nx_http_probe_lib.nx

nx_http_probe_lib.nx -- THE BOUNDED LOOPBACK HTTP LIVENESS PROBE + DEAD-MAN HEARTBEAT STAMPER. WHY THIS EXISTS (2026-08-20). The estate's only compensating control over a FAIL-OPEN authentication path was a curl one-liner in cron.reg: curl -s --max-time 8 http://127.0.0.1:18096/api/cap/status | grep -q '"secure":true' \ && date +ts=%s > knowledge/status/capplane.log The cron row FIRED and the command FAILED, and because the row DISCARDS ALL OUTPUT its own failure was unobservable: 7 of 8 conjuncts were proven true and the 8th ("does curl run") was structurally unmeasurable. The cap-plane watch went stale at 10.9x its budget and nobody could say which link broke. **** A PROBE THAT FAILS SILENTLY IS NOT A CONTROL, IT IS A DECORATION. **** So the single disqualifying property for the replacement is a silent failure mode. EVERY exit path here carries a NAMED reason, printed on stdout AND stderr, and the verdict line is LAST so a positional reader (gv_last_line, nx_gate_green) can anchor on it without matching text anywhere else. WHY A LIB AND NOT ONE FILE: the CLI (nx_http_probe.nx) and the gate (nx_http_probe_gate.nx) both need the same logic, and a gate that re-implements its subject proves nothing. One ruler, two callers. LOOPBACK-ONLY BY CONSTRUCTION -- THIS IS A SAFETY PROPERTY, NOT A LIMITATION. The destination address is hard-pinned to 127.0.0.1 and cannot be passed in. cron.reg's own cap-plane comment records why: during the 2026-08-06 outage the PUBLIC url returned insecure_placeholder/secure=false while loopback :18096 returned provisioned/secure=true, because the public :443 answer came from a DIFFERENT BINARY (DSM nginx co-squat, D008) -- and that sent the diagnosis down a false path for an hour. **** A HEALTH ENDPOINT ANSWERS FOR THE PROCESS THAT SERVED IT, NEVER FOR THE SERVICE. **** A sibling seat had to re-derive that this session after taking the convenient answer. Pinning the address makes the mistake unrepresentable rather than merely documented. COMPOSED, NOT RE-IMPLEMENTED. Three proven primitives do the work: nx_connect_bounded (nx_connect.nx) -- SO_RCVTIMEO does NOT bound connect(); this does nx_http_client_build_request(nx_http_client.nx) -- the ONE request-format definition in the estate sys_set_socket_timeout (nx_syscalls.nx) -- SO_RCVTIMEO/SO_SNDTIMEO The only new code is a DEADLINE-AWARE drain. nx_http_client_get's own _drain has no read bound, so a daemon that accepts and then wedges -- WHICH IS EXACTLY THE 2026-08-06 INCIDENT -- parks the probe forever. On a */5 beat that piles up processes, which is a resource bug even when the feature works. nx_http_client_get is otherwise the right organ and is deliberately left byte-untouched: editing a lib with ~100 consumers to add one caller's timeout is a fleet-wide blast radius for a local need. THE BUDGET IS AN ARGUMENT, NOT A CONSTANT. Rule 11: no magic numbers. The caller states the budget and states its derivation at the call site (cron.reg). Worst-case wall time is ~2x budget: the connect leg and the receive leg each get the full budget, deliberately, so that "slow to connect" and "slow to answer" are separately diagnosable instead of sharing one squeezed allowance. Pick budget <= beat/2.