`nx_funcheck.nx` source

↩ module page · 385 lines · 25291 B
1// nx_funcheck.nx -- SOVEREIGN FUNCTIONAL HEALTH MONITOR (synthetic-transaction checks). Operator 2026-06-29:
2// "build capabilities so we never manually debug -- focus on getting sites up and KEEPING them up." This is the
3// VALIDATION half of the reliability loop: it drives the REAL user flows (homepage, gallery login page, the
4// gallery/video AUTH POST, wiki, torrent) over the sovereign TLS1.3 client and reports PASS/FAIL per check,
5// distinguishing the THREE failure modes a status-code check is blind to:
6//   CONN-FAIL  : TCP connect failed              -> backend down / unreachable  (= the browser's "Failed to fetch")
7//   NO-RESPONSE: connected+TLS ok, no HTTP reply -> proxy hang / reset          (= the browser's "Failed to fetch")
8//   EXPECT-MISS: HTTP reply, but the expected content signature is absent       (= a 404/500 served as 200, etc.)
9// Data-driven: each check is a row in knowledge/hosting/funcchecks.conf (name|method|url|path|expect|body). Add a
10// flow = add a row. Reused by deploy-gating (block/rollback a deploy that breaks a flow) + the keep-up loop
11// (FAIL -> auto-heal: reconcile/restart/rollback). Exit 0 iff ALL flows pass. license_tier: ORIGINAL
12import "nx_syscalls.nx"
13import "nx_artifact_root.nx"   // ar_resolve: the estate's ONE artifact-root resolver (CWD-independence)
14import "nx_itoa_lib.nx"   // shared MSB-first emitter (zero-alloc)
15import "nx_connect.nx"   // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
16import "nx_x509_trust_store.nx"
17import "nx_trust_store_load_from_certdata.nx"
18import "nx_tls13_client_validate_certificate.nx"
19import "nx_tls13_client_session_run.nx"
20import "nx_https_url_for_fetch.nx"
21import "nx_https_url_connect.nx"
22import "nx_https_get_complete.nx"
23import "nx_https_post_complete.nx"
24import "nx_websocket_client_upgrade.nx"   // R2: real WebSocket-101 upgrade over the sovereign TLS session
25import "nx_https_fetch_lib.nx"   // hf_decode_transport: the estate's ONE transport decoder (dechunk + gzip/deflate)
26static fc_dec_buf: *u8
27static fc_dec_ready: i64
28const FC_MAGIC_4096: i64 = 4096
29const FC_MAGIC_65536: i64 = 65536
30const FC_MAGIC_16645: i64 = 16645
31const FC_MAGIC_2592000: i64 = 2592000
32const FC_MAGIC_10368000: i64 = 10368000
33const FC_MAGIC_34560000: i64 = 34560000
34const FC_MAGIC_4194304: i64 = 4194304
35const FC_MAGIC_1024: i64 = 1024
36const FC_MAGIC_8192: i64 = 8192
37
38// per-flow socket timeout (SO_RCVTIMEO/SO_SNDTIMEO): a hung TLS handshake or HTTP read must FAIL this flow
39// (-> NO-RESPONSE) instead of blocking the WHOLE monitor, so EVERY downstream flow still gets checked. This is
40// the fix for the diagnosis-blinding hang (home stalled -> video_room never tested). TODO: make per-flow via a
41// 7th funcchecks.conf column if a flow legitimately needs longer.
42const FC_TIMEOUT_S: i64 = 15
43func fc_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
44// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch
45// buffer per call and never freed it -- 4096B leaked PER CALL at page granularity,
46// the defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M
47// calls). nxi_* is MSB-first, allocates NOTHING, emits identical bytes incl. sign.
