nx_edge_vantage.nx source

1// nx_edge_vantage.nx -- EDGE REACHABILITY AS A SOVEREIGN ORGAN (2026-08-06, debt 1786068787). 2// 3// WHY THIS FILE EXISTS AT ALL. The capability shipped first as nishi-ops/edge_vantage_beat.ps1 -- 4// POWERSHELL, i.e. a borrowed third-party runtime -- which violates the standing law "build NISHI 5// tooling for every need; never default to linux/3rd-party tools where an organ exists or can be 6// built" and rule 27 (shell exists ONLY to launch a sovereign ELF). The operator caught it directly. 7// The MEASUREMENT is irreducibly off-box -- the NAS cannot tell you whether the WAN reaches its own 8// front door, so something must run away from the box -- but NOTHING about that requires PowerShell. 9// The estate already settled this exact shape with nx_content_ship: an organ whose work irreducibly 10// starts laptop-side is still a SOVEREIGN ELF, and the shell is reduced to one launch line. 11// 12// WHAT IT MEASURES, AND WHY IT IS NOT A PING. A pass/fail probe cannot separate "our edge, transient 13// blip" from "answered by the wrong server entirely" -- and for two days the estate's standing answer 14// to any transport error was a memory line about a :443 co-squat that had ALREADY BEEN FIXED on 15// 08-04. So this asks WHO ANSWERED: our sovereign edge stamps X-Served-By, and a co-squatting server 16// cannot. That single header turns folklore into a measurement. 17// 18// DEGRADED IS A DISTINCT VERDICT ON PURPOSE. Collapsing partial reachability into OK is how an 19// intermittent fault hides until it is total; collapsing it into FAIL cries wolf. MEASURED on the 20// PowerShell predecessor: a real window came back 4-of-6 handshakes with the rest clean, which is 21// exactly the state neither OK nor FAIL describes. 22// 23// VANTAGE IS PART OF THE READING, NEVER AN ASSUMPTION -- so it is an ARGUMENT and it is printed. 24// Running this organ ON the NAS and OFF it are DIFFERENT EXPERIMENTS with different correct answers 25// (the NAS hairpin does not necessarily reach our own edge), which makes the same binary its own 26// negative control. A row that does not say where it was taken is not evidence. 27// 28// nx_edge_vantage [url] [n] [vantage-label] 29// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 30import "nx_syscalls.nx" 31import "nx_csprng.nx" 32import "nx_x509_trust_store.nx" 33import "nx_trust_store_load_from_certdata.nx" 34import "nx_tls13_client_validate_certificate.nx" 35import "nx_tls13_client_session_run.nx" 36import "nx_tls13_chrome_session.nx" 37import "nx_https_url_for_fetch.nx" 38import "nx_https_url_connect.nx" 39import "nx_https_get_complete.nx" 40import "nx_tls_cert_cache.nx" 41import "nx_https_fetch_lib.nx" 42 43const EV_OUTCAP: i64 = 1048576 44const EV_ROWCAP: i64 = 2048 45const EV_DEF_N: i64 = 6 46const EV_MAX_N: i64 = 64 47 48func ev_put(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 49func ev_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 50func ev_cat(d: *u8, o: i64, s: *u8) -> i64 { var x: i64 = o; var i: i64 = 0; while s[i] != (0 as u8) { d[x] = s[i]; x = x + 1; i = i + 1 } return x } 51func ev_catn(d: *u8, o: i64, v: i64) -> i64 { 52 var x: i64 = o 53 var m: i64 = v 54 if m < 0 { d[x] = 45 as u8; x = x + 1; m = 0 - m } 55 if m == 0 { d[x] = 48 as u8; return x + 1 } 56 let t: *u8 = sys_mmap(32) 57 var k: i64 = 0 58 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 59 var j: i64 = 0 60 while j < k { d[x] = t[k - 1 - j]; x = x + 1; j = j + 1 } 61 return x 62} 63func ev_atoi(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; while s[i] != (0 as u8) { let c: i64 = s[i] as i64; if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } i = i + 1 } return v } 64// substring search over a RAW response buffer (headers included; the buffer is not NUL-terminated) 65func ev_has(buf: *u8, n: i64, lit: *u8) -> i64 { 66 let ll: i64 = ev_slen(lit) 67 if ll == 0 { return 0 } 68 if ll > n { return 0 } 69 var i: i64 = 0 70 while i + ll <= n { 71 var k: i64 = 0 72 var ok: i64 = 1 73 while k < ll { if buf[i + k] != lit[k] { ok = 0; k = ll } else { k = k + 1 } } 74 if ok == 1 { return 1 } 75 i = i + 1 76 } 77 return 0 78} 79 80func main(argc: i64, argv: *i64) -> i64 { 81 // DEFAULT TARGET IS A SITES ROUTE, NOT THE MGMT API. First cut defaulted to /api/health and scored 82 // ours=0 from BOTH vantages -- which looked like "nothing is our edge" and was actually my own 83 // instrument: MEASURED, /api/health answers `401 Unauthorized` with Content-Type, Connection and 84 // Content-Length AND NOTHING ELSE, so the identity header it was being graded on is never sent on 85 // that route. `/` and `/code/tools` both carry `X-Served-By: nishi-substrate-v2`. 