code wiki / (root) / nx_wpt_ingest_gate.nx
`nx_wpt_ingest_gate.nx` source

↩ module page · 489 lines · 24343 B
1// nx_wpt_ingest_gate.nx -- IN-PROCESS gate for BR21 (nx_wpt_acquire_lib, carried by nx_wpt_ingest).
2//
3// THE ANTI-VACUITY TOOTH IS THE WHOLE POINT AND IT IS NAMED. The defect BR21 closes is that the hand
4// acquisition path re-emitted every body through a TEXT TOOL ARGUMENT -- a NUL-terminated C string --
5// and html/syntax/parsing-html-fragments is the ENCODING-DETECTION suite, whose fixtures are UTF-16LE
6// with a BOM and therefore carry a NUL as their FOURTH BYTE. An ASCII fixture round-trips perfectly
7// through the broken path, so an ASCII fixture is a test the defect cannot fail. Every byte-exactness
8// tooth below runs on a UTF-16LE-with-BOM body built at RUNTIME, and the fixture is first asserted to
9// actually contain the NUL before any outcome is read: assert the fixture reached the condition
10// BEFORE asserting the outcome.
11//
12// THE HASH ANCHOR COMES FROM OUTSIDE THE ESTATE. wa_verify_blob compares against the git blob object
13// name GitHub declares. One tooth pins that arithmetic to f2ba8f84ab5c1bce84a7b441cb1959cfc7093b7f,
14// which is git hash-object of the three bytes abc under git 2.49.0 -- a value this estate did not
15// choose and cannot influence. Without it, computing a digest with swhid and then checking it with
16// swhid would prove plumbing and call it correctness.
17//
18// SCOPE, STATED: this gate is OFFLINE by construction. It proves the manifest parser, the dual
19// verification, the raw write, the read-back compare, the pin rule, the name allowlist, the
20// completeness conjunction and the manifest/marker emit. It does NOT prove the transport -- that is
21// nx_https_fetch_follow's subject, and the end-to-end proof is the live re-ingest reproducing
22// corpus_sha16 54e90b086e0c6530 and 1819a1dcd3030f03, recorded on browser.plan, not here.
23//
24// license_tier: ORIGINAL
25
26import "nx_syscalls.nx"
27import "nx_gate_verdict.nx"
28import "nx_wpt_acquire_lib.nx"
29
30const GT_DIR: *u8 = "/tmp/wsp_gate"
31const GT_FIX_CAP: i64 = 65536
32const GT_JSON_CAP: i64 = 65536
33const GT_BOM0: i64 = 255
34const GT_BOM1: i64 = 254
35const GT_FIX_LEN: i64 = 72          // DERIVED: 2 BOM bytes + 2 bytes per char of a 35-char title
36const GT_FIX_CSTR: i64 = 3          // DERIVED: BOM, BOM, first char -- then the NUL a C string stops at
37const GT_NUMBUF: i64 = 64           // DERIVED: a 64-bit decimal is at most 20 digits, plus a sign and a NUL
38const GT_SIZE_A: i64 = 1204         // the size GitHub declares for DOMTokenList-Iterable.html at the pin
39const GT_SIZE_B: i64 = 1205         // GT_SIZE_A + 1: the nearest neighbour, so the renderer cannot be a constant
40const GT_DIGITS_A: i64 = 5          // DERIVED: one char for the zero, plus the four digits of GT_SIZE_A
41const GT_DIGITS_B: i64 = 4          // DERIVED: the digit count of GT_SIZE_B
42
43// ---- RUNTIME FIXTURE BUILDERS (a detector that scans source finds its own fixtures) -------------
44
45func gt_utf16le(d: *u8) -> i64 {
  d[0] = GT_BOM0 as u8
  d[1] = GT_BOM1 as u8
  let s: *u8 = "<title>WPT encoding fixture</title>" as *u8
  var i: i64 = 0
  var o: i64 = 2
  while s[i] != (0 as u8) {
      d[o] = s[i]
      o = o + 1
      d[o] = 0 as u8
      o = o + 1
      i = i + 1
  }
  return o
59}
60
61func gt_q(d: *u8, o: i64) -> i64 { d[o] = 34 as u8; return o + 1 }
62func gt_ch(d: *u8, o: i64, c: i64) -> i64 { d[o] = c as u8; return o + 1 }
63func gt_kv(d: *u8, o: i64, k: *u8, v: *u8) -> i64 {
  var p: i64 = gt_q(d, o)
  p = wsp_scat(d, p, k)
  p = gt_q(d, p)
  p = gt_ch(d, p, 58)
  p = gt_ch(d, p, 32)
  p = gt_q(d, p)
  p = wsp_scat(d, p, v)
  p = gt_q(d, p)
  p = gt_ch(d, p, 44)
  p = gt_ch(d, p, 10)
  return p
75}
76func gt_kn(d: *u8, o: i64, k: *u8, v: i64) -> i64 {
  var p: i64 = gt_q(d, o)
  p = wsp_scat(d, p, k)
  p = gt_q(d, p)
  p = gt_ch(d, p, 58)
  p = gt_ch(d, p, 32)
  p = wa_mf_num(d, p, v)
  p = gt_ch(d, p, 44)
  p = gt_ch(d, p, 10)
  return p
86}
87// one contents-API record in GitHub's real field order, including the path and download_url values
88// that carry the file name -- so a parser matching a key without its quotes would be caught here.