48func fc_putn(v: i64) -> i64 { nxi_out(v); return 0 }
49func fc_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
50func fc_atoi(s: *u8) -> i64 { var v: i64=0; var i: i64=0; while s[i]!=(0 as u8){ let c: i64=s[i] as i64; if c>=48 { if c<=57 { v=v*10+(c-48) } } i=i+1 } return v }
51func fc_contains(hay: *u8, n: i64, needle: *u8) -> i64 {
  let nl: i64 = fc_strlen(needle); if nl==0 {return 1}
  var i: i64=0
  while i+nl<=n { var j: i64=0; var ok: i64=1; while j<nl { if hay[i+j]!=needle[j]{ok=0;j=nl} else {j=j+1} } if ok==1{return 1} i=i+1 }
  return 0 }
56func fc_eol(b: *u8, n: i64, st: i64) -> i64 { var i: i64=st; while i<n { if (b[i] as i64)==10 {return i} i=i+1 } return n }
57func fc_split_pipe(b: *u8, ls: i64, le: i64, offs: *i64, lens: *i64, maxf: i64) -> i64 {
  var nf: i64=0; var st: i64=ls; var i: i64=ls
  while i < le { if (b[i] as i64)==124 { if nf<maxf { offs[nf]=st; lens[nf]=i-st; nf=nf+1 } st=i+1 } i=i+1 }
  if nf<maxf { offs[nf]=st; lens[nf]=le-st; nf=nf+1 }
  return nf }
62func fc_copyz(dst: *u8, src: *u8, off: i64, len: i64) -> i64 { var i: i64=0; while i<len{dst[i]=src[off+i];i=i+1} dst[len]=0 as u8; return len }
63// append helpers for the persisted status line (knowledge/status/funcheck.log) -- the census/keep-up loop
64// reads the LAST line; one assembled buffer -> ONE sys_write (O_APPEND, no tearing; single-writer runs).
65func fcl_apps(b: *u8, n: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){b[n+i]=s[i];i=i+1} return n+i }
66func fcl_appn(b: *u8, n: i64, v: i64) -> i64 {
  let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}
  var i: i64=0; var p: i64=n; while i<k{b[p]=t[k-1-i];p=p+1;i=i+1} return p }
69
70// R2: WebSocket-101 upgrade probe over an ESTABLISHED TLS-1.3 session. Sends a real RFC-6455 upgrade
71// request (Sec-WebSocket-Key etc.), reads the response headers, validates 101 + Sec-WebSocket-Accept.
72// Composes the client-upgrade byte builder/validator (nx_ws_client_*) + the SAME record encrypt/decrypt
73// glue nx_https_get_complete uses (client_app keys to send, server_app keys to read). Returns NX_WSCU_OK
74// or an NX_WSCU_* failure code. This is what a status-code check is BLIND to: a room that 200s its static
75// shell but does NOT actually accept a WebSocket upgrade = the "not enterable" false-green.
76func fc_ws_probe(s: *Tls13ClientSession, fd: i64, host: *u8, hlen: i64, path: *u8, plen: i64) -> i64 {
  let req: *u8 = sys_mmap(FC_MAGIC_4096)
  let key24: *u8 = sys_mmap(32)
  let rn: i64 = nx_ws_client_build_request(req, FC_MAGIC_4096, host, hlen, path, plen, 443, 0, key24)
  if rn < 0 { return NX_WSCU_KEY_TOO_BIG }
  // encrypt the upgrade request as one application_data record + write it (client_app keys)
  let rec_buf: *u8 = sys_mmap(rn + 64)
  let header_out: *u8 = rec_buf
  let ct_out: *u8 = ((rec_buf as i64) + NX_TLS13_RECORD_HEADER_LEN) as *u8
  let tag_out: *u8 = ((rec_buf as i64) + NX_TLS13_RECORD_HEADER_LEN + rn + 1) as *u8
  let ev: i64 = nx_tls13_record_encrypt_v2(s.cipher_suite, s.client_app_traffic_key, s.client_app_iv, s.client_app_seq, req, rn, NX_TLS13_CT_APPLICATION_DATA, 0, header_out, ct_out, tag_out)
  s.client_app_seq = s.client_app_seq + 1
  if ev != NX_TLS13_REC_VERDICT_OK { return NX_WSCU_WRITE_FAIL }
  let total: i64 = NX_TLS13_RECORD_HEADER_LEN + rn + 1 + NX_TLS13_RECORD_TAG_LEN
