2: MULTI-POINT -- vp_list returns exactly 3 retained points with 3 DISTINCT CIDs.
  // ============================================================================================
  let vers: *i64 = sys_mmap(8 * 64) as *i64
  let cidbuf: *u8 = sys_mmap(72 * 64)
  let nlist: i64 = vp_list_ex(prefix, slug, vers, cidbuf, 64)
  let cidA: *u8 = (cidbuf as i64 + 0 * 72) as *u8
  let cidB: *u8 = (cidbuf as i64 + 1 * 72) as *u8
  let cidC: *u8 = (cidbuf as i64 + 2 * 72) as *u8
  var c2ok: i64 = 1
  if nlist != 3 { c2ok = 0 }
  if vers[0] != 1 { c2ok = 0 }
  if vers[1] != 2 { c2ok = 0 }
  if vers[2] != 3 { c2ok = 0 }
  // distinct CIDs (distinct contents => distinct content addresses)
  if g_streq(cidA, cidB) == 1 { c2ok = 0 }
  if g_streq(cidA, cidC) == 1 { c2ok = 0 }
  if g_streq(cidB, cidC) == 1 { c2ok = 0 }
  rows = rows + 1
  g_w("  vp_list count=" as *u8); g_num(nlist); g_w(" versions=[" as *u8)
  g_num(vers[0]); g_w("," as *u8); g_num(vers[1]); g_w("," as *u8); g_num(vers[2]); g_w("]\n" as *u8)
  g_w("    v1 cid=" as *u8); g_w(cidA); g_w("\n" as *u8)
  g_w("    v2 cid=" as *u8); g_w(cidB); g_w("\n" as *u8)
  g_w("    v3 cid=" as *u8); g_w(cidC); g_w("\n" as *u8)
  pass = pass + g_row(2, c2ok, "vp_list = 3 DISTINCT retained rollback points (multi-point)" as *u8)
194
  // ============================================================================================
  // C3: restore -> v1 yields EXACT v1 bytes.
  // ============================================================================================
  let stage: *u8 = "/tmp/vp_restore.html" as *u8
  let nout: *i64 = sys_mmap(16) as *i64
  let rr1: i64 = restore_ex(prefix, slug, 1, stage, cs_ptr, cs_len, ncorpus, 0, res, nout)
  // read back what was staged live and compare to the ORIGINAL v1 bytes.
  let sbox: *i64 = sys_mmap(16) as *i64
  let sback1: *u8 = sys_read_file(stage, sbox)
  var c3ok: i64 = 1
  if rr1 != VR_OK { c3ok = 0 }
  if g_byteq(sback1, sbox[0], b1, n1) != 1 { c3ok = 0 }
  rows = rows + 1
  g_w("  restore(v1) rc=" as *u8); g_w(vr_status_name(rr1)); g_w(" staged_bytes=" as *u8); g_num(sbox[0]); g_w(" orig_v1=" as *u8); g_num(n1); g_w("\n" as *u8)
  pass = pass + g_row(3, c3ok, "restore->v1 is byte-exact v1" as *u8)
210
  // ============================================================================================
  // C4: restore -> the MIDDLE v2 yields EXACT v2 bytes (roll back to ANY point, not just last).
  // ============================================================================================
  let rr2: i64 = restore_ex(prefix, slug, 2, stage, cs_ptr, cs_len, ncorpus, 0, res, nout)
  let sback2: *u8 = sys_read_file(stage, sbox)
  var c4ok: i64 = 1
  if rr2 != VR_OK { c4ok = 0 }
  if g_byteq(sback2, sbox[0], b2, n2) != 1 { c4ok = 0 }
  // also assert it is NOT v1 or v3 (proves true mid-point selection)
  if g_byteq(sback2, sbox[0], b1, n1) == 1 { c4ok = 0 }
  if g_byteq(sback2, sbox[0], b3, n3) == 1 { c4ok = 0 }
  rows = rows + 1
  g_w("  restore(v2 MIDDLE) rc=" as *u8); g_w(vr_status_name(rr2)); g_w(" staged_bytes=" as *u8); g_num(sbox[0]); g_w(" orig_v2=" as *u8); g_num(n2); g_w("\n" as *u8)
  pass = pass + g_row(4, c4ok, "restore->MIDDLE v2 is byte-exact v2 (any-point rollback)" as *u8)
225
  // ============================================================================================
  // C5: restore -> unknown v# (99) is REFUSED (VR_NOT_FOUND), push NOT invoked.