89func gt_rec(d: *u8, o: i64, name: *u8, sha: *u8, size: i64, typ: *u8, with_sha: i64) -> i64 {
  var p: i64 = gt_ch(d, o, 123)
  p = gt_ch(d, p, 10)
  p = gt_kv(d, p, "name" as *u8, name)
  let pathbuf: *u8 = sys_mmap(1024)
  var q: i64 = wsp_scat(pathbuf, 0, "dom/lists/" as *u8)
  q = wsp_scat(pathbuf, q, name)
  pathbuf[q] = 0 as u8
  p = gt_kv(d, p, "path" as *u8, pathbuf)
  if with_sha == 1 { p = gt_kv(d, p, "sha" as *u8, sha) }
  p = gt_kn(d, p, "size" as *u8, size)
  let dl: *u8 = sys_mmap(1024)
  var r: i64 = wsp_scat(dl, 0, "https://raw.githubusercontent.com/web-platform-tests/wpt/dead/dom/lists/" as *u8)
  r = wsp_scat(dl, r, name)
  dl[r] = 0 as u8
  p = gt_kv(d, p, "download_url" as *u8, dl)
  p = gt_kv(d, p, "type" as *u8, typ)
  p = gt_ch(d, p, 125)
  p = gt_ch(d, p, 44)
  p = gt_ch(d, p, 10)
  return p
110}
111
112func gt_path(out: *u8, leaf: *u8) -> i64 {
  var p: i64 = wsp_scat(out, 0, GT_DIR)
  p = wsp_scat(out, p, "/" as *u8)
  p = wsp_scat(out, p, leaf)
  out[p] = 0 as u8
  return p
118}
119func gt_exists(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  sys_close(fd)
  return 1
124}
125func gt_zero(rep: *i64) -> i64 { var i: i64 = 0; while i < WA_R_SLOTS { rep[i] = 0; i = i + 1 } return 0 }
126
127func gt_blobsha(data: *u8, n: i64, out: *u8) -> i64 {
  let id: *u8 = sys_mmap(WA_ID_CAP)
  let r: i64 = swhid_cnt(data, n, id)
  if r < 0 { return 0 }
  var i: i64 = 0
  while i < WA_SHA_HEX { out[i] = id[WA_SWHID_PREFIX + i]; i = i + 1 }
  out[WA_SHA_HEX] = 0 as u8
  return 1
135}
136func gt_hexeq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while i < WA_SHA_HEX { if a[i] != b[i] { return 0 } i = i + 1 }
  return 1
140}
141
142func main() -> i64 {
  gv_head("nx_wpt_ingest_gate -- BR21 byte-preserving WPT corpus ingest" as *u8)
  let ctr: *i64 = gv_ctr()
145
  // ---- SETUP. Idempotent by construction: every fixture is unlinked first, so a run reports on
  // itself and never on the leavings of the previous one. Gate scratch lives under /tmp, never
  // beside a production tree.
