nx_ws_hygiene_gate.nx source
↩ module page · 119 lines · 6306 B
1// nx_ws_hygiene_gate.nx -- liar-killed GATE for the workstream-hygiene classifier (R-ORCH).
2// Proves it flags the exact anti-patterns the operator called out AND does NOT false-flag the
3// sanctioned sovereign path: the live example line (`wsl -e sh -c './_offc/nx_swcompare_research.elf
4// ... > /tmp/... 2>&1'`) is a VIOLATION; the sanctioned build launcher (nx_sov_build_run via wsl
5// --cd /mnt/c) is GREEN (the rule-27 exception -- the load-bearing negative control that keeps the
6// gate from banning the one allowed shell use); mcp/api lines are GREEN; TSV/plumbing/tmp caught.
7// Exit 0 only on all-PASS.
8// license_tier: ORIGINAL expect_exit: 0
9import "nx_syscalls.nx"
10import "nx_ws_hygiene_core.nx"
11
12func h_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
13
14func h_putn(v: i64) -> i64 {
15 let b: *u8 = sys_mmap(32)
16 let e: i64 = ccz_cat_num(b, 0, v)
17 sys_write(1, b, e)
18 return 0
19}
20
21func h_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
22
23// classify a NUL-terminated line and check the verdict id + whether it should be a violation.
24func h_check(desc: *u8, line: *u8, want: i64, passp: *i64) -> i64 {
25 let got: i64 = hv_classify(line, h_slen(line))
26 h_puts("T " as *u8)
27 h_puts(desc)
28 h_puts(" -> " as *u8)
29 h_puts(hv_name(got))
30 if got == want { h_puts(" PASS\n" as *u8); passp[0] = passp[0] + 1 } else { h_puts(" FAIL(want " as *u8); h_puts(hv_name(want)); h_puts(")\n" as *u8) }
31 return 0
32}
33
34// classify a tool NAME on the token-budget axis and check the verdict.
35func h_check_tool(desc: *u8, name: *u8, want: i64, passp: *i64) -> i64 {
36 let got: i64 = hv_tool_verdict(name, h_slen(name))
37 h_puts("T " as *u8)
38 h_puts(desc)
39 h_puts(" -> " as *u8)
40 h_puts(hv_name(got))
41 if got == want { h_puts(" PASS\n" as *u8); passp[0] = passp[0] + 1 } else { h_puts(" FAIL(want " as *u8); h_puts(hv_name(want)); h_puts(")\n" as *u8) }
42 return 0
43}
44
45func main(argc: i64, argv: *i64) -> i64 {
46 let pass: *i64 = sys_mmap(16) as *i64
47 pass[0] = 0
48
49 // THE live example the operator pasted -> SHELL-EXEC-ORGAN violation
50 h_check("live-swcompare-shchain" as *u8,
51 "wsl -d Ubuntu --cd /mnt/c/Users/elder/nishi-core/nxc2 -e sh -c './_offc/nx_swcompare_research.elf knowledge/compare/swarm.q > /tmp/sw_research.out 2>&1'" as *u8,
52 HV_SHELL_EXEC, pass)
53
54 // load-bearing NEG-CONTROL: the sanctioned build launcher (rule-27 exception) -> GREEN, NOT flagged
55 h_check("sanctioned-build-lane" as *u8,
56 "wsl -d Ubuntu --cd /mnt/c/Users/elder/nishi-core/nxc2 -e ./_offc/nx_sov_build_run.elf nx_ws_hygiene_gate" as *u8,
57 HV_SOV_BUILD, pass)
58
59 // nx_ship / nx_content_ship also sanctioned
60 h_check("sanctioned-ship" as *u8,
61 "_offc/nx_ship.elf nx_tool_argecho /tmp/tok /tmp/shipsrc" as *u8,
62 HV_SOV_BUILD, pass)
63
64 // sovereign API/MCP paths -> GREEN (an mcp/api build call is SOV-API, distinct from the shell
65 // build-lane launcher above -- both GREEN, neither a violation)
66 h_check("mcp-tool" as *u8, "mcp__nishi__nx_mgmt POST /api/build target=x" as *u8, HV_SOV_API, pass)
