nx_conductor_pulse.nx source

1// nx_conductor_pulse.nx -- GOVERNED pulse/daemon admission through the Nishi CONDUCTOR (operator: "pulses and 2// daemons and all that go through the nishi conductor not just us doing whatever like we were with publishing 3// till nishi publisher"). Mirrors the PUBLISHER's governance (submit -> approve -> run_governed) but for 4// RECURRING / LONG-RUNNING work: a pulse or daemon may NOT be spawned ad-hoc -- it must be ADMITTED by the 5// conductor, and only an admitted one may FIRE. The admission bar (ALL required): 6// (1) OWNED -- an Accountable role owns it (RACI; the conductor routes work to owners, nx_harmony_conduct) 7// (2) GATE-GREEN -- the organ it runs passes its gate (#7 test-before-ship: never pulse a broken organ) 8// (3) NEVER-BRICK -- a daemon touching hardware state is REJECTED unless never-brick is PROVEN (#26) 9// cp_fire_governed FIRES only an admitted pulse => "nothing pulses except through the conductor" (the enforcement, 10// the analog of nothing shipping except through the publisher). Sovereign. license_tier: ORIGINAL 11import "nx_syscalls.nx" 12 13const CP_RUNNER: *u8 = "_offc/nx_sov_build_run.elf" 14const CP_REJECT: i64 = 0 15const CP_ADMIT: i64 = 1 16 17func cp_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8) { if a[i]!=b[i] { return 0 } i=i+1 } if b[i]!=(0 as u8) { return 0 } return 1 } 18 19// (1) OWNED: the pulse names a real bound role. "" / unknown -> no Accountable owner -> not admissible. 20// (the conductor binds owners from the VALIDATED RACI contract via nx_harmony_conduct; this is the predicate.) 21func cp_owner_ok(role: *u8) -> i64 { 22 if cp_streq(role, "engineer" as *u8)==1 { return 1 } 23 if cp_streq(role, "doctor" as *u8)==1 { return 1 } 24 if cp_streq(role, "researcher" as *u8)==1 { return 1 } 25 if cp_streq(role, "adversarial" as *u8)==1 { return 1 } 26 if cp_streq(role, "pm" as *u8)==1 { return 1 } 27 return 0 28} 29 30// (2) GATE-GREEN: fork the sovereign runner on the organ's gate; 0 = GREEN. Don't pulse what doesn't pass. 31func cp_run_gate(gate: *u8) -> i64 { 32 let pid: i64 = sys_fork() 33 if pid == 0 { 34 let dn: i64 = sys_openat_wr("/dev/null\x00" as *u8, 420) 35 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 36 let argv: *i64 = sys_mmap(64) as *i64 37 argv[0] = CP_RUNNER as i64; argv[1] = gate as i64; argv[2] = 0 38 let envp: *i64 = sys_mmap(16) as *i64 39 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 40 sys_execve(CP_RUNNER, argv, envp) 41 sys_exit(127) 42 } 43 let st: *i64 = sys_mmap(16) as *i64 44 sys_wait4(pid, st, 0) 45 return (st[0] >> 8) & 0xff 46} 47 48// (3) NEVER-BRICK (#26): a hardware-touching daemon must PROVE never-brick or it is rejected by construction. 49func cp_neverbrick_ok(touches_hw: i64, neverbrick_proven: i64) -> i64 { if touches_hw==1 { if neverbrick_proven==0 { return 0 } } return 1 } 50 51// THE ADMISSION: ADMIT iff owned AND gate-green AND never-brick-ok. owner_ok / gate_exit are computed by the 52// caller (cp_owner_ok / cp_run_gate) so the decision itself is pure + fully testable. 53func cp_admit(owner_ok: i64, gate_exit: i64, touches_hw: i64, neverbrick_proven: i64) -> i64 { 54 if owner_ok != 1 { return CP_REJECT } 55 if gate_exit != 0 { return CP_REJECT } 56 if cp_neverbrick_ok(touches_hw, neverbrick_proven) != 1 { return CP_REJECT } 57 return CP_ADMIT 58} 59 60// GOVERNED FIRE: only an admitted pulse may run. Returns the organ's exit code, or -1 if REFUSED (not admitted). 61// This is the enforcement -- an un-admitted pulse CANNOT fire, so nothing pulses except through the conductor. 62func cp_fire_governed(admitted: i64, organ_gate: *u8) -> i64 { 63 if admitted != CP_ADMIT { return 0 - 1 } 64 return cp_run_gate(organ_gate) 65}