  sys_mkdir(GT_DIR, MODE_0755)
  let p_ok: *u8 = sys_mmap(WA_PATH_CAP)
  let p_tr: *u8 = sys_mmap(WA_PATH_CAP)
  let p_bad: *u8 = sys_mmap(WA_PATH_CAP)
  let p_mf: *u8 = sys_mmap(WA_PATH_CAP)
  let p_mk: *u8 = sys_mmap(WA_PATH_CAP)
  gt_path(p_ok, "utf16le-bom.html" as *u8)
  gt_path(p_tr, "nul-truncated.html" as *u8)
  gt_path(p_bad, "never-written.html" as *u8)
  gt_path(p_mf, "MANIFEST.tsv" as *u8)
  wa_marker_path(GT_DIR, p_mk)
  sys_unlinkat(p_ok)
  sys_unlinkat(p_tr)
  sys_unlinkat(p_bad)
  sys_unlinkat(p_mf)
  sys_unlinkat(p_mk)
  gv_need("setup-scratch-dir-is-writable" as *u8, gt_exists(GT_DIR), ctr)
  var clean: i64 = 0
  if gt_exists(p_ok) == 0 { clean = 1 }
  gv_need("setup-left-no-fixture-behind" as *u8, clean, ctr)
169
  // ---- THE FIXTURE, AND THE PROOF IT CAN FAIL ------------------------------------------------
  let f: *u8 = sys_mmap(GT_FIX_CAP)
  let n: i64 = gt_utf16le(f)
  let cstr: i64 = wa_strlen(f)
  gv_puts("  fixture: bytes=" as *u8); gv_num(n)
  gv_puts(" b0=" as *u8); gv_num(f[0] as i64)
  gv_puts(" b1=" as *u8); gv_num(f[1] as i64)
  gv_puts(" b3=" as *u8); gv_num(f[3] as i64)
  gv_puts(" c_string_length=" as *u8); gv_num(cstr); gv_puts("\n" as *u8)
  var t_bom: i64 = 0
  if (f[0] as i64) == GT_BOM0 { if (f[1] as i64) == GT_BOM1 { t_bom = 1 } }
  gv_check("fixture-is-utf16le-with-a-bom" as *u8, t_bom, ctr)
  var t_nul: i64 = 0
  if n > GT_FIX_CSTR { if (f[3] as i64) == 0 { t_nul = 1 } }
  gv_check("fixture-carries-an-embedded-nul-at-byte-3-so-the-defect-can-fire" as *u8, t_nul, ctr)
  var t_arith: i64 = 0
  if cstr == GT_FIX_CSTR { if n == GT_FIX_LEN { t_arith = 1 } }
  gv_check("fixture-a-c-string-carrier-sees-3-bytes-where-the-file-has-72" as *u8, t_arith, ctr)
188
  // ---- THE EXTERNAL HASH ANCHOR ---------------------------------------------------------------
  let kat: *u8 = sys_mmap(64)
  gt_blobsha("abc" as *u8, 3, kat)
  gv_puts("  blob sha of abc = " as *u8); gv_puts(kat); gv_puts("\n" as *u8)
  let kat_hit: i64 = gt_hexeq(kat, "f2ba8f84ab5c1bce84a7b441cb1959cfc7093b7f" as *u8)
  let kat_miss: i64 = gt_hexeq(kat, "f2ba8f84ab5c1bce84a7b441cb1959cfc7093b7e" as *u8)
  gv_bite("blob-sha-hits-the-git-2-49-0-vector-for-abc-and-misses-a-one-nibble-neighbour" as *u8, kat_hit, kat_miss, ctr)
196
  // ---- VERIFICATION ---------------------------------------------------------------------------
  let sha: *u8 = sys_mmap(64)
  gt_blobsha(f, n, sha)
  var t_v0: i64 = 0
  if wa_verify_blob(f, n, n, sha) == 0 { t_v0 = 1 }
  gv_check("verify-accepts-a-body-matching-both-declared-numbers" as *u8, t_v0, ctr)
  var t_v1: i64 = 0
  if wa_verify_blob(f, n, n + 1, sha) == 1 { t_v1 = 1 }
  gv_check("neg-control-verify-refuses-a-declared-size-one-too-large" as *u8, t_v1, ctr)
  var t_v2: i64 = 0
  if wa_verify_blob(f, GT_FIX_CSTR, n, sha) == 1 { t_v2 = 1 }
  gv_check("neg-control-verify-refuses-a-nul-truncated-body" as *u8, t_v2, ctr)
209
  // A BYTE SWAP PRESERVES LENGTH, so this is the tooth proving the sha leg is load-bearing rather
  // than decoration beside the size check.