  var woff: i64 = 0
  while woff < total { let w: i64 = sys_write(fd, ((rec_buf as i64) + woff) as *u8, total - woff); if w <= 0 { return NX_WSCU_WRITE_FAIL } woff = woff + w }
  // read + decrypt response records (server_app keys) until the header terminator (a 101 has no body)
  let resp: *u8 = sys_mmap(FC_MAGIC_65536)
  var acc: i64 = 0
  let rec_in: *u8 = sys_mmap(FC_MAGIC_16645)
  let pt: *u8 = sys_mmap(FC_MAGIC_16645)
  let ctp: *i64 = sys_mmap(16) as *i64
  let lenp: *i64 = sys_mmap(16) as *i64
  var go: i64 = 1
  while go == 1 {
      let rt: i64 = nx_tls13_read_record_from_fd(fd, rec_in, FC_MAGIC_16645)
      if rt < 0 { go = 0 } else {
          let ct_len: i64 = rt - NX_TLS13_RECORD_HEADER_LEN - NX_TLS13_RECORD_TAG_LEN
          let tag: *u8 = ((rec_in as i64) + rt - NX_TLS13_RECORD_TAG_LEN) as *u8
          let dv: i64 = nx_tls13_record_decrypt_v2(s.cipher_suite, s.server_app_traffic_key, s.server_app_iv, s.server_app_seq, rec_in, ((rec_in as i64) + NX_TLS13_RECORD_HEADER_LEN) as *u8, ct_len, tag, pt, ctp, lenp)
          s.server_app_seq = s.server_app_seq + 1
          if dv != NX_TLS13_REC_VERDICT_OK { return NX_WSCU_READ_FAIL }
          if ctp[0] == NX_TLS13_CT_APPLICATION_DATA {
              var i: i64 = 0
              while i < lenp[0] { if acc < FC_MAGIC_65536 { resp[acc] = pt[i]; acc = acc + 1 } i = i + 1 }
              if _wscu_find_header_end(resp, acc) >= 0 { go = 0 }
          }
          if ctp[0] == NX_TLS13_CT_ALERT { go = 0 }
      }
  }
  return nx_ws_client_validate_response(resp, acc, key24)
117}
118
119// DISCRIMINATE cert-expiry from a generic handshake fail: re-connect + retry the handshake with `now`
120// BACKDATED by back_seconds. If it then SUCCEEDS, the cert was valid in the past but not now = EXPIRED
121// (or clock skew) -- the ONLY thing that changed is the validity-window check (ctx.now_epoch). Reuses the
122// exact connect+session machinery; no cert parsing, no shared-stack change. Returns 1 if the backdated
123// handshake succeeds. Runs ONLY on an already-failing flow, so the extra handshake cost is bounded.
124func fc_diag_expiry(store: *TrustStore, url: *u8, back_seconds: i64) -> i64 {
  let cr: *u8 = sys_mmap(32); var i: i64=0; while i<32{cr[i]=(0xC0+i) as u8;i=i+1}
  let priv: *u8 = sys_mmap(32); i=0; while i<32{priv[i]=(0xA0+i) as u8;i=i+1}
  let url_p: *NxUrl = nx_url_new()
  let target_raw: *u8 = sys_mmap(32)
  let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
  target.url = url_p; target.port = 0
  if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { return 0 }
  let fd_p: *i64 = sys_mmap(16) as *i64
  if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK { return 0 }
  let fd: i64 = *fd_p
  sys_set_socket_timeout(fd, FC_TIMEOUT_S)
  let host: *u8 = url + target.url.host_off
  let hlen: i64 = target.url.host_len
  let vc_raw: *u8 = sys_mmap(128)
  let vc: *TlsValidationContext = vc_raw as *TlsValidationContext
  vc.store = store; vc.sni_host = host; vc.sni_host_len = hlen
  vc.now_epoch = sys_now_realtime_sec() - back_seconds
  let sr: i64 = nx_tls13_client_session_run(fd, host, hlen, cr, priv, vc)
  sys_close(fd)
  if sr > 0 { return 1 }
  return 0
146}
147
148// extract a same-host (leading '/') Location header value into out (NUL-term); returns len or 0.
