code wiki / _hdl_build / nx_cron_reconcile.nx
`nx_cron_reconcile.nx` source

↩ module page · 360 lines · 19297 B
1// nx_cron_reconcile.nx -- SOVEREIGN crontab reconciler (operator directive 2026-07-16: "make the
2// capabilities native to the nishi ecosystem, don't make me do it"). The nishi-managed block of a crontab
3// becomes DATA: cron.reg declares exactly the nishi rows that must exist; this organ rewrites the crontab
4// so its nishi rows (any line containing /nishihost/) equal EXACTLY the declared set, leaving every
5// non-nishi row BYTE-EXACT. Dead rows (retired reconcilers) vanish by construction; new rows = a registry
6// line. Runs as root with ZERO operator action by piggybacking on the existing root cron row
7// (nx_edge443_reconcile.sh -- the same proven pattern as the vsz_watchdog on the rail).
8//
9// NEVER-BRICK BY CONSTRUCTION (this writes a root-owned BOOT FILE):
10//   R1 only lines containing /nishihost/ are ever touched -- the filter IS the blast-radius bound
11//   R2 refuse (exit 3, no write) if the registry is missing/empty -- an absent SSOT must never wipe rows
12//   R3 refuse (exit 5, no write) if ANY declared row lacks /nishihost/ -- the organ cannot inject
13//      non-nishi rows even if the registry is corrupted/hostile
14//   R4 refuse (exit 4, no write) if the crontab is unreadable or EMPTY -- a boot file is never empty
15//   R5 idempotent: byte-identical result -> NO-CHANGE, zero writes (safe at any frequency)
16//   R6 atomic: write <crontab>.nxnew then renameat over -- no torn boot file ever exists on disk
17// After a real change, SIGHUP every `crond` (reload -- standard, non-destructive; if crond ignores it,
18// stale in-memory entries keep harmlessly firing removed paths until its next restart = no regression).
19//
20// ---- THE SILENT-TRUNCATION DEFECT, FIXED 2026-08-20 (debt 1787260381) ---------------------------
21// THIS ORGAN SPENT AT LEAST TWO WEEKS APPLYING A PREFIX OF ITS OWN SSOT AND REPORTING IT AS THE WHOLE.
22// cr_read used to do ONE sys_read of CR_REGCAP-1 = 16383 bytes with no truncation check, while cron.reg
23// had grown to 24356. Every declared row past 16 KiB was invisible; the organ then counted what it had
24// SEEN into decl and printed "NO-CHANGE (crontab already matches cron.reg; declared=55)" -- a number that
25// reads exactly like a complete count. MEASURED: 66 rows declared, 55 applied, 11 silently inert, among
26// them the estate's only compensating control over a fail-open authentication path.
27//   ****  A CAP REACHED IN SILENCE BECOMES A MEASUREMENT NOBODY KNOWS IS PARTIAL.  ****
28// The fingerprint was in this organ's own log the whole time and nobody had a reason to look: `declared`
29// FELL 58 -> 57 -> 55 across 1346 runs while the registry only ever GREW. A registry that only grows
30// whose applied count only shrinks is a byte cap being crossed, one comment block at a time. And R5
31// (idempotence) hid it perfectly: the crontab genuinely DID match the truncated view, so CHANGED events
32// over that entire window numbered ZERO and every run looked healthy.
33//
34// THE FIX IS THE REMOVAL OF THE CAP, NOT A BIGGER CAP. A raised ceiling is the same defect with a later
35// trigger date, and this file's history is three variants of the same class already. cr_slurp composes
36// sys_read_file (nx_syscalls.nx), which sizes its buffer from the file itself via lseek END and cannot
37// short-read -- the estate primitive that already ate this exact debt twice (a 9 GB gguf 2026-07-15, and
38// the address-space regression 2026-08-19). There is no length constant left to outgrow.
39//
40// AND REMOVAL ALONE IS NOT ENOUGH, BECAUSE THE OLD BUG WAS UNDETECTABLE RATHER THAN MERELY WRONG. Three
41// guards now make the class announce instead of degrade:
42//   G1 TWO INSTRUMENTS, ONE FACT: the bytes handed back are compared against the file's OWN size taken
43//      independently (cr_fsize / lseek END). A disagreement is a PARTIAL READ and REFUSES (exit 7). This
44//      is the tooth that fails against the pre-fix binary: 16383 != 24356.
