nx_evict.nx

buildroot/runtime/_hdl_build/nx_evict.nx

8449 B164 linesdepth 2pulls 2 transitivereach 0 importersview sourcekind tool

docs dependencies structs consts functions

about

nx_evict.nx -- THE SOVEREIGN JANITOR MOVER (debt seq221 second half; retires the "sanctioned janitor ssh mv" residual class). REVERSIBLE eviction: atomic sys_renameat of a nishihost-relative file into retired/ with the path FLATTENED (each '/' -> '__'), bytes preserved (additive-only law rule 13 -- nothing is ever deleted, history is sacred). restore = the exact inverse, refusing to clobber an existing destination (fail-safe). DENY BY CONSTRUCTION (not config): absolute paths, '..' traversal, secret material (secret/key/ token/passw/.pem/opaque needles), live binaries (.elf -- promote/rollback owns those), the retired/ namespace itself, and the protected registries (tool_allowlist.conf, daemons.reg, clock_jobs.tsv, proxy_routes.conf, sites.conf). Over-deny is the safe failure mode; needles are lowercase-literal (declared envelope). nx_evict evict <relpath> -> retired/<flattened> (atomic, reversible) nx_evict restore <name> <destpath> -> retired/<name> -> <destpath> (refuses if dest exists) nx_evict selftest -> probe evict/restore round-trip + refusal teeth, exit 0/5 license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0

dependencies 1 imports · 0 importers

imports: nx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

17	const EV_STDERR: i64 = 2
18	const EV_PATHCAP: i64 = 512
19	const EV_SLASH: i64 = 47
20	const EV_UND: i64 = 95
21	const EV_MODE: i64 = 0x1a4
22	const EV_EXIT_USAGE: i64 = 2
23	const EV_EXIT_REFUSED: i64 = 3
24	const EV_EXIT_IO: i64 = 4
25	const EV_EXIT_SELF: i64 = 5
26	const EV_V_E: i64 = 101
27	const EV_V_R: i64 = 114
28	const EV_V_S: i64 = 115
29	const EV_ARGC_EVICT: i64 = 3
30	const EV_ARGC_RESTORE: i64 = 4

functions

32	func ev_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 2: ev_werr ev_has
33	func ev_werr(s: *u8) -> i64 { sys_write(EV_STDERR, s, ev_slen(s)); return 0 } called by 1: main calls 2: sys_write ev_slen
34	func ev_cat(d: u8, off: i64, s: u8) -> i64 called by 2: ev_flat main
40	func ev_eq(a: u8, b: u8) -> i64 called by 1: ev_deny
46	func ev_has(s: u8, sub: u8) -> i64 called by 2: ev_deny main calls 1: ev_slen
61	func ev_deny(p: *u8) -> i64 called by 1: main calls 2: ev_has ev_eq
80	func ev_flat(src: u8, dst: u8) -> i64 called by 1: main calls 1: ev_cat
92	func ev_exists(p: *u8) -> i64 called by 1: main calls 2: sys_openat_rd sys_close
99	func main(argc: i64, argv: *i64) -> i64 calls 12: ev_werr sys_exit ev_deny sys_openat_wr sys_write sys_close+6