  let g: *u8 = sys_mmap(GT_FIX_CAP)
  var c: i64 = 0
  while c < n { g[c] = f[c]; c = c + 1 }
  let swap: i64 = g[4] as i64
  g[4] = g[6]
  g[6] = swap as u8
  let vg: i64 = wa_verify_blob(g, n, n, sha)
  gv_puts("  byte-swapped copy: same length=" as *u8); gv_num(n)
  gv_puts(" verify_code=" as *u8); gv_num(vg); gv_puts(" (1 size, 2 sha)\n" as *u8)
  var t_swapfix: i64 = 0
  if (g[4] as i64) != (f[4] as i64) { t_swapfix = 1 }
  gv_check("fixture-the-swap-really-changed-a-byte" as *u8, t_swapfix, ctr)
  var t_v3: i64 = 0
  if vg == 2 { t_v3 = 1 }
  gv_check("neg-control-verify-catches-a-byte-swap-on-the-sha-which-the-size-check-cannot-see" as *u8, t_v3, ctr)
227
  // ---- RAW WRITE AND READ-BACK ----------------------------------------------------------------
  var t_w: i64 = 0
  if wa_write_raw(p_ok, f, n) == 0 { t_w = 1 }
  gv_check("write-raw-reports-success-on-the-utf16le-body" as *u8, t_w, ctr)
  var t_rb: i64 = 0
  if wa_readback_eq(p_ok, f, n) == 1 { t_rb = 1 }
  gv_check("readback-is-byte-identical-to-the-utf16le-body" as *u8, t_rb, ctr)
235
  let lp: *i64 = sys_mmap(16) as *i64
  lp[0] = 0
  let back: *u8 = sys_read_file(p_ok, lp)
  var len_ok: i64 = 0
  var bom_ok: i64 = 0
  if (back as i64) != 0 {
      if lp[0] == n { if n == GT_FIX_LEN { len_ok = 1 } }
      if (back[0] as i64) == GT_BOM0 { if (back[1] as i64) == GT_BOM1 { bom_ok = 1 } }
  }
  gv_puts("  read back: bytes=" as *u8); gv_num(lp[0]); gv_puts("\n" as *u8)
  gv_check("readback-length-on-disk-is-72-not-3" as *u8, len_ok, ctr)
  gv_check("readback-preserves-both-bom-bytes" as *u8, bom_ok, ctr)
248
  // THE DEFECT ITSELF, PLANTED: write only up to the first NUL, which is exactly what a text
  // argument carrier does, and prove the read-back compare refuses it.
  var t_plant: i64 = 0
  if wa_write_raw(p_tr, f, cstr) == 0 { if wa_readback_eq(p_tr, f, n) == 0 { t_plant = 1 } }
  gv_check("neg-control-a-nul-truncated-write-is-caught-by-the-readback-compare" as *u8, t_plant, ctr)
254
  // ---- LAND ONE -------------------------------------------------------------------------------
  let rep: *i64 = sys_mmap(WA_R_SLOTS * 8) as *i64
  gt_zero(rep)
  sys_unlinkat(p_ok)
  let nm_ok: *u8 = "utf16le-bom.html" as *u8
  let rc1: i64 = wa_land_one(GT_DIR, nm_ok, wa_strlen(nm_ok), f, n, n, sha, rep)
  var t_l1: i64 = 0
  if rc1 == 0 { if rep[WA_R_LANDED] == 1 { t_l1 = 1 } }
  gv_check("land-one-lands-a-verified-body-and-counts-it" as *u8, t_l1, ctr)
  let rc2: i64 = wa_land_one(GT_DIR, nm_ok, wa_strlen(nm_ok), f, n, n, sha, rep)
  var t_l2: i64 = 0
  if rc2 == 0 { if rep[WA_R_LANDED] == 2 { if wa_readback_eq(p_ok, f, n) == 1 { t_l2 = 1 } } }
  gv_check("land-one-is-idempotent-and-the-second-landing-is-byte-identical" as *u8, t_l2, ctr)
  var t_ag: i64 = 0
  if wa_already_good(GT_DIR, nm_ok, wa_strlen(nm_ok), n, sha) == 1 { t_ag = 1 }
  gv_check("already-good-sees-a-file-satisfying-both-declared-numbers" as *u8, t_ag, ctr)
  var t_ag2: i64 = 0
  if wa_already_good(GT_DIR, nm_ok, wa_strlen(nm_ok), n + 1, sha) == 0 { t_ag2 = 1 }
  gv_check("neg-control-already-good-refuses-when-the-declared-size-differs" as *u8, t_ag2, ctr)
274
  // A BODY THAT FAILS VERIFICATION MUST NEVER REACH THE DISK: a corrupt file is indistinguishable
  // from a good one to every later reader, and the runner would fold it into a corpus_sha.