45//   G2 THE PARSE MUST REACH THE END: `scanned=` is printed beside `reg_bytes=`, so "I only ever saw a
46//      prefix" is visible in the evidence line rather than derivable only by someone who already suspects
47//      it. A count with no denominator beside it is how this hid.
48//   G3 THE PARTITION MUST SUM: rows DECLARED by the registry and rows APPLIED into the output are counted
49//      separately and must be equal, and the kept/removed/applied split must account for every line.
50//      A mismatch REFUSES (exit 8) rather than writing a boot file nobody can reconcile.
51// ⚠G1 is the one that would have caught the original; G2 and G3 catch the next variant. Stated that way
52// deliberately -- claiming all three would have caught it would be an overclaim about my own instrument.
53//
54// usage: nx_cron_reconcile <crontab-path> <reg-path>     (gate runs it on COPIES; prod = /etc/crontab)
55// exit: 0 ok (CHANGED or NO-CHANGE) | 2 usage | 3 reg-refuse | 4 crontab-refuse | 5 reg-taint | 6 write-fail
56//       | 7 partial-read (the two size instruments disagree) | 8 partition-mismatch (declared != applied)
57// license_tier: ORIGINAL   module: nishi-core.ops.cron_reconcile
58import "nx_syscalls.nx"
59const CR_MAGIC_65536: i64 = 65536
60
61// CR_CTCAP (65536) and CR_REGCAP (16384) ARE DELIBERATELY GONE, NOT RAISED. Both files are now read whole.
62// The crontab one was a latent copy of the same bug: /etc/crontab is GENERATED FROM cron.reg, so it
63// inherits the registry's growth and would have crossed its own ceiling next.
64// The output buffer is DERIVED from the two inputs instead of being a third guess. Upper bound is exact:
65// the crontab pass emits at most every byte it kept plus one newline if the file lacked a trailing one,
66// and the registry pass the same -- so cn + rn + 2 suffices. The slack is a small named margin over that
67// proven bound, not a tuning knob.
68const CR_OUT_SLACK: i64 = 16
69const CR_SEEK_END:  i64 = 2
70const CR_EXIT_PARTIAL_READ: i64 = 7
71const CR_EXIT_PARTITION:    i64 = 8
72const CR_MARK:   *u8 = "/nishihost/" as *u8
73
74func cr_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
75func cr_p(s: *u8) -> i64 { sys_write(1, s, cr_slen(s)); return 0 }
76func cr_decw(v: i64, out: *u8) -> i64 {
  var o: i64 = 0
  var m: i64 = v
  if m < 0 { out[0] = 45 as u8; o = 1; m = 0 - m }
  if m == 0 { out[o] = 48 as u8; return o + 1 }
  var nd: i64 = 1
  var mm: i64 = m
  while mm >= 10 { nd = nd + 1; mm = mm / 10 }
  var i: i64 = nd - 1
  while m > 0 { out[o + i] = (48 + (m % 10)) as u8; m = m / 10; i = i - 1 }
  return o + nd
87}
88func cr_pn(v: i64) -> i64 { let b: *u8 = sys_mmap(28); let n: i64 = cr_decw(v, b); sys_write(1, b, n); sys_munmap(b, 28); return 0 }
89func cr_contains(hay: *u8, hlen: i64, needle: *u8) -> i64 {
  let nlen: i64 = cr_slen(needle)
  if hlen < nlen { return 0 }
  var s: i64 = 0
  let last: i64 = hlen - nlen
  while s <= last {
      var m: i64 = 0
      var eq: i64 = 1
      while m < nlen { if hay[s + m] != needle[m] { eq = 0; m = nlen } m = m + 1 }
      if eq == 1 { return 1 }
      s = s + 1
  }
  return 0
102}
103func cr_line_end(buf: *u8, pos: i64, end: i64) -> i64 {
  var p: i64 = pos
  while p < end { if (buf[p] as i64) == 10 { return p } p = p + 1 }
  return end
107}
108// THE FILE'S OWN SIZE, taken INDEPENDENTLY of the read. This is the second instrument in G1: two ways of
109// answering "how big is this file" that must agree. Returns -1 if the size cannot be established, and the
110// caller then treats the check as UNOBSERVABLE rather than as a pass -- "I could not look" is not "it is fine".
111func cr_fsize(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  let n: i64 = sys_lseek(fd, 0, CR_SEEK_END)
  sys_close(fd)
  return n
117}
118
119// READ THE WHOLE FILE, WITH NO LENGTH CONSTANT ANYWHERE IN THE PATH. sys_read_file sizes its buffer from
120// the file (lseek END) and drains to EOF, so a short read is not a thing this can do. Returns the buffer
121// (or 0 on failure) and writes the length through out_len.
