nx_nishipages_serve.nx

nx_nishipages_serve.nx -- sovereign self-contained static server for nishi-pages. Built per operator directive 2026-06-30: "build the apis that will do what you are trying to do in shell" + "sovereign live server first". WHY SELF-CONTAINED (not composing nx_pages_static / nx_http_server): those modules pull nx_syscalls.nx, which needs nx_syscalls_x86_64.nx for __syscall/sys_mmap -- but the two modules BOTH define 26 of the same sys_* symbols, so any organ pulling both double-emits every sys_* label and `as` rejects the duplicate (this is exactly why the "shipped" nx_audit_server_* organs do not assemble on the current toolchain). nx_syscalls.nx has 6098 importers, so it cannot be edited. We therefore import ONLY the leaf x86_64 syscall layer (every socket + file syscall, zero further imports) plus the pure, import-free CWE-22 canonicalizer. Result: no symbol overlap, clean link, fully sovereign. Serves the whole dist/ tree with clean URLs: "/" -> dist/index.html "/foo/" -> dist/foo/index.html "/foo" -> dist/foo (file) else dist/foo/index.html else dist/foo.html "/a/b.ext" -> dist/a/b.ext (literal; MIME by extension, incl. .wasm) Path traversal (../, NUL, backslash, leading /) is rejected by nx_path_canonicalize before any file is opened -- defense at the boundary. Build (x86_64 native Linux ELF): cd nishi-core/nxc2 ./nxc2.exe --target x86_64 runtime/nx_nishipages_serve.nx > /tmp/nps.s wsl bash -c "gcc -no-pie /tmp/nps.s -o /tmp/nx_nishipages_serve" Run from the nishi-pages checkout so the relative "dist" root resolves: cd nishi-pages && /tmp/nx_nishipages_serve # listens on :8090 nx_capability_claims: needs: [x86_64_syscalls, cwe_22_canonicalize] provides: [nishipages_static_serve, clean_url_routing, full_dist_tree_serve, wasm_mime] safety: [cwe_22_canonicalize_at_boundary, get_only, bounded_request_buffer, no_floating_point, jpl_rule2_bounded_accept_loop]