code wiki / _hdl_build / nx_deploy_lib.nx
`nx_deploy_lib.nx` source

↩ module page · 129 lines · 5655 B
1// nx_deploy_lib.nx -- the SAFETY CORE that turns "pushing live" from an F-level manual shit-show into ONE
2// reliable gated call. Operator: "im tired of pushing live being such a shit show its f level right now."
3// What was missing (per the deploy evaluation): VALIDATE-before-promote, HEALTH-verify-after, AUTO-ROLLBACK
4// on fail. This lib is those guarantees, pure + gateable; nx_deploy.nx wires them around the PROVEN organs
5// (nx_aw_hostctl deploy/status/rollback, atomic rename, sovereign SSH). license_tier: ORIGINAL
6import "nx_syscalls.nx"
7const K_MAGIC_4096: i64 = 4096
8const K_MAGIC_4095: i64 = 4095
9const K_MAGIC_262144: i64 = 262144
10const K_MAGIC_262140: i64 = 262140
11
12func dp_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
13func dp_w(fd: i64, s: *u8) -> i64 { let n: i64=dp_len(s); sys_write(fd,s,n); return 0 }
14func dp_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m; sys_write(fd,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 }
15func dp_read(path: *u8, buf: *u8, cap: i64) -> i64 {
16    let fd: i64 = sys_openat_rd(path)
17    if fd < 0 { return 0 }
18    var n: i64 = 0
19    var r: i64 = sys_read(fd, buf, cap - 1)
20    while r > 0 { n = n + r; if n >= cap - 1 { r = 0 } else { r = sys_read(fd, buf + n, cap - 1 - n) } }
21    sys_close(fd)
22    return n
23}
24func dp_writefile(path: *u8, buf: *u8, n: i64) -> i64 {
25    let fd: i64 = sys_openat_wr(path, 0x1a4)
26    if fd < 0 { return 0 - 1 }
27    sys_write(fd, buf, n)
28    sys_close(fd)
29    return 0
30}
31
32// VALIDATE-BEFORE-PROMOTE (fail-closed): never ship/promote a corrupt artifact. kind 0=binary(ELF magic),
33// 1=html/text(must contain a '<' tag), 2=any-non-empty. returns 1 valid / 0 invalid.
34func dep_validate(path: *u8, kind: i64) -> i64 {
35    let buf: *u8 = sys_mmap(K_MAGIC_4096)
36    let n: i64 = dp_read(path, buf, K_MAGIC_4095)
37    if n <= 0 { return 0 }
38    if kind == 0 {
39        if n < 4 { return 0 }
40        if buf[0] != (127 as u8) { return 0 }
41        if buf[1] != (69 as u8) { return 0 }
42        if buf[2] != (76 as u8) { return 0 }
43        if buf[3] != (70 as u8) { return 0 }
44        return 1
45    }
46    if kind == 1 {
47        var i: i64 = 0
48        while i < n { if buf[i] == (60 as u8) { return 1 } i = i + 1 }
49        return 0
50    }
51    return 1
52}
53
54// THE DEPLOY STATE MACHINE (the safety logic). Given the step results, decide:
55//   0 = SUCCESS (promote stuck + healthy) ; 1 = ROLLBACK (promoted but unhealthy, or promote failed) ;
56//   2 = ABORT (invalid artifact or ship failed -- nothing was promoted, site untouched).
57// This is what guarantees a deploy NEVER leaves the site down: unhealthy -> automatic rollback.
58func dep_decide(valid: i64, ship_rc: i64, promote_rc: i64, health_ok: i64) -> i64 {
59    if valid == 0 { return 2 }
60    if ship_rc != 0 { return 2 }
61    if promote_rc != 0 { return 1 }
62    if health_ok == 0 { return 1 }
63    return 0
64}
65
66// fork+exec a proven ELF with args (args[i] = *u8 cast to i64); wait; return its exit code (-1 on signal).
67func dep_run(elf: *u8, args: *i64, nargs: i64) -> i64 {
68    let pid: i64 = sys_fork()
69    if pid == 0 {
70        let argv: *i64 = sys_mmap(8 * (nargs + 2)) as *i64
71        let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
72        argv[0] = elf as i64
73        var i: i64 = 0
74        while i < nargs { argv[i+1] = args[i]; i = i + 1 }
75        argv[nargs+1] = 0
76        sys_execve(elf, argv, envp)
77        sys_exit(127)
78    }
79    let st: *i64 = sys_mmap(16) as *i64
80    sys_wait4(pid, st, 0)
81    if (st[0] % 128) != 0 { return 0 - 1 }
82    return (st[0] >> 8) & 0xff
83}
84
85func dp_contains(buf: *u8, n: i64, pat: *u8) -> i64 {
86    let pl: i64 = dp_len(pat)
87    if pl == 0 { return 0 }
88    var i: i64 = 0
89    while i + pl <= n {
90        var k: i64 = 0
91        var hit: i64 = 1
92        while k < pl { if buf[i+k] != pat[k] { hit = 0; k = pl } else { k = k + 1 } }
93        if hit == 1 { return 1 }
94        i = i + 1
95    }
96    return 0
97}
98// THE REAL health check: the deployed daemon's "...: UP" line must be PRESENT in the status OUTPUT. NOT just
99// status exiting 0 -- that false-green reported HEALTHY while sites.elf(web:8443) was DOWN (proven live).
100func dep_status_healthy(buf: *u8, n: i64, up_token: *u8) -> i64 { return dp_contains(buf, n, up_token) }
101
102// run an ELF capturing its stdout+stderr to outfile (so we can parse the result, not just trust the exit code).
103func dep_run_capture(elf: *u8, args: *i64, nargs: i64, outfile: *u8) -> i64 {
104    let pid: i64 = sys_fork()
105    if pid == 0 {
106        let fd: i64 = sys_openat_wr(outfile, 0x1a4)
107        if fd >= 0 { sys_dup3(fd, 1, 0); sys_dup3(fd, 2, 0) }
108        let argv: *i64 = sys_mmap(8 * (nargs + 2)) as *i64
109        let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
110        argv[0] = elf as i64
111        var i: i64 = 0
112        while i < nargs { argv[i+1] = args[i]; i = i + 1 }
113        argv[nargs+1] = 0
114        sys_execve(elf, argv, envp)
115        sys_exit(127)
116    }
117    let st: *i64 = sys_mmap(16) as *i64
118    sys_wait4(pid, st, 0)
119    if (st[0] % 128) != 0 { return 0 - 1 }
120    return (st[0] >> 8) & 0xff
121}
122// hostctl status -> capture -> is the deployed daemon actually UP? (the fix for the false-green).
123func dep_health(helf: *u8, up_token: *u8, tmpfile: *u8) -> i64 {
124    let stargs: *i64 = sys_mmap(16) as *i64; stargs[0] = "status" as i64
125    dep_run_capture(helf, stargs, 1, tmpfile)
126    let buf: *u8 = sys_mmap(K_MAGIC_262144)
127    let n: i64 = dp_read(tmpfile, buf, K_MAGIC_262140)
128    return dep_status_healthy(buf, n, up_token)
129}
nx_deploy_lib.nx source

`nx_deploy_lib.nx` source