122func cr_slurp(path: *u8, out_len: *i64) -> *u8 {
  let n: *i64 = sys_mmap(16) as *i64
  n[0] = 0
  let b: *u8 = sys_read_file(path, n)
  out_len[0] = n[0]
  return b
128}
129
130func main(argc: i64, argv: *i64) -> i64 {
  if argc < 3 { cr_p("usage: nx_cron_reconcile <crontab-path> <reg-path>\n" as *u8); return 2 }
  let ctpath: *u8 = argv[1] as *u8
  let regpath: *u8 = argv[2] as *u8
  let cnp: *i64 = sys_mmap(16) as *i64
  let rnp: *i64 = sys_mmap(16) as *i64
136
  // R4: crontab must exist and be non-empty
  let ct: *u8 = cr_slurp(ctpath, cnp)
  let cn: i64 = cnp[0]
  if (ct as i64) == 0 { cr_p("REFUSED: crontab unreadable (a boot file is never absent) -- no write\n" as *u8); return 4 }
  if cn <= 0 { cr_p("REFUSED: crontab unreadable/empty (a boot file is never empty) -- no write\n" as *u8); return 4 }
  // G1 for the crontab too. Same guard, same reason: WE generate this file from the registry, so it
  // inherits the registry growth that broke the other side. A latent copy of a live bug is still a bug.
  let ctsz: i64 = cr_fsize(ctpath)
  if ctsz >= 0 { if cn != ctsz {
      cr_p("REFUSED: PARTIAL READ of the crontab -- got " as *u8); cr_pn(cn)
      cr_p(" bytes but the file is " as *u8); cr_pn(ctsz)
      cr_p(" -- refusing rather than reconciling against a prefix\n" as *u8)
      return CR_EXIT_PARTIAL_READ
  } }
  // R2: registry must exist with >=1 declared row; R3: every row must carry the nishi mark
  let reg: *u8 = cr_slurp(regpath, rnp)
  let rn: i64 = rnp[0]
  if (reg as i64) == 0 { cr_p("REFUSED: cron.reg missing -- an absent SSOT never wipes rows\n" as *u8); return 3 }
  if rn <= 0 { cr_p("REFUSED: cron.reg missing/empty -- an absent SSOT never wipes rows\n" as *u8); return 3 }
  // ---- G1: TWO INSTRUMENTS, ONE FACT. THIS IS THE TOOTH THE PRE-FIX BINARY FAILS. -----------
  // The old reader arrived here holding 16383 bytes of a 24356-byte file and was perfectly happy,
  // because nothing downstream had any way to know what it had NOT been given. Comparing the bytes we
  // were handed against the file OWN size is the cheapest possible check and the only one that can see
  // a prefix AS a prefix. If the size cannot be established the check is UNOBSERVABLE and is skipped
  // rather than counted as a pass -- "I could not look" is not "I looked and it is fine".
  let regsz: i64 = cr_fsize(regpath)
  if regsz >= 0 { if rn != regsz {
      cr_p("REFUSED: PARTIAL READ of cron.reg -- got " as *u8); cr_pn(rn)
      cr_p(" bytes but the file is " as *u8); cr_pn(regsz)
      cr_p(" -- every row past a short read is SILENTLY INERT, so this refuses instead\n" as *u8)
      return CR_EXIT_PARTIAL_READ
  } }
  // The output is DERIVED from the two inputs, so there is no third size left to outgrow.
