code wiki / _hdl_build / nx_aw_hostctl.nx
nx_aw_hostctl.nx
buildroot/runtime/_hdl_build/nx_aw_hostctl.nx
about
nx_aw_hostctl.nx -- SOVEREIGN deploy/supervision TRIGGER for the NAS control plane. Retires the
nascmd.txt + nx_aw_nasfix "run arbitrary shell" escape hatch for the deploy path (operator: "no .txt and
other bullshit... nishi ecosystem all the way up from the hardware rung, each rung"). It gets the NAS
password from the sovereign vault (composes _offc/nx_machine_key.elf + _offc/nx_vault.elf, exactly as
nx_aw_nasfix/nx_secret_cli do), opens the team's OWN sovereign SSH (nx_ssh_lib), and runs EXACTLY ONE
thing remotely: the sovereign control-plane binary nx_hostctl with an ALLOWLISTED subcommand. The remote
payload is an absolute binary path + one validated arg -- NO command file, NO cd/&&, NO tar/kill/setsid/
fuser/dev-tcp coreutils. All real lifecycle work (atomic binary swap, kill, respawn, health) is done by
nx_hostctl's own syscalls. This is the "named sovereign op-organ" the sovereignty memo specified.
nx_aw_hostctl selfswap -> run nx_hostctl.new selfswap : install+adopt the NEW supervisor (wiki-aware)
nx_aw_hostctl deploy -> run nx_hostctl deploy : atomic-swap sites.elf + respawn (/wiki route)
nx_aw_hostctl wikideploy -> run nx_hostctl wikideploy : atomic-swap the wiki gateway + respawn
nx_aw_hostctl galxdeploy -> run nx_hostctl galxdeploy : atomic-swap the gallery gateway + respawn
nx_aw_hostctl reconcile -> run nx_hostctl reconcile : one-supervisor reconcile (adopt sites.elf)
license_tier: ORIGINAL (vault+SSH spine reused from nx_aw_nasfix; the shell escape hatch removed)
dependencies 4 imports · 0 importers
imports: nx_syscalls.nxnx_ssh_lib.nxnx_arbiter.nxnx_receipt.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 20 | const AH_MAGIC_8095: i64 = 8095 |
| 21 | const AH_MAGIC_18190: i64 = 18190 |
| 22 | const AH_MAGIC_18794: i64 = 18794 |
| 23 | const AH_MAGIC_18795: i64 = 18795 |
| 24 | const AH_MAGIC_18099: i64 = 18099 |
| 25 | const AH_MAGIC_9099: i64 = 9099 |
| 26 | const AH_MAGIC_9091: i64 = 9091 |
| 27 | const AH_MAGIC_9444: i64 = 9444 |
| 28 | const AH_MAGIC_8453: i64 = 8453 |
| 29 | const AH_MAGIC_8444: i64 = 8444 |
| 30 | const AH_MAGIC_8791: i64 = 8791 |
| 31 | const AH_MAGIC_8097: i64 = 8097 |
| 32 | const AH_MAGIC_18797: i64 = 18797 |
| 33 | const AH_MAGIC_18793: i64 = 18793 |
| 34 | const AH_MAGIC_6881: i64 = 6881 |
| 35 | const AH_MAGIC_18090: i64 = 18090 |
| 36 | const AH_MAGIC_18796: i64 = 18796 |
| 37 | const AH_MAGIC_18456: i64 = 18456 |
| 38 | const AH_MAGIC_65536: i64 = 65536 |
| 39 | const AH_MAGIC_1048576: i64 = 1048576 |
| 40 | const AH_MAGIC_16384: i64 = 16384 |
| 41 | const AH_MAGIC_1024: i64 = 1024 |
| 42 | const AH_MAGIC_1800: i64 = 1800 |
| 44 | const AH_SECRET_OUT: *u8 = "/tmp/nxsecret.out" as *u8 |
| 45 | const AH_VAULT_NV: *u8 = "/home/elderwesto/.nishi/secrets/nas.nv" as *u8 |
| 46 | const AH_HOSTCTL: *u8 = "/volume1/homes/elderwesto/nishihost/nx_hostctl" as *u8 |
| 47 | const AH_HOSTCTL_NEW: *u8 = "/volume1/homes/elderwesto/nishihost/nx_hostctl.new" as *u8 |
functions
| 49 | func ah_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 1: main |
| 50 | func ah_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8) { if a[i]!=b[i] { return 0 } i=i+1 } if b[i]!=(0 as u8) { return 0 } return 1 } |
| 53 | func ah_run(path: *u8, a1: *u8, a2: *u8) -> i64 |
| 71 | func ah_unlink(path: *u8) -> i64 { __syscall(263, AT_FDCWD, path, 0, 0, 0, 0) return 0 } called by 1: main |
| 76 | func ah_allowed(sub: *u8) -> i64 |
| 151 | func ah_drain(st: *SshState) -> i64 |
| 164 | func ah_sudo_put(st: *SshState, wcmd: *u8, wcmdlen: i64, data: *u8, datalen: i64, quiet_max: i64) -> i64 |
| 206 | func main(argc: i64, argv: *i64) -> i64 |