nx_pulse_worker.nx

nx_pulse_worker.nx -- LANE WORKER: NAS-owned schedule -> laptop execution (operator 2026-07-16: the autograde pulse "is supposed to be nishi ecosystem native using the nas" -- the Windows scheduled task built earlier the same day was REJECTED and deleted; this organ replaces it). DESIGN (every piece an ecosystem piece; zero Windows constructs; zero inbound ports): * THE NAS OWNS THE SCHEDULE AS DATA: https://nishifamily.com/evidence/autograde/pulse_policy.txt (edited any time via /api/upload + /api/promote_content). Keys: enabled=0|1, mode=interval|daily, interval_min=N, daily_utc_hour=H. * THIS worker polls that policy OUTBOUND over sovereign TLS (forks _offc/nx_mgmt_client.elf GET -- the proven WSL->edge lane) and fires only when the NAS policy says due. The laptop is the executor because the grader organs + ledgers live on this box's build lane; the schedule truth is the NAS's. * A FIRE = fork the proven payload bench/autograde_pulse.sh (autograde gate -> dashboard ship -> the script appends its own PULSE start/done rows). Worker appends a PWRK audit row per fire. * FAIL-CLOSED: policy unreachable / status!=200 / enabled!=1 / unparsable => NO fire. * RATE-LIMITED BY CONSTRUCTION: never fires within 1800s of the last PULSE start, whatever the policy says -- a crashed ship or an operator typo (interval_min=0) cannot rapid-fire the loop. * UPGRADE PATH: when the swarm worker-agent lane lands, this worker pulls hub-queued jobs instead of a polled policy file -- same shape, richer plumbing (job kinds, permissions, QUEUE-when-busy). usage: nx_pulse_worker [poll_seconds] [oneshot] -- poll default 120; any 3rd arg = one cycle then exit. MUST be launched from the nxc2 checkout root (relative _offc/ + bench/ paths). HANG-PROOF (debt eaten 2026-07-16): both child forks ride nx_guarded_run (WNOHANG poll + wall-clock deadline + SIGKILL + reap, gate-proven) -- a wedged TLS fetch or stuck payload can no longer freeze the daemon; it is killed at the deadline and the cycle fails CLOSED (no fire on unknown policy). Child stdout rides a pipe drained AFTER exit -- safe because both outputs are far below the 64KB pipe buffer (policy ~1KB, pulse log ~4KB); a runaway writer blocks and the deadline reaps it. expect_exit: 0 license_tier: ORIGINAL