  // ============================================================================================
  // pre-set res to a sentinel so we can confirm restore did NOT invoke the push path.
  res.push_invoked = 0 - 7
  let rr99: i64 = restore_ex(prefix, slug, 99, stage, cs_ptr, cs_len, ncorpus, 0, res, nout)
  var c5ok: i64 = 1
  if rr99 != VR_NOT_FOUND { c5ok = 0 }
  if res.push_invoked != (0 - 7) { c5ok = 0 }   // unchanged sentinel => pub_publish was never reached
  rows = rows + 1
  g_w("  restore(v99 unknown) rc=" as *u8); g_w(vr_status_name(rr99)); g_w(" (push path NOT reached: sentinel intact=" as *u8)
  if res.push_invoked == (0 - 7) { g_w("yes" as *u8) } else { g_w("NO" as *u8) }
  g_w(")\n" as *u8)
  pass = pass + g_row(5, c5ok, "restore->unknown v# REFUSED (VR_NOT_FOUND, no push)" as *u8)
240
  // ============================================================================================
  // C6: APPEND-ONLY -- v1's record is byte-identical AFTER v2 and v3 were published.
  // ============================================================================================
  let v1cid_now: *u8 = sys_mmap(80)
  vp_cid_of_version(prefix, slug, 1, v1cid_now)
  let v1pp2: *i64 = sys_mmap(16) as *i64
  let v1blen_now: i64 = war_get_by_cid(prefix, v1cid_now, v1pp2, VR_SCAN_CAP)
  var c6ok: i64 = 1
  // (a) the retained CID for v1 is byte-identical to the CID captured right after v1 (index untouched).
  let c6a: i64 = g_streq(v1cid_then, v1cid_now)
  if c6a != 1 { c6ok = 0 }
  // (b) the blob that CID resolves to AFTER v2,v3 is byte-identical to the ORIGINAL v1 source bytes.
  //     (a)+(b): CID unchanged AND blob == original content == a complete content-addressed proof that
  //     v1's record was neither mutated nor deleted by the later publishes.
  let c6b: i64 = g_byteq(v1pp2[0] as *u8, v1blen_now, b1, n1)
  if c6b != 1 { c6ok = 0 }
  g_w("  C6 subchecks a(cid-stable)=" as *u8); g_num(c6a); g_w(" b(blob==orig-v1)=" as *u8); g_num(c6b); g_w("\n" as *u8)
  rows = rows + 1
  g_w("  v1 cid then=" as *u8); g_w(v1cid_then); g_w("\n        now =" as *u8); g_w(v1cid_now); g_w("\n" as *u8)
  g_w("  v1 blob now=" as *u8); g_num(v1blen_now); g_w(" orig=" as *u8); g_num(n1); g_w("\n" as *u8)
  pass = pass + g_row(6, c6ok, "APPEND-ONLY: v1 record (CID+blob) byte-identical after v2,v3 (no mutate/delete)" as *u8)
262
  // ============================================================================================
  // C7: the three source contents are pairwise distinct (sanity for the distinct-CID claim).
  // ============================================================================================
  var c7ok: i64 = 1
  if g_byteq(b1, n1, b2, n2) == 1 { c7ok = 0 }
  if g_byteq(b1, n1, b3, n3) == 1 { c7ok = 0 }
  if g_byteq(b2, n2, b3, n3) == 1 { c7ok = 0 }
  rows = rows + 1
  pass = pass + g_row(7, c7ok, "the 3 published contents are pairwise distinct" as *u8)
272
  // ---- verdict ----
  g_w("NX-WIKI-VERSIONED-PUBLISH-GATE rows=" as *u8); g_num(rows); g_w(" pass=" as *u8); g_num(pass); g_w("\n" as *u8)
  if pass == rows {
      let line: *u8 = sys_mmap(256)
      var off: i64 = g_cat(line, 0, "WIKIVERSIONEDPUBLISH row=nx_wiki_versioned_publish multi-point-rollback rows=" as *u8)
      off = g_catnum(line, off, rows); off = g_cat(line, off, " pass=" as *u8); off = g_catnum(line, off, pass)
      off = g_cat(line, off, " evidence=3-retained+restore-middle+append-only verdict=PASS\n" as *u8)
      let gf: i64 = sys_openat_append("knowledge/status/wiki_versioned_publish_gate.log" as *u8, 0x1a4)
      if gf >= 0 { sys_write(gf, line, off); sys_close(gf) }
      g_w("NX-WIKI-VERSIONED-PUBLISH-GATE verdict=PASS\n" as *u8)
      sys_exit(0); return 0
  }
  g_w("NX-WIKI-VERSIONED-PUBLISH-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8)
  sys_exit(1); return 1
287}
nx_wiki_versioned_publish_gate.nx source

`nx_wiki_versioned_publish_gate.nx` source