86 // ★A GUARD WHOSE INPUT THE ROUTE DOES NOT EMIT SCORES EVERY HEALTHY ANSWER AS A FAILURE. 87 var url: *u8 = "https://nishifamily.com/" as *u8 88 var n: i64 = EV_DEF_N 89 var vant: *u8 = "unlabelled" as *u8 90 if argc >= 2 { url = argv[1] as *u8 } 91 if argc >= 3 { n = ev_atoi(argv[2] as *u8) } 92 if argc >= 4 { vant = argv[3] as *u8 } 93 if n < 1 { n = 1 } 94 // CAP THE PROBE. An unbounded n aimed at our own edge is a self-inflicted load generator, and the 95 // one thing a reachability probe must never do is cause the outage it reports. 96 if n > EV_MAX_N { n = EV_MAX_N } 97 98 let store_i: i64 = hf_store_load() 99 if store_i <= 0 { 100 // REFUSE, never score. A probe that cannot validate certificates would still get bytes back 101 // and would happily call an impostor healthy -- silence here is the honest answer. 102 ev_put("EDGE-VANTAGE REFUSED trust-store-load-failed (data/mozilla_certdata.txt on CWD?) -- no verdict emitted\n" as *u8) 103 sys_exit(3) 104 return 3 105 } 106 107 // HOISTED. One buffer reused across probes: allocating inside the loop leaks a page per probe, 108 // which is the defect that took 28.5GB of a 36GB host in nx_ts_lumadiff. 109 let out: *u8 = sys_mmap(EV_OUTCAP) 110 let row: *u8 = sys_mmap(EV_ROWCAP) 111 112 var ok: i64 = 0 113 var ours: i64 = 0 114 var cfail: i64 = 0 115 var tfail: i64 = 0 116 var ofail: i64 = 0 117 var i: i64 = 0 118 while i < n { 119 // hf_fetch, NOT hf_fetch_mode. MEASURED 2026-08-06: hf_fetch_mode exists ONLY in the NAS tree; 120 // the laptop authoring tree's nx_https_fetch_lib.nx predates it, so an organ written against it 121 // builds on the NAS and FAILS locally with "call to undefined function". This organ must build 122 // IDENTICALLY IN BOTH TREES -- it is the same measurement taken from two vantages, and two 123 // source variants of one instrument is exactly how a comparison stops meaning anything. 124 // Choosing the older common entry point costs the explicit decode flag and nothing else: every 125 // failure mode below is classified from the RETURN CODE, not from the body. 126 let r: i64 = hf_fetch(store_i, url, 0, 0, out, EV_OUTCAP) 127 if r >= 0 { 128 ok = ok + 1 129 // Match the VALUE, not just the header name: `nishi-substrate-v2` is what our edge stamps. 130 // Grading on the bare header name would count any server that happens to send X-Served-By. 131 if ev_has(out, r, "nishi-substrate-v2" as *u8) == 1 { ours = ours + 1 } 132 } 133 if r == HF_ERR_CONNECT { cfail = cfail + 1 } 134 if r == HF_ERR_TLS { tfail = tfail + 1 } 135 if r < 0 { if r != HF_ERR_CONNECT { if r != HF_ERR_TLS { ofail = ofail + 1 } } } 136 i = i + 1 137 } 138 139 // VERDICT. OK demands BOTH full reachability AND that every answer was ours -- reachable-but-wrong 140 // -server is a failure mode that a reachability count alone cannot see. 141 var verdict: *u8 = "FAIL" as *u8 142 if ok > 0 { verdict = "DEGRADED" as *u8 } 143 if ok == n { if ours == n { verdict = "OK" as *u8 } } 144 145 var o: i64 = 0 146 o = ev_cat(row, o, "EDGE-VANTAGE " as *u8) 147 o = ev_cat(row, o, verdict) 148 o = ev_cat(row, o, " ts=" as *u8) 149 o = ev_catn(row, o, sys_now_realtime_sec()) 150 o = ev_cat(row, o, " vantage=" as *u8) 151 o = ev_cat(row, o, vant) 152 o = ev_cat(row, o, " url=" as *u8) 153 o = ev_cat(row, o, url) 154 o = ev_cat(row, o, " n=" as *u8) 155 o = ev_catn(row, o, n) 156 o = ev_cat(row, o, " ok=" as *u8) 157 o = ev_catn(row, o, ok) 158 o = ev_cat(row, o, " ours=" as *u8) 159 o = ev_catn(row, o, ours) 160 o = ev_cat(row, o, " connect_fail=" as *u8) 161 o = ev_catn(row, o, cfail) 162 o = ev_cat(row, o, " tls_fail=" as *u8) 163 o = ev_catn(row, o, tfail) 164 o = ev_cat(row, o, " other_fail=" as *u8) 165 o = ev_catn(row, o, ofail) 166 // ENVELOPE DECLARED IN-BAND: `ours` counts responses carrying X-Served-By, which our edge stamps 167 // and a co-squatting server does not. It is an identity signal, not a proof of authenticity -- say 168 // so rather than let a reader upgrade it to one. 169 o = ev_cat(row, o, " ident=X-Served-By-present;identity-signal-not-authentication\n" as *u8) 170 row[o] = 0 as u8 171 sys_write(1, row, o) 172 sys_exit(0) 173 return 0 174}