149func fc_hdr_location(buf: *u8, n: i64, out: *u8) -> i64 {
  let key: *u8 = "Location:" as *u8
  let kl: i64 = 9
  var i: i64 = 0
  while i + kl < n {
      var m: i64 = 1; var j: i64 = 0
      while j < kl { if buf[i+j] != key[j] { m=0; j=kl } else { j=j+1 } }
      if m==1 {
          var p: i64 = i + kl
          var go: i64 = 1
          while go==1 { if p<n { if buf[p]==(32 as u8) { p=p+1 } else { go=0 } } else { go=0 } }
          if p < n { if buf[p]==(47 as u8) {
              var o: i64 = 0
              var go2: i64 = 1
              while go2==1 { if p<n { let c: i64 = buf[p] as i64; if c==13 { go2=0 } else { if c==10 { go2=0 } else { out[o]=buf[p]; o=o+1; p=p+1 } } } else { go2=0 } }
              out[o]=0 as u8
              return o
          } }
          return 0
      }
      i = i + 1
  }
  return 0
172}
173
174// run ONE check. returns 1 pass / 0 fail; prints the verdict + the failure MODE.
175// parse a dotted-ipv4 string into packed BE, or 0 if not a valid quad (so "" / garbage -> DNS path).
176func fc_parse_ip(s: *u8) -> i64 {
  var parts: i64=0; var cur: i64=0; var packed: i64=0; var any: i64=0; var i: i64=0
  var run: i64=1
  while run==1 {
      let c: i64 = s[i] as i64
      if c == 0 { if any==1 { packed=(packed<<8)|cur; parts=parts+1 } run=0 }
      else { if c == 46 { packed=(packed<<8)|cur; cur=0; parts=parts+1; any=0 }
      else { if c>=48 { if c<=57 { cur=cur*10+(c-48); any=1 } else { return 0 } } else { return 0 } } }
      i = i + 1
  }
  if parts != 4 { return 0 }
  return packed
188}
189// TCP-connect to an EXPLICIT packed-BE ipv4 : port. fd in *fd_p; returns 0 ok / -1 fail. Used for the
190// per-row connect-IP override (8th conf column): test a capability SUBDOMAIN's real edge chain by
191// hitting the edge IP directly while the SNI/Host stays the subdomain -- the honest way to monitor a
192// split-horizon/hairpin'd subdomain from the LAN (the sni_router still routes by SNI = the real path).
193func fc_connect_explicit(packed: i64, port: i64, fd_p: *i64) -> i64 {
  let fd: i64 = sys_socket(2, 1, 0)
  if fd < 0 { return 0 - 1 }
  let sa: *u8 = sys_mmap(16)
  sa[0]=2 as u8; sa[1]=0 as u8
  sa[2]=((port>>8)&0xff) as u8; sa[3]=(port&0xff) as u8
  sa[4]=((packed>>24)&0xff) as u8; sa[5]=((packed>>16)&0xff) as u8; sa[6]=((packed>>8)&0xff) as u8; sa[7]=(packed&0xff) as u8
  var z: i64=8; while z<16 { sa[z]=0 as u8; z=z+1 }
  if nx_connect_bounded(fd, sa, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); return 0 - 1 }
  fd_p[0] = fd
  return 0
204}
205
206func fc_one(store: *TrustStore, name: *u8, method: *u8, url: *u8, path: *u8, expect: *u8, body: *u8, tmo_s: i64, connect_ip: *u8) -> i64 {
  let cr: *u8 = sys_mmap(32); var i: i64=0; while i<32{cr[i]=(0xC0+i) as u8;i=i+1}
  let priv: *u8 = sys_mmap(32); i=0; while i<32{priv[i]=(0xA0+i) as u8;i=i+1}
  let url_p: *NxUrl = nx_url_new()
  let target_raw: *u8 = sys_mmap(32)
  let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
  target.url = url_p; target.port = 0
  if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { fc_puts("  FAIL " as *u8); fc_puts(name); fc_puts(" -> BAD-URL\n" as *u8); return 0 }
  let fd_p: *i64 = sys_mmap(16) as *i64
  let t0: i64 = sys_now_us()
  // connect-IP override: dotted-quad -> connect to that edge IP directly (SNI/Host stay the URL host,
  // so the sni_router routes by SNI = the true external path); else normal DNS resolve.