  let out: *u8 = sys_mmap(cn + rn + CR_OUT_SLACK)
  let np:  *u8 = sys_mmap(512)
  var decl: i64 = 0
  var scanned: i64 = 0
  var pos: i64 = 0
  while pos < rn {
      let le: i64 = cr_line_end(reg, pos, rn)
      if le > pos { if (reg[pos] as i64) != 35 { if (reg[pos] as i64) != 13 {
          if cr_contains((((reg as i64) + pos)) as *u8, le - pos, CR_MARK) == 0 {
              cr_p("REFUSED: declared row lacks /nishihost/ (registry taint -- this organ cannot manage non-nishi rows)\n" as *u8)
              return 5
          }
          decl = decl + 1
      } } }
      scanned = le
      pos = le + 1
  }
  if decl == 0 { cr_p("REFUSED: cron.reg has no declared rows -- no write\n" as *u8); return 3 }
188
  // build: non-nishi crontab lines byte-exact, then the declared block
  var w: i64 = 0
  var removed: i64 = 0
  var kept: i64 = 0
  var applied: i64 = 0
  pos = 0
  while pos < cn {
      let le2: i64 = cr_line_end(ct, pos, cn)
      if cr_contains((((ct as i64) + pos)) as *u8, le2 - pos, CR_MARK) == 1 { removed = removed + 1 }
      else {
          kept = kept + 1
          var k: i64 = pos
          while k < le2 { out[w] = ct[k]; w = w + 1; k = k + 1 }
          out[w] = 10 as u8
          w = w + 1
      }
      pos = le2 + 1
  }
  pos = 0
  while pos < rn {
      let le3: i64 = cr_line_end(reg, pos, rn)
      if le3 > pos { if (reg[pos] as i64) != 35 { if (reg[pos] as i64) != 13 {
          var k2: i64 = pos
          while k2 < le3 { out[w] = reg[k2]; w = w + 1; k2 = k2 + 1 }
          out[w] = 10 as u8
          w = w + 1
          applied = applied + 1
      } } }
      pos = le3 + 1
  }
219
  // ---- G3: THE PARTITION MUST SUM, AND IT IS CHECKED BEFORE ANY BOOT FILE IS TOUCHED ---------
  // Every row the registry DECLARED must be a row we APPLIED. The two counters walk the same buffer
  // by the same rule, so today they cannot disagree -- which is exactly why asserting it costs
  // nothing and why a later edit that breaks the correspondence cannot ship quietly.
  // A PARTITION IS A CLAIM: CHECK THAT THE PARTS SUM, AND PRINT THEM EITHER WAY.
  if applied != decl {
      cr_p("REFUSED: partition does not reconcile -- declared=" as *u8); cr_pn(decl)
      cr_p(" applied=" as *u8); cr_pn(applied)
      cr_p(" -- refusing to write a crontab whose contents cannot be accounted for\n" as *u8)
      return CR_EXIT_PARTITION
  }
231
  // R5: idempotence -- byte-identical means zero writes
  var same: i64 = 0
  if w == cn {
      same = 1
      var ci: i64 = 0
      while ci < cn { if out[ci] != ct[ci] { same = 0; ci = cn } ci = ci + 1 }
  }
  if same == 1 {
      // ts= ON THE QUIET PATH. A healthy reconciler emits NO-CHANGE almost every run, so this is the
      // line that proves it is alive -- and without a timestamp nx_cron_watch cannot age it, which is
      // why this organ sat UNWATCHED. It is the worst possible one to leave unwatched: its own registry
      // header records that it failed silently TWICE (invoked argless, then as the wrong user), and each
      // time every row added to cron.reg was inert for weeks while the file read like a live schedule.
      // AN APPLIER THAT CANNOT BE AGED IS AN APPLIER NOBODY CAN TELL HAS STOPPED.
      // EVERY NUMBER HERE HAS ITS DENOMINATOR BESIDE IT. The defect this organ shipped for two weeks
      // was a bare `declared=55` with nothing to compare it against: no file size, no scan extent, no
      // applied count. A reader had no way to ask "55 of what?" and so nobody did.
      //   ****  A COUNT PUBLISHED WITHOUT ITS DENOMINATOR IS AN INVITATION TO TRUST IT.  ****
      // reg_scanned == reg_bytes-1 (the final newline) is the visible proof the parse reached the end.
