nx_deploy_verify.nx source

1// nx_deploy_verify.nx -- the team's capability to ADDRESS the deploy RISK + UNCERTAINTY (operator: "if 2// there is risk build the team to address the risk and uncertainty"). The risk: rebuilding a production 3// binary from a source that may be drifted/unpinned could REGRESS the live site. The fix is differential 4// equivalence (the Referee discipline applied to deploy): a swap is SAFE only if (1) the build is even 5// VERIFIABLE (source pinned + the rebuild runs), (2) the rebuild serves byte-IDENTICAL content to the 6// LIVE site on EVERY existing route (no regression), and (3) the new route is present + correct. 7// Crucially, when the source is NOT pinned (the current reality), the verdict is UNVERIFIABLE -> DO NOT 8// SWAP -- the team refuses to gamble with the live family site instead of cutting the corner. 9// license_tier: ORIGINAL Pairs with nx_deploy (backup+rollback) + nx_referee (objective equivalence). 10 11import "nx_syscalls.nx" 12 13const DV_REGRESS: i64 = 0 // a route differs / new route wrong -> swap would break the live site 14const DV_SAFE: i64 = 1 // reproduces live on every route + new route ok -> safe to swap 15const DV_UNVERIFIABLE: i64 = 2 // can't even verify (source not pinned / rebuild won't run) -> DO NOT SWAP 16 17// content hashes for the existing routes: rebuild must match live on EVERY one (no regression). 18func dv_routes_equivalent(n: i64, live: *i64, rebuild: *i64) -> i64 { 19 var i: i64 = 0 20 while i < n { if live[i] != rebuild[i] { return 0 } i = i + 1 } 21 return 1 22} 23func dv_first_divergent_route(n: i64, live: *i64, rebuild: *i64) -> i64 { 24 var i: i64 = 0 25 while i < n { if live[i] != rebuild[i] { return i } i = i + 1 } 26 return 0 - 1 27} 28 29// is the deploy even verifiable? need the source pinned AND a runnable rebuild to compare against live. 30func dv_verifiable(source_pinned: i64, rebuild_runs: i64) -> i64 { 31 if source_pinned != 1 { return 0 } 32 if rebuild_runs != 1 { return 0 } 33 return 1 34} 35 36// the verdict. 37func dv_verdict(verifiable: i64, equivalent: i64, new_route_ok: i64) -> i64 { 38 if verifiable != 1 { return DV_UNVERIFIABLE } // cannot prove safety -> never swap 39 if equivalent != 1 { return DV_REGRESS } // an existing route changed -> regression 40 if new_route_ok != 1 { return DV_REGRESS } // the new route missing/wrong -> fail 41 return DV_SAFE 42} 43 44// only a SAFE verdict permits the swap; UNVERIFIABLE and REGRESS both protect the live site. 45func dv_safe_to_swap(verdict: i64) -> i64 { if verdict == DV_SAFE { return 1 } return 0 } 46 47// did the live site survive the decision? (it always does -- we only swap when provably safe.) 48func dv_live_protected(verdict: i64, swapped: i64) -> i64 { 49 if verdict == DV_SAFE { return 1 } // swap was safe 50 if swapped == 0 { return 1 } // unsafe -> we did NOT swap -> live untouched 51 return 0 52}