  var ov_packed: i64 = 0
  if (connect_ip as i64) != 0 { ov_packed = fc_parse_ip(connect_ip) }
  if ov_packed != 0 {
      var oport: i64 = target.port
      if oport <= 0 { oport = 443 }
      if fc_connect_explicit(ov_packed, oport, fd_p) != 0 {
          fc_puts("  FAIL " as *u8); fc_puts(name); fc_puts(" -> CONN-FAIL (edge-ip override; = 'Failed to fetch')\n" as *u8); return 0 }
  } else {
      if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK {
          fc_puts("  FAIL " as *u8); fc_puts(name); fc_puts(" -> CONN-FAIL (TCP connect; = 'Failed to fetch')\n" as *u8); return 0 }
  }
  let fd: i64 = *fd_p
  var tmo: i64 = tmo_s
  if tmo <= 0 { tmo = FC_TIMEOUT_S }         // per-flow timeout (7th conf column); default 15s
  sys_set_socket_timeout(fd, tmo)            // bound the handshake + HTTP read: a hung flow FAILS fast, never blocks downstream flows
  let host: *u8 = url + target.url.host_off
  let hlen: i64 = target.url.host_len
  let vc_raw: *u8 = sys_mmap(64)
  let vc: *TlsValidationContext = vc_raw as *TlsValidationContext
  vc.store = store; vc.sni_host = host; vc.sni_host_len = hlen; vc.now_epoch = sys_now_realtime_sec()
  let sr: i64 = nx_tls13_client_session_run(fd, host, hlen, cr, priv, vc)
  if sr <= 0 {
      sys_close(fd)
      // make the failure ACTIONABLE: is it an EXPIRED cert? (backdated-now retry ladder: 30d/120d/400d)
      var cexp: i64 = 0
      if fc_diag_expiry(store, url, FC_MAGIC_2592000) == 1 { cexp = 1 }
      else { if fc_diag_expiry(store, url, FC_MAGIC_10368000) == 1 { cexp = 1 }
      else { if fc_diag_expiry(store, url, FC_MAGIC_34560000) == 1 { cexp = 1 } } }
      fc_puts("  FAIL " as *u8); fc_puts(name)
      if cexp == 1 { fc_puts(" -> CERT-EXPIRED (TLS cert past notAfter -- renew/reissue) sr=" as *u8) }
      else { fc_puts(" -> TLS-HANDSHAKE-FAIL sr=" as *u8) }
      fc_putn(sr); fc_puts("\n" as *u8); return 0 }
  let session: *Tls13ClientSession = sr as *Tls13ClientSession
  // @ws ENTERABILITY (R2): a real WebSocket-101 upgrade, not a status code. Catches a room that serves
  // its shell but does NOT accept a socket = the "not enterable" false-green a GET is blind to.