      cr_p("NO-CHANGE (crontab already matches cron.reg; declared=" as *u8)
      cr_pn(decl)
      cr_p(")" as *u8)
      cr_p(" applied=" as *u8); cr_pn(applied)
      cr_p(" kept=" as *u8); cr_pn(kept)
      cr_p(" removed=" as *u8); cr_pn(removed)
      cr_p(" reg_bytes=" as *u8); cr_pn(rn)
      cr_p(" reg_scanned=" as *u8); cr_pn(scanned)
      cr_p(" crontab_bytes=" as *u8); cr_pn(cn)
      cr_p(" ts=" as *u8)
      cr_pn(sys_now_realtime_sec())
      cr_p("\n" as *u8)
      return 0
  }
265
  // R6: atomic write -- <path>.nxnew then rename over
  var npw: i64 = 0
  var pi: i64 = 0
  while ctpath[pi] != (0 as u8) { np[npw] = ctpath[pi]; npw = npw + 1; pi = pi + 1 }
  let sfx: *u8 = ".nxnew" as *u8
  var si: i64 = 0
  while sfx[si] != (0 as u8) { np[npw] = sfx[si]; npw = npw + 1; si = si + 1 }
  np[npw] = 0 as u8
  let wfd: i64 = sys_openat_wr(np, 420)
  if wfd < 0 { cr_p("WRITE-FAIL: cannot create .nxnew (permission?) -- crontab untouched\n" as *u8); return 6 }
  var off: i64 = 0
  while off < w {
      let wr: i64 = sys_write(wfd, (((out as i64) + off)) as *u8, w - off)
      if wr <= 0 { sys_close(wfd); cr_p("WRITE-FAIL: short write on .nxnew -- crontab untouched\n" as *u8); return 6 }
      off = off + wr
  }
  sys_close(wfd)
  if sys_renameat(np, ctpath) != 0 { cr_p("WRITE-FAIL: rename over crontab failed -- crontab untouched\n" as *u8); return 6 }
  cr_p("CHANGED: nishi-rows removed=" as *u8)
  cr_pn(removed)
  cr_p(" declared=" as *u8)
  cr_pn(decl)
  cr_p(" applied=" as *u8)
  cr_pn(applied)
  cr_p(" kept=" as *u8)
  cr_pn(kept)
  cr_p(" reg_bytes=" as *u8)
  cr_pn(rn)
  cr_p(" reg_scanned=" as *u8)
  cr_pn(scanned)
  cr_p(" bytes " as *u8)
  cr_pn(cn)
  cr_p("->" as *u8)
  cr_pn(w)
  cr_p(" ts=" as *u8)
  cr_pn(sys_now_realtime_sec())
  cr_p("\n" as *u8)
303
  // SIGHUP crond so the in-memory schedule reloads (safe standard reload; no-op if none found)
  let dfd: i64 = sys_openat_rd("/proc\x00" as *u8)
  if dfd >= 0 {
      let dbuf: *u8 = sys_mmap(CR_MAGIC_65536)
      let cpath: *u8 = sys_mmap(64)
      let cbuf: *u8 = sys_mmap(32)
      var hup: i64 = 0
      var reading: i64 = 1
      while reading == 1 {
          let dn: i64 = sys_getdents64(dfd, dbuf, CR_MAGIC_65536)
          if dn <= 0 { reading = 0 }
          else {
              var doff: i64 = 0
              while doff < dn {
                  let recp: *u8 = (((dbuf as i64) + doff)) as *u8
                  let reclen: i64 = dirent_reclen(recp)
                  let nm: *u8 = dirent_name(recp)
                  if nm[0] >= (48 as u8) { if nm[0] <= (57 as u8) {
                      var qi: i64 = 0
                      let pre: *u8 = "/proc/" as *u8
                      var ppi: i64 = 0
                      while pre[ppi] != (0 as u8) { cpath[ppi] = pre[ppi]; ppi = ppi + 1 }
                      while nm[qi] != (0 as u8) { cpath[ppi] = nm[qi]; ppi = ppi + 1; qi = qi + 1 }
                      let suf: *u8 = "/comm" as *u8
                      var ssi: i64 = 0
                      while suf[ssi] != (0 as u8) { cpath[ppi] = suf[ssi]; ppi = ppi + 1; ssi = ssi + 1 }
                      cpath[ppi] = 0 as u8
                      let cfd: i64 = sys_openat_rd(cpath)
                      if cfd >= 0 {
                          let cl: i64 = sys_read(cfd, cbuf, 31)
                          sys_close(cfd)
                          // comm == "crond\n"
                          if cl >= 5 { if cbuf[0]==(99 as u8) { if cbuf[1]==(114 as u8) { if cbuf[2]==(111 as u8) { if cbuf[3]==(110 as u8) { if cbuf[4]==(100 as u8) {
                              var tail_ok: i64 = 0
                              if cl == 5 { tail_ok = 1 }
                              if cl == 6 { if (cbuf[5] as i64) == 10 { tail_ok = 1 } }
                              if tail_ok == 1 {
                                  var pid: i64 = 0
                                  var di: i64 = 0
                                  while nm[di] != (0 as u8) { pid = pid * 10 + ((nm[di] as i64) - 48); di = di + 1 }
                                  nx_kill(pid, 1)
                                  hup = hup + 1
                              }
                          } } } } } }
                      }
                  } }
                  doff = doff + reclen
              }
          }
      }
      sys_close(dfd)
      cr_p("crond HUP'd: " as *u8)
      cr_pn(hup)
      cr_p("\n" as *u8)
  }
  return 0
360}
nx_cron_reconcile.nx source

`nx_cron_reconcile.nx` source