67 h_check("api-route" as *u8, "POST /api/route host=nishifamily.com prefix=/media" as *u8, HV_SOV_API, pass)
68
69 // bare sh -c glue (no organ) -> SHELL-CHAIN
70 h_check("bare-shchain" as *u8, "sh -c 'echo hi && cat foo'" as *u8, HV_SHELL_CHAIN, pass)
71
72 // TSV write -> TSV-FORMAT
73 h_check("tsv-write" as *u8, "write knowledge/compare/swarm_results.tsv" as *u8, HV_TSV, pass)
74
75 // raw plumbing -> PLUMBING
76 h_check("scp-plumbing" as *u8, "scp build.elf elderwesto@192.168.8.227:/tmp/" as *u8, HV_PLUMBING, pass)
77 h_check("curl-plumbing" as *u8, "curl -s https://nishifamily.com/api/health" as *u8, HV_PLUMBING, pass)
78
79 // tmp redirect on a plain command -> TMP-REDIRECT
80 h_check("tmp-redirect" as *u8, "cat foo > /tmp/scratch.out" as *u8, HV_TMP_REDIRECT, pass)
81
82 // bare /mnt/c outside build lane -> WSL-PATH
83 h_check("bare-wsl-path" as *u8, "read /mnt/c/Users/elder/data/x" as *u8, HV_WSL_PATH, pass)
84
85 // NEUTRAL: an ordinary sovereign edit/read (no shell, no tsv) -> not flagged, not GREEN-marked
86 h_check("neutral-edit" as *u8, "Edit runtime/nx_foo.nx add function" as *u8, HV_NONE, pass)
87
88 // git-the-VCS is the operator's ACCEPTED "git or beyond" -> ACCEPTED-VCS, NOT a violation (round-3
89 // self-correction: my enforcer had over-flagged the accepted tool at rm-severity)
90 h_check("git-commit-ACCEPTED" as *u8, "cd nishi-core && git add x && git commit -m msg" as *u8, HV_ACCEPTED_VCS, pass)
91 // the ACTUAL sin (rm plumbing / lock-reaping) STILL trips
92 h_check("lock-reap-rm-SHELL-UTIL" as *u8, "rm -f .git/index.lock" as *u8, HV_SHELL_UTIL, pass)
93 // and a MIXED pipeline still trips (rm checked before git, so the sin can't hide behind a commit)
94 h_check("pipeline-rm-plus-git-trips" as *u8, "cd r && rm -f .git/index.lock && git commit -m x" as *u8, HV_SHELL_UTIL, pass)
95
96 // token-burn tool axis (hv_tool_verdict on a tool NAME) -> flag the expensive one-offs, GREEN the MCP
97 h_check_tool("webfetch-tool" as *u8, "WebFetch" as *u8, HV_TOKEN_BURN, pass)
98 h_check_tool("workflow-tool" as *u8, "Workflow" as *u8, HV_TOKEN_BURN, pass)
99 h_check_tool("agent-tool" as *u8, "Agent" as *u8, HV_TOKEN_BURN, pass)
100 h_check_tool("nishi-mcp-tool-GREEN" as *u8, "mcp__nishi__nishi_search" as *u8, HV_SOV_API, pass)
101
102 // is_violation predicate: SHELL-EXEC + SHELL-UTIL + TOKEN-BURN are violations, SOV-BUILD is not
103 var okpred: i64 = 1
104 if hv_is_violation(HV_SHELL_EXEC) != 1 { okpred = 0 }
105 if hv_is_violation(HV_SHELL_UTIL) != 1 { okpred = 0 }
106 if hv_is_violation(HV_TOKEN_BURN) != 1 { okpred = 0 }
107 if hv_is_violation(HV_SOV_BUILD) != 0 { okpred = 0 }
108 if hv_is_violation(HV_ACCEPTED_VCS) != 0 { okpred = 0 }
109 if hv_is_violation(HV_NONE) != 0 { okpred = 0 }
110 h_puts("T is-violation-predicate got=" as *u8); h_putn(okpred)
111 if okpred == 1 { h_puts(" PASS\n" as *u8); pass[0] = pass[0] + 1 } else { h_puts(" FAIL\n" as *u8) }
112
113 h_puts("WSHYG-GATE pass=" as *u8)
114 h_putn(pass[0])
115 h_puts("/20 verdict=" as *u8)
116 if pass[0] == 20 { h_puts("GREEN\n" as *u8); return 0 }
117 h_puts("RED\n" as *u8)
118 return 1
119}