  if fc_contains(expect, fc_strlen(expect), "@ws" as *u8) == 1 {
      let wv: i64 = fc_ws_probe(session, fd, host, hlen, path, fc_strlen(path))
      let wms: i64 = (sys_now_us() - t0) / 1000
      sys_close(fd)
      if wv == NX_WSCU_OK {
          fc_puts("  PASS " as *u8); fc_puts(name); fc_puts(" (WebSocket 101 upgrade OK) ms=" as *u8); fc_putn(wms); fc_puts("\n" as *u8); return 1 }
      fc_puts("  FAIL " as *u8); fc_puts(name); fc_puts(" -> WS-UPGRADE-FAIL wscu=" as *u8); fc_putn(wv); fc_puts(" (room not enterable: no 101) ms=" as *u8); fc_putn(wms); fc_puts("\n" as *u8); return 0
  }
  let buf: *u8 = sys_mmap(FC_MAGIC_4194304)
  var rc: i64 = 0
  if fc_contains(method, fc_strlen(method), "POST" as *u8)==1 {
      rc = nx_https_post_complete(session, fd, path, fc_strlen(path), host, hlen, "application/x-www-form-urlencoded" as *u8, 33, body, fc_strlen(body), buf, FC_MAGIC_4194304)
  } else {
      rc = nx_https_get_complete(session, fd, path, fc_strlen(path), host, hlen, buf, FC_MAGIC_4194304)
  }
  let ms: i64 = (sys_now_us() - t0) / 1000
  sys_close(fd)
  if rc < 0 { fc_puts("  FAIL " as *u8); fc_puts(name); fc_puts(" -> NO-RESPONSE rc="); fc_putn(rc); fc_puts(" (proxy hang/reset; = 'Failed to fetch') ms="); fc_putn(ms); fc_puts("\n" as *u8); return 0 }
  // FOLLOW ONE same-host redirect (real browsers do; a monitor that doesn't = false-negative on
  // canonicalized/clean-URL resources, e.g. /video/embed.html -> 301 -> the served page). GET only.
  if rc > 12 { if buf[9]==(51 as u8) { if buf[10]==(48 as u8) {
      let loc: *u8 = sys_mmap(FC_MAGIC_1024)
      let locn: i64 = fc_hdr_location(buf, rc, loc)
      if locn > 0 {
          let fd2p: *i64 = sys_mmap(16) as *i64
          if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd2p) == NX_HTTPS_CONNECT_OK {
              let fd2: i64 = *fd2p
              sys_set_socket_timeout(fd2, tmo)
              let vc2_raw: *u8 = sys_mmap(128)
              let vc2: *TlsValidationContext = vc2_raw as *TlsValidationContext
              vc2.store = store; vc2.sni_host = host; vc2.sni_host_len = hlen; vc2.now_epoch = sys_now_realtime_sec()
              let sr2: i64 = nx_tls13_client_session_run(fd2, host, hlen, cr, priv, vc2)
              if sr2 > 0 {
                  let sess2: *Tls13ClientSession = sr2 as *Tls13ClientSession
                  let rc2: i64 = nx_https_get_complete(sess2, fd2, loc, fc_strlen(loc), host, hlen, buf, FC_MAGIC_4194304)
                  sys_close(fd2)
                  if rc2 > 0 { rc = rc2 }
              } else { sys_close(fd2) }
          }
      }
  } } }
  // DECODE THE TRANSPORT BEFORE MATCHING (2026-08-22): the client ADVERTISES gzip/deflate but
  // nx_https_get_complete returns the body VERBATIM, so a COMPRESSED body was substring-searched for a
  // PLAINTEXT marker. hf_decode_transport is the estate's ONE decoder -- composed, not rebuilt.
  if fc_dec_ready == 0 { fc_dec_ready = 1; fc_dec_buf = sys_mmap(FC_MAGIC_4194304) }
  let dn: i64 = hf_decode_transport(buf, rc, fc_dec_buf, FC_MAGIC_4194304)
  if dn > 0 { var ci: i64 = 0; while ci < dn { buf[ci] = fc_dec_buf[ci]; ci = ci + 1 } rc = dn }
  // @js ASSET-INTEGRITY mode (200 is the beginning, not the end): a <script>/asset that comes back as
  // text/html is a JS file served as a 404 HTML page -> the browser's "Uncaught SyntaxError: Unexpected
  // token '<'". Catch it MECHANICALLY so no human has to open dev-tools. Would have caught the app.js break.