  gt_zero(rep)
  let nm_bad: *u8 = "never-written.html" as *u8
  let rc3: i64 = wa_land_one(GT_DIR, nm_bad, wa_strlen(nm_bad), f, n, n, kat, rep)
  var t_l3: i64 = 0
  if rc3 == 2 { if rep[WA_R_FAIL_SHA] == 1 { t_l3 = 1 } }
  gv_check("neg-control-land-one-refuses-a-body-whose-blob-sha-differs" as *u8, t_l3, ctr)
  var t_l4: i64 = 0
  if gt_exists(p_bad) == 0 { t_l4 = 1 }
  gv_check("neg-control-a-refused-body-left-no-file-on-disk" as *u8, t_l4, ctr)
286
  gt_zero(rep)
  let nm_esc: *u8 = "../escaped.html" as *u8
  let rc4: i64 = wa_land_one(GT_DIR, nm_esc, wa_strlen(nm_esc), f, n, n, sha, rep)
  var t_l5: i64 = 0
  if rc4 == 5 { if rep[WA_R_REFUSED_NAME] == 1 { t_l5 = 1 } }
  gv_check("neg-control-land-one-refuses-a-parent-traversal-name" as *u8, t_l5, ctr)
293
  // ---- THE SHARED DECIMAL RENDERER ------------------------------------------------------------
  // wa_mf_num is the ONE decimal renderer in the lib -- wa_putn composes it rather than carrying a
  // second copy, and every size written into MANIFEST.tsv goes through it. Zero is the case a
  // hand-rolled renderer gets wrong, so it is the case tested first.
  let nb: *u8 = sys_mmap(GT_NUMBUF)
  var no: i64 = wa_mf_num(nb, 0, 0)
  no = wa_mf_num(nb, no, GT_SIZE_A)
  nb[no] = 0 as u8
  gv_puts("  wa_mf_num zero then GT_SIZE_A = " as *u8); gv_puts(nb)
  gv_puts(" offset=" as *u8); gv_num(no); gv_puts("\n" as *u8)
  var t_d0: i64 = 0
  if no == GT_DIGITS_A { if wa_find(nb, GT_DIGITS_A, 0, "01204" as *u8) == 0 { t_d0 = 1 } }
  gv_check("decimal-renderer-writes-zero-then-1204-and-returns-the-right-offset" as *u8, t_d0, ctr)
  let nb2: *u8 = sys_mmap(GT_NUMBUF)
  let no2: i64 = wa_mf_num(nb2, 0, GT_SIZE_B)
  var t_d1: i64 = 0
  if no2 == GT_DIGITS_B { if wa_find(nb2, GT_DIGITS_B, 0, "1205" as *u8) == 0 { t_d1 = 1 } }
  gv_check("neg-control-decimal-renderer-renders-1205-differently-from-1204" as *u8, t_d1, ctr)
312
  // ---- THE PIN --------------------------------------------------------------------------------
  let pin_good: i64 = wa_is_pin("a7b5671e50ee3610ec3ad2e1278a33b2cb11339c" as *u8)
  let pin_branch: i64 = wa_is_pin("main" as *u8)
  gv_bite("pin-accepts-a-40-hex-commit-and-refuses-a-branch-name" as *u8, pin_good, pin_branch, ctr)
  var t_p2: i64 = 0
  if wa_is_pin("A7B5671E50EE3610EC3AD2E1278A33B2CB11339C" as *u8) == 0 { t_p2 = 1 }
  gv_check("neg-control-pin-refuses-uppercase-hex" as *u8, t_p2, ctr)
  var t_p3: i64 = 0
  if wa_is_pin("a7b5671e50ee3610ec3ad2e1278a33b2cb11339" as *u8) == 0 { t_p3 = 1 }
  gv_check("neg-control-pin-refuses-39-hex" as *u8, t_p3, ctr)
323
  // ---- THE NAME ALLOWLIST ---------------------------------------------------------------------
  let nm_real: *u8 = "namednodemap-supported-property-names.html" as *u8
  var t_n0: i64 = 0
  if wa_is_safe_name(nm_real, wa_strlen(nm_real)) == 1 { t_n0 = 1 }
  gv_check("safe-name-accepts-a-real-wpt-filename" as *u8, t_n0, ctr)
  var t_n1: i64 = 0
  if wa_is_safe_name(nm_esc, wa_strlen(nm_esc)) == 0 { t_n1 = 1 }
  gv_check("neg-control-safe-name-refuses-parent-traversal" as *u8, t_n1, ctr)
