code wiki / _hdl_build / nx_deploy_ready.nx

nx_deploy_ready.nx

buildroot/runtime/_hdl_build/nx_deploy_ready.nx

15934 B270 linesdepth 2pulls 2 transitivereach 0 importersview sourcekind tooltopic deploy
docsdependenciesstructsconstsfunctions

about

nx_deploy_ready.nx -- PRE-DEPLOY SAFETY GATE (operator: "prevent things like this... deploy... managed"). The capstone of the deploy-reliability trilogy: an agent/session calls this BEFORE deploying an organ to learn if it is SAFE. Aggregates the supervised signals into ONE actionable verdict instead of 3 separate checks -- proactive prevention (won't deploy into a drifted buildroot or after a contract regression). Data-driven (rule 11): knowledge/registry/deploy_checks.tsv rows = name<TAB>file<TAB>marker<TAB>severity<TAB>remediation. A check PASSES if <file> contains <marker>. severity BLOCK -> a fail makes deploy UNSAFE; WARN -> advisory. nx_deploy_ready check [manifest] [target] (JSON: deploy_safe + per-check pass/severity + blockers + remediations) LOOSE COUPLING (operator 2026-09-02: "a supervisor deploy has no business being blocked by a search domain's RED ... estate wide loose coupling small sharp intelligent pieces"). The evidence-honesty row used to be a GLOBAL conjunction: any RED compare domain blocked EVERY deploy, so two content domains blocked a fleet- supervisor memory-leak fix and the gate got overridden -- a gate that blocks too broadly is disabled in practice and protects nothing. Now, when the caller names the deploy TARGET (a deploy_targets.conf row name), that ONE row is SCOPED to the target's blast radius: it blocks iff the target's OWN domain, or a SHARED-FATE domain (the deploy machinery itself), is named on the RED_DOMAINS= line nx_sota_status emits. Every other row is unchanged. With no target, or an unmapped target, or an evidence log that carries no RED_DOMAINS= line (an older producer), the row keeps its GLOBAL marker check -- the fallback fails in the direction of REFUSING, never of acquitting, and the JSON names which scope applied so the audit is visible. Data-driven (rule 11): knowledge/registry/deploy_domain.conf rows = <target> <domain>; knowledge/registry/deploy_sharedfate.conf rows = one shared-fate domain per line. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0

dependencies 1 imports · 0 importers

nx_syscalls.nx nx_deploy_ready.nx

imports: nx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main dr_contains dr_vlen dr_werr sys_write sys_exit sys_mmap nxa_die sys_write ↻ sys_exit ↻ nxa_lock_take nxa_lock_addr sys_write ↻ nxa_lock_give nxa_lock_addr ↻ nxa_report_overrun sys_write ↻ nxa_dump_printable sys_write ↻ nxa_dump_sizes sys_write ↻ dr_read sys_openat_rd sys_read sys_close dr_lookup_domain dr_le dr_cat dr_le ↻ dr_col dr_cstr dr_span_is dr_red_names dr_contains ↻ sys_mmap ↻ dr_sharedfate_red sys_mmap ↻ dr_le ↻ dr_red_names ↻ dr_cat_esc

structs

none

consts

24const DR_CAP: i64 = 262144
25const DR_TAB: i64 = 9
26const DR_NL: i64 = 10
27const DR_HASH: i64 = 35
28const DR_SPACE: i64 = 32
29const DR_STDERR: i64 = 2
30const DR_SPAN: i64 = 16
31const DR_EXIT_USAGE: i64 = 2
32const DR_NAMECAP: i64 = 256
33const DR_DOMAIN_CONF: *u8 = "knowledge/registry/deploy_domain.conf"
34const DR_SHAREDFATE_CONF: *u8 = "knowledge/registry/deploy_sharedfate.conf"
35const DR_RED_KEY: *u8 = "RED_DOMAINS="
36const DR_SCOPED_ROW: *u8 = "evidence-honesty"

functions

38func dr_werr(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(DR_STDERR, s, n); return 0 }
called by 1: main calls 1: sys_write
39func dr_vlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 1: main
40func dr_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o] = s[i]; o = o + 1; i = i + 1 } return o }
called by 1: main
41func dr_catn(d: *u8, o: i64, v: i64) -> i64 { let t: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { d[o] = 45 as u8; o = o + 1; m = 0 - m } var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } var i: i64 = 0; while i < k { d[o] = t[k-1-i]; o = o + 1; i = i + 1 } return o }
called by 1: main calls 1: sys_mmap
42func dr_cat_esc(d: *u8, o: i64, q: *u8, s: i64, e: i64) -> i64 { var i: i64 = s; while i < e { var c: i64 = q[i] as i64; if c == 34 { c = 39 } if c == 92 { c = 47 } if c < 32 { c = 32 } d[o] = c as u8; o = o + 1; i = i + 1 } return o }
called by 1: main
43func dr_read(path: *u8, buf: *u8, cap: i64) -> i64
called by 1: main calls 3: sys_openat_rdsys_readsys_close
52func dr_contains(buf: *u8, n: i64, lit: *u8) -> i64
called by 2: dr_red_namesmain
66func dr_le(q: *u8, i: i64, n: i64) -> i64 { var e: i64 = i; var s: i64 = 1; while s == 1 { if e >= n { s = 0 } else { if q[e] == (DR_NL as u8) { s = 0 } else { e = e + 1 } } } return e }
called by 3: dr_lookup_domaindr_sharedfate_redmain
67func dr_col(q: *u8, ls: i64, le: i64, c: i64, out: *i64) -> i64
called by 1: main
83func dr_cstr(q: *u8, s: i64, e: i64, dst: *u8) -> i64 { var i: i64 = 0; while s + i < e { dst[i] = q[s+i]; i = i + 1 } dst[i] = 0 as u8; return i }
called by 1: main
84func dr_span_is(q: *u8, s: i64, e: i64, lit: *u8) -> i64 { var i: i64 = 0; while s + i < e { if lit[i] == (0 as u8) { return 0 } if q[s+i] != lit[i] { return 0 } i = i + 1 } if lit[i] != (0 as u8) { return 0 } return 1 }
called by 1: main
91func dr_red_names(buf: *u8, n: i64, domain: *u8, out: *i64) -> i64
called by 2: dr_sharedfate_redmain calls 2: dr_containssys_mmap
106func dr_lookup_domain(conf: *u8, n: i64, target: *u8, dst: *u8) -> i64
called by 1: main calls 1: dr_le
132func dr_sharedfate_red(sf: *u8, sfn: i64, ev: *u8, evn: i64) -> i64
called by 1: main calls 3: sys_mmapdr_ledr_red_names
150func main(argc: i64, argv: *i64) -> i64
calls 17: dr_containsdr_vlendr_werrsys_exitsys_mmapdr_read+11