  if fc_contains(expect, fc_strlen(expect), "@js" as *u8) == 1 {
      if fc_contains(buf, rc, "text/html" as *u8) == 1 {
          fc_puts("  FAIL " as *u8); fc_puts(name); fc_puts(" -> JS-AS-HTML (script served text/html = console 'Uncaught SyntaxError: Unexpected token <') " as *u8); fc_putn(rc); fc_puts("B ms=" as *u8); fc_putn(ms); fc_puts("\n" as *u8); return 0 }
      fc_puts("  PASS " as *u8); fc_puts(name); fc_puts(" (JS asset OK, not HTML) " as *u8); fc_putn(rc); fc_puts("B ms=" as *u8); fc_putn(ms); fc_puts("\n" as *u8); return 1 }
  if fc_contains(buf, rc, expect)==1 {
      fc_puts("  PASS " as *u8); fc_puts(name); fc_puts(" ("); fc_putn(rc); fc_puts("B ms="); fc_putn(ms); fc_puts(")\n" as *u8); return 1 }
  fc_puts("  FAIL " as *u8); fc_puts(name); fc_puts(" -> EXPECT-MISS '"); fc_puts(expect); fc_puts("' absent ("); fc_putn(rc); fc_puts("B ms="); fc_putn(ms); fc_puts(") got1st='" as *u8)
  var gi: i64 = 0
  while gi < rc { if gi >= 56 { gi = rc } else { let gc: i64 = buf[gi] as i64; if gc==13 { gi = rc } else { if gc==10 { gi = rc } else { sys_write(1, ((buf as i64)+gi) as *u8, 1); gi = gi + 1 } } } }
  fc_puts("'\n" as *u8); return 0
313}
314
315func main() -> i64 {
  let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt\x00" as *u8, 512, FC_MAGIC_4194304)
  if r <= 0 { fc_puts("FUNCHECK: certdata load failed (data/mozilla_certdata.txt)\n" as *u8); return 1 }
  let store: *TrustStore = r as *TrustStore
  fc_puts("FUNCHECK functional monitor -- CA=" as *u8); fc_putn(trust_store_count(store)); fc_puts(" (driving REAL user flows over TLS)\n" as *u8)
  let szb: *i64 = sys_mmap(16) as *i64; szb[0]=0
  // ★CWD-INDEPENDENT CONFIG RESOLUTION (2026-08-08). nx_inputprobe flagged this path CWD-DEPENDENT:
  // from the serving root the conf resolves only as `funcchecks.conf`, so a bare read here finds
  // nothing and the monitor checks ZERO flows -- while funcheck.log backs TWO ecomat slots (hosting
  // slot2 AND network slot1). ★CREDIT WHERE DUE: this organ already FAILS CLOSED -- it returns before
  // writing any status line, unlike nx_security_census and nx_game_gen2, which wrote confident false
  // rows from the same class of bug. The defect here cost SILENCE, not a lie, and silence is the
  // correct failure. Resolving through the estate's ONE artifact-root resolver turns it into a real
  // measurement without weakening that refusal.