  let nm_sl: *u8 = "a/b.html" as *u8
  var t_n2: i64 = 0
  if wa_is_safe_name(nm_sl, wa_strlen(nm_sl)) == 0 { t_n2 = 1 }
  gv_check("neg-control-safe-name-refuses-a-slash" as *u8, t_n2, ctr)
  let nm_dot: *u8 = ".hidden.html" as *u8
  var t_n3: i64 = 0
  if wa_is_safe_name(nm_dot, wa_strlen(nm_dot)) == 0 { t_n3 = 1 }
  gv_check("neg-control-safe-name-refuses-a-leading-dot" as *u8, t_n3, ctr)
340
  // ---- THE MANIFEST PARSER --------------------------------------------------------------------
  // Four records in GitHub's real field order: two .html files, one .md file, one directory whose
  // name ends .html. The declared population is 2 -- the other two are skipped for two DIFFERENT
  // reasons and each reason has its own counter.
  let js: *u8 = sys_mmap(GT_JSON_CAP)
  var jo: i64 = gt_ch(js, 0, 91)
  jo = gt_ch(js, jo, 10)
  jo = gt_rec(js, jo, "DOMTokenList-Iterable.html" as *u8, "4cf84b12a22d15cbc8fb76d174ee0cbb7693b63b" as *u8, 1204, "file" as *u8, 1)
  jo = gt_rec(js, jo, nm_real, "0000000000000000000000000000000000000000" as *u8, 1114, "file" as *u8, 1)
  jo = gt_rec(js, jo, "README.md" as *u8, "59c821a7daa465a852a1e9cba209af40de132d12" as *u8, 67, "file" as *u8, 1)
  jo = gt_rec(js, jo, "subdir.html" as *u8, "1111111111111111111111111111111111111111" as *u8, 0, "dir" as *u8, 1)
  jo = gt_ch(js, jo, 93)
353
  let namebuf: *u8 = sys_mmap(65536)
  let offs: *i64 = sys_mmap(1024) as *i64
  let sizes: *i64 = sys_mmap(1024) as *i64
  let shas: *u8 = sys_mmap(4096)
  gt_zero(rep)
  let cnt: i64 = wa_parse_manifest(js, jo, namebuf, 65536, offs, sizes, shas, 64, rep)
  gv_puts("  parse: entries=" as *u8); gv_num(rep[WA_R_ENTRIES])
  gv_puts(" declared=" as *u8); gv_num(cnt)
  gv_puts(" skipped_nothtml=" as *u8); gv_num(rep[WA_R_SKIPPED_NOTHTML])
  gv_puts(" skipped_notfile=" as *u8); gv_num(rep[WA_R_SKIPPED_NOTFILE]); gv_puts("\n" as *u8)
  var t_m0: i64 = 0
  if rep[WA_R_ENTRIES] == 4 { t_m0 = 1 }
  gv_check("manifest-parse-saw-all-four-entries" as *u8, t_m0, ctr)
  var t_m1: i64 = 0
  if cnt == 2 { if rep[WA_R_DECLARED] == 2 { t_m1 = 1 } }
  gv_check("manifest-parse-declares-2-html-files-of-4-entries" as *u8, t_m1, ctr)
  var t_m2: i64 = 0
  if rep[WA_R_SKIPPED_NOTHTML] == 1 { if rep[WA_R_SKIPPED_NOTFILE] == 1 { t_m2 = 1 } }
  gv_check("manifest-parse-counts-the-two-skip-reasons-separately" as *u8, t_m2, ctr)
  var t_m3: i64 = 0
  if (rep[WA_R_DECLARED] + rep[WA_R_SKIPPED_NOTHTML] + rep[WA_R_SKIPPED_NOTFILE]) == rep[WA_R_ENTRIES] { t_m3 = 1 }
  gv_check("manifest-parse-partition-sums-to-the-entry-count" as *u8, t_m3, ctr)
376
  var t_m4: i64 = 0
  if cnt == 2 {
      let n0: *u8 = ((namebuf as i64) + offs[0]) as *u8
      let n1: *u8 = ((namebuf as i64) + offs[1]) as *u8
      if wa_find(n0, wa_strlen(n0), 0, "DOMTokenList-Iterable.html" as *u8) == 0 {
          if wa_find(n1, wa_strlen(n1), 0, nm_real) == 0 { t_m4 = 1 }
      }
  }
  // the filename in record 2 contains the letters n-a-m-e twice; a key needle without its quotes
  // would split the record there and lose it.
