nx_wiki_publish.nx

nx_wiki_publish.nx -- A3: the ONE-CALL GUARDED PUBLISH WRAPPER (the enforcement point). EVERY page that goes live MUST flow through pub_publish(); nothing reaches the served wiki doc-root unless the A2 guard (nx_wiki_publish_guard pg_decide) returns PG_ALLOW. This is the wiki's publish PEP wrapped around the A2 PDP: same fail-closed / deny-by-default discipline as nx_access_pep around nx_access_wall. FLOW (composition, not reimplementation): 1. read the page bytes from local_html_path. 2. verdict = pg_decide(WAR_PREFIX, bytes, n, corpus...) -- the SOLE integrity authority (REUSED). 3. REJECT -> return {status=PUB_REJECTED, code=<the exact PG_REJECT_* reason>, push_invoked=0}. The push path is NEVER reached (fail-closed). This is THE safety property A3 exists to guarantee: a guard-rejected page can never be streamed to the live site. 4. ALLOW -> if do_push_flag == 0: return {status=PUB_ALLOW_NOPUSH, code=PG_ALLOW, push_invoked=0} (the guard verdict is reported, but nothing is pushed -- lets the gate prove the ALLOW path is reached WITHOUT touching the network). -> if do_push_flag == 1: write the awpush.src/awpush.dst staging files for /wiki/<slug>.html at the SERVED doc-root, then invoke the PROVEN push (nx_aw_push) as a separate run, and return {status=PUB_PUBLISHED, bytes=n, push_invoked=1}. HOW THE PUSH IS INVOKED: nx_aw_push's streaming logic lives in its main() (it reads awpush.src/awpush.dst, opens the vault, SSHes, streams) -- it is NOT an importable function. So A3 REUSES it the SAME way the rest of the stack does: write the two staging files, then fork+execve _offc/nx_aw_push.elf and wait. We do not re-implement vault auth or SSH (no rolled crypto, no copy-paste of the push spine). ADDITIVE-ONLY: the dst command is `mkdir -p <wikidir>; cat > <wikidir>/<slug>.html` -- it writes exactly ONE page and never touches any other file in the doc-root. corpus = parallel arrays (cs_ptr[i] = slug ptr, cs_len[i] = slug len, ncorpus) -- the SAME array idiom pg_decide / nx_access_wall_gate use (NishiLang caps a call's arg count, so a set is passed as arrays). Pure NishiLang, NO sql/.sh/.py/.js, no new .tsv/.conf. license_tier: ORIGINAL