  let cfgp: *u8 = sys_mmap(512)
  if ar_resolve("knowledge/hosting/funcchecks.conf" as *u8, cfgp) == 0 {
      fc_puts("FUNCHECK: funcchecks.conf unresolvable from here OR any configured root -- checking NOTHING, refusing to report\n" as *u8); return 1
  }
  let cfg: *u8 = sys_read_file(cfgp, szb)
  if (cfg as i64)==0 { fc_puts("FUNCHECK: funcchecks.conf resolved but unreadable\n" as *u8); return 1 }
  let n: i64 = szb[0]
  let offs: *i64 = sys_mmap(256) as *i64
  let lens: *i64 = sys_mmap(256) as *i64
  let nm: *u8=sys_mmap(128); let mt: *u8=sys_mmap(16); let ur: *u8=sys_mmap(FC_MAGIC_1024); let pa: *u8=sys_mmap(FC_MAGIC_1024); let ex: *u8=sys_mmap(512); let bo: *u8=sys_mmap(FC_MAGIC_1024); let tb: *u8=sys_mmap(16)
  var cur: i64=0; var total: i64=0; var pass: i64=0
  let lb: *u8 = sys_mmap(FC_MAGIC_4096); var lbn: i64=0   // accumulates " <name>=PASS/FAIL" per flow for the persisted line
  while cur < n {
      let le: i64 = fc_eol(cfg, n, cur)
      var ok_line: i64=1
      if le<=cur {ok_line=0}
      if ok_line==1 { if (cfg[cur] as i64)==35 {ok_line=0} }
      if ok_line==1 {
          let nf: i64 = fc_split_pipe(cfg, cur, le, offs, lens, 16)
          if nf>=5 {
              fc_copyz(nm, cfg, offs[0], lens[0]); fc_copyz(mt, cfg, offs[1], lens[1]); fc_copyz(ur, cfg, offs[2], lens[2])
              fc_copyz(pa, cfg, offs[3], lens[3]); fc_copyz(ex, cfg, offs[4], lens[4]); bo[0]=0 as u8
              if nf>=6 { fc_copyz(bo, cfg, offs[5], lens[5]) }
              var tmo7: i64 = 0
              if nf>=7 { fc_copyz(tb, cfg, offs[6], lens[6]); tmo7 = fc_atoi(tb) }
              let cip: *u8 = sys_mmap(64); cip[0]=0 as u8
              if nf>=8 { fc_copyz(cip, cfg, offs[7], lens[7]) }   // 8th col: connect-IP override (edge probe)
              total = total + 1
              let r1: i64 = fc_one(store, nm, mt, ur, pa, ex, bo, tmo7, cip)
              if r1==1 { pass=pass+1 }
              lbn = fcl_apps(lb, lbn, " " as *u8)
              lbn = fcl_apps(lb, lbn, nm)
              if r1==1 { lbn = fcl_apps(lb, lbn, "=PASS" as *u8) } else { lbn = fcl_apps(lb, lbn, "=FAIL" as *u8) }
          }
      }
      cur = le + 1
  }
  fc_puts("FUNCHECK RESULT pass=" as *u8); fc_putn(pass); fc_puts("/" as *u8); fc_putn(total); fc_puts("\n" as *u8)
  // persist ONE status line (epoch + per-flow results + verdict) -> knowledge/status/funcheck.log so the
  // rival census's LIVE axis + the keep-up loop consume a durable, freshness-checkable record (not stdout).
  let bb: *u8 = sys_mmap(FC_MAGIC_8192); var bn: i64=0
  bn = fcl_apps(bb, bn, "FUNCHECK epoch=" as *u8)
  bn = fcl_appn(bb, bn, sys_now_realtime_sec())
  bn = fcl_apps(bb, bn, " pass=" as *u8)
  bn = fcl_appn(bb, bn, pass)
  bn = fcl_apps(bb, bn, "/" as *u8)
  bn = fcl_appn(bb, bn, total)
  var li: i64=0
  while li < lbn { bb[bn]=lb[li]; bn=bn+1; li=li+1 }
  if pass==total { bn = fcl_apps(bb, bn, " verdict=GREEN" as *u8) } else { bn = fcl_apps(bb, bn, " verdict=RED" as *u8) }
  bb[bn]=10 as u8; bn=bn+1
  let lf: i64 = sys_openat_append("knowledge/status/funcheck.log" as *u8, 0x1a4)
  if lf>=0 { sys_write(lf, bb, bn); sys_close(lf) }
  if pass==total { fc_puts("FUNCHECK GREEN -- every user flow validated end-to-end\n" as *u8); return 0 }
  fc_puts("FUNCHECK RED -- a real user flow is BROKEN (see the FAIL lines + failure MODE above)\n" as *u8)
  return 1
385}
nx_funcheck.nx source

`nx_funcheck.nx` source