  gv_check("manifest-parse-not-confused-by-a-filename-containing-the-key" as *u8, t_m4, ctr)
  var t_m5: i64 = 0
  if cnt == 2 { if sizes[0] == 1204 { if sizes[1] == 1114 { t_m5 = 1 } } }
  gv_check("manifest-parse-reads-the-declared-sizes" as *u8, t_m5, ctr)
  var t_m6: i64 = 0
  if cnt == 2 { if gt_hexeq(shas, "4cf84b12a22d15cbc8fb76d174ee0cbb7693b63b" as *u8) == 1 { t_m6 = 1 } }
  gv_check("manifest-parse-reads-the-declared-blob-sha" as *u8, t_m6, ctr)
394
  // A record missing one required field REFUSES the whole parse. A silently skipped row would be a
  // smaller population, which reads as better news.
  let js2: *u8 = sys_mmap(GT_JSON_CAP)
  var j2: i64 = gt_ch(js2, 0, 91)
  j2 = gt_rec(js2, j2, "ok.html" as *u8, "4cf84b12a22d15cbc8fb76d174ee0cbb7693b63b" as *u8, 10, "file" as *u8, 1)
  j2 = gt_rec(js2, j2, "nosha.html" as *u8, "unused" as *u8, 10, "file" as *u8, 0)
  j2 = gt_ch(js2, j2, 93)
  gt_zero(rep)
  var t_m7: i64 = 0
  if wa_parse_manifest(js2, j2, namebuf, 65536, offs, sizes, shas, 64, rep) == WA_PARSE_MALFORMED { t_m7 = 1 }
  gv_check("neg-control-a-record-missing-its-sha-refuses-the-whole-parse" as *u8, t_m7, ctr)
  gt_zero(rep)
  var t_m8: i64 = 0
  if wa_parse_manifest(js, jo, namebuf, 65536, offs, sizes, shas, 1, rep) == WA_PARSE_OVERFLOW { t_m8 = 1 }
  gv_check("neg-control-more-records-than-the-table-is-refused-not-capped" as *u8, t_m8, ctr)
  gt_zero(rep)
  var t_m9: i64 = 0
  if wa_parse_manifest(js, jo, namebuf, 8, offs, sizes, shas, 64, rep) == WA_PARSE_NAMEBUF { t_m9 = 1 }
  gv_check("neg-control-exhausted-name-storage-is-refused-not-capped" as *u8, t_m9, ctr)
414
  // ---- THE COMPLETENESS CONJUNCTION -----------------------------------------------------------
  gt_zero(rep)
  var t_c0: i64 = 0
  if wa_coverage_complete(rep) == 0 { t_c0 = 1 }
  gv_check("neg-control-coverage-complete-is-false-on-the-empty-set" as *u8, t_c0, ctr)
  rep[WA_R_DECLARED] = 5
  rep[WA_R_LANDED] = 3
  rep[WA_R_REUSED] = 2
  var t_c1: i64 = 0
  if wa_coverage_complete(rep) == 1 { t_c1 = 1 }
  gv_check("coverage-complete-true-when-every-declared-file-is-present" as *u8, t_c1, ctr)
  var t_c2: i64 = 0
  if wa_report_sums(rep) == 1 { t_c2 = 1 }
  gv_check("partition-sums-when-the-report-is-consistent" as *u8, t_c2, ctr)
  rep[WA_R_REUSED] = 1
  rep[WA_R_FAIL_SHA] = 1
  var t_c3: i64 = 0
  if wa_coverage_complete(rep) == 0 { t_c3 = 1 }
  gv_check("neg-control-coverage-complete-false-when-one-file-failed" as *u8, t_c3, ctr)
  rep[WA_R_FAIL_SHA] = 0
  var t_c4: i64 = 0
  if wa_report_sums(rep) == 0 { t_c4 = 1 }
  gv_check("neg-control-partition-leaks-when-the-report-does-not-reconcile" as *u8, t_c4, ctr)
438
  // ---- MANIFEST EMIT AND THE MARKER -----------------------------------------------------------
  gt_zero(rep)
  let cnt2: i64 = wa_parse_manifest(js, jo, namebuf, 65536, offs, sizes, shas, 64, rep)
  rep[WA_R_LANDED] = cnt2
  rep[WA_R_COVERAGE_COMPLETE] = 1
  wa_manifest_write(GT_DIR, "dom/lists" as *u8, "a7b5671e50ee3610ec3ad2e1278a33b2cb11339c" as *u8,
                    namebuf, offs, sizes, shas, cnt2, rep)
  lp[0] = 0
  let mb: *u8 = sys_read_file(p_mf, lp)
  var has_pin: i64 = 0
  var last_is_verdict: i64 = 0
  var mlen: i64 = 0
  if (mb as i64) != 0 {
      mlen = lp[0]
      if wa_find(mb, mlen, 0, "a7b5671e50ee3610ec3ad2e1278a33b2cb11339c" as *u8) >= 0 { has_pin = 1 }
      // the LAST line, taken by POSITION: step over the trailing newline, then back to the one before
      var e: i64 = mlen - 1
      if e >= 0 { if (mb[e] as i64) == 10 { e = e - 1 } }
      var s2: i64 = e
      var seeking: i64 = 1
      while seeking == 1 {
          if s2 <= 0 { seeking = 0 } else {
              if (mb[s2-1] as i64) == 10 { seeking = 0 } else { s2 = s2 - 1 }
          }
      }
      if wa_find(mb, mlen, s2, "verdict" as *u8) == s2 { last_is_verdict = 1 }
  }
  gv_puts("  manifest: bytes=" as *u8); gv_num(mlen)
  gv_puts(" rows=" as *u8); gv_num(cnt2); gv_puts("\n" as *u8)
  var t_e0: i64 = 0
  if mlen > 0 { t_e0 = 1 }
  gv_check("manifest-emit-produced-a-readable-file" as *u8, t_e0, ctr)
  gv_check("manifest-emit-carries-the-commit-pin" as *u8, has_pin, ctr)
  gv_check("manifest-emit-last-line-is-the-canonical-verdict" as *u8, last_is_verdict, ctr)
473
  wa_marker_set(GT_DIR, 0, 5, 3)
  let mk_written: i64 = gt_exists(p_mk)
  wa_marker_set(GT_DIR, 1, 5, 5)
  var mk_still: i64 = gt_exists(p_mk)
  gv_bite("marker-is-written-when-incomplete-and-removed-when-complete" as *u8, mk_written, mk_still, ctr)
479
  // ---- TEARDOWN (the next run must measure itself, not this one) ------------------------------
  sys_unlinkat(p_ok)
  sys_unlinkat(p_tr)
  sys_unlinkat(p_bad)
  sys_unlinkat(p_mf)
  sys_unlinkat(p_mk)
486
  return gv_verdict("nx_wpt_ingest_gate" as *u8, ctr,
      "offline proof of the ingest core: manifest parse, dual verification against the declared size and the declared git blob sha, raw write, read-back compare, pin rule, name allowlist, completeness conjunction, manifest and marker emit. The transport is nx_https_fetch_follow's subject and is NOT proven here." as *u8)
489}
nx_wpt_ingest_gate.nx source

`nx_wpt_ingest_gate.nx` source
