nx_funcheck.nx source
↩ module page · 363 lines · 23457 B
1// nx_funcheck.nx -- SOVEREIGN FUNCTIONAL HEALTH MONITOR (synthetic-transaction checks). Operator 2026-06-29:
2// "build capabilities so we never manually debug -- focus on getting sites up and KEEPING them up." This is the
3// VALIDATION half of the reliability loop: it drives the REAL user flows (homepage, gallery login page, the
4// gallery/video AUTH POST, wiki, torrent) over the sovereign TLS1.3 client and reports PASS/FAIL per check,
5// distinguishing the THREE failure modes a status-code check is blind to:
6// CONN-FAIL : TCP connect failed -> backend down / unreachable (= the browser's "Failed to fetch")
7// NO-RESPONSE: connected+TLS ok, no HTTP reply -> proxy hang / reset (= the browser's "Failed to fetch")
8// EXPECT-MISS: HTTP reply, but the expected content signature is absent (= a 404/500 served as 200, etc.)
9// Data-driven: each check is a row in knowledge/hosting/funcchecks.conf (name|method|url|path|expect|body). Add a
10// flow = add a row. Reused by deploy-gating (block/rollback a deploy that breaks a flow) + the keep-up loop
11// (FAIL -> auto-heal: reconcile/restart/rollback). Exit 0 iff ALL flows pass. license_tier: ORIGINAL
12import "nx_syscalls.nx"
13import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc)
14import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
15import "nx_x509_trust_store.nx"
16import "nx_trust_store_load_from_certdata.nx"
17import "nx_tls13_client_validate_certificate.nx"
18import "nx_tls13_client_session_run.nx"
19import "nx_https_url_for_fetch.nx"
20import "nx_https_url_connect.nx"
21import "nx_https_get_complete.nx"
22import "nx_https_post_complete.nx"
23import "nx_websocket_client_upgrade.nx" // R2: real WebSocket-101 upgrade over the sovereign TLS session
24const FC_MAGIC_4096: i64 = 4096
25const FC_MAGIC_65536: i64 = 65536
26const FC_MAGIC_16645: i64 = 16645
27const FC_MAGIC_2592000: i64 = 2592000
28const FC_MAGIC_10368000: i64 = 10368000
29const FC_MAGIC_34560000: i64 = 34560000
30const FC_MAGIC_4194304: i64 = 4194304
31const FC_MAGIC_1024: i64 = 1024
32const FC_MAGIC_8192: i64 = 8192
33
34// per-flow socket timeout (SO_RCVTIMEO/SO_SNDTIMEO): a hung TLS handshake or HTTP read must FAIL this flow
35// (-> NO-RESPONSE) instead of blocking the WHOLE monitor, so EVERY downstream flow still gets checked. This is
36// the fix for the diagnosis-blinding hang (home stalled -> video_room never tested). TODO: make per-flow via a
37// 7th funcchecks.conf column if a flow legitimately needs longer.
38const FC_TIMEOUT_S: i64 = 15
39func fc_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
40// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch
41// buffer per call and never freed it -- 4096B leaked PER CALL at page granularity,
42// the defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M
43// calls). nxi_* is MSB-first, allocates NOTHING, emits identical bytes incl. sign.
44func fc_putn(v: i64) -> i64 { nxi_out(v); return 0 }
45func fc_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
46func fc_atoi(s: *u8) -> i64 { var v: i64=0; var i: i64=0; while s[i]!=(0 as u8){ let c: i64=s[i] as i64; if c>=48 { if c<=57 { v=v*10+(c-48) } } i=i+1 } return v }
47func fc_contains(hay: *u8, n: i64, needle: *u8) -> i64 {
48 let nl: i64 = fc_strlen(needle); if nl==0 {return 1}
49 var i: i64=0
50 while i+nl<=n { var j: i64=0; var ok: i64=1; while j<nl { if hay[i+j]!=needle[j]{ok=0;j=nl} else {j=j+1} } if ok==1{return 1} i=i+1 }
51 return 0 }
52func fc_eol(b: *u8, n: i64, st: i64) -> i64 { var i: i64=st; while i<n { if (b[i] as i64)==10 {return i} i=i+1 } return n }
53func fc_split_pipe(b: *u8, ls: i64, le: i64, offs: *i64, lens: *i64, maxf: i64) -> i64 {
54 var nf: i64=0; var st: i64=ls; var i: i64=ls
55 while i < le { if (b[i] as i64)==124 { if nf<maxf { offs[nf]=st; lens[nf]=i-st; nf=nf+1 } st=i+1 } i=i+1 }
56 if nf<maxf { offs[nf]=st; lens[nf]=le-st; nf=nf+1 }
57 return nf }
58func fc_copyz(dst: *u8, src: *u8, off: i64, len: i64) -> i64 { var i: i64=0; while i<len{dst[i]=src[off+i];i=i+1} dst[len]=0 as u8; return len }
59// append helpers for the persisted status line (knowledge/status/funcheck.log) -- the census/keep-up loop
60// reads the LAST line; one assembled buffer -> ONE sys_write (O_APPEND, no tearing; single-writer runs).
61func fcl_apps(b: *u8, n: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){b[n+i]=s[i];i=i+1} return n+i }
62func fcl_appn(b: *u8, n: i64, v: i64) -> i64 {
63 let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}
64 var i: i64=0; var p: i64=n; while i<k{b[p]=t[k-1-i];p=p+1;i=i+1} return p }
65
66// R2: WebSocket-101 upgrade probe over an ESTABLISHED TLS-1.3 session. Sends a real RFC-6455 upgrade
67// request (Sec-WebSocket-Key etc.), reads the response headers, validates 101 + Sec-WebSocket-Accept.
68// Composes the client-upgrade byte builder/validator (nx_ws_client_*) + the SAME record encrypt/decrypt
69// glue nx_https_get_complete uses (client_app keys to send, server_app keys to read). Returns NX_WSCU_OK
70// or an NX_WSCU_* failure code. This is what a status-code check is BLIND to: a room that 200s its static
71// shell but does NOT actually accept a WebSocket upgrade = the "not enterable" false-green.
72func fc_ws_probe(s: *Tls13ClientSession, fd: i64, host: *u8, hlen: i64, path: *u8, plen: i64) -> i64 {
73 let req: *u8 = sys_mmap(FC_MAGIC_4096)
74 let key24: *u8 = sys_mmap(32)
75 let rn: i64 = nx_ws_client_build_request(req, FC_MAGIC_4096, host, hlen, path, plen, 443, 0, key24)
76 if rn < 0 { return NX_WSCU_KEY_TOO_BIG }
77 // encrypt the upgrade request as one application_data record + write it (client_app keys)
78 let rec_buf: *u8 = sys_mmap(rn + 64)
79 let header_out: *u8 = rec_buf
80 let ct_out: *u8 = ((rec_buf as i64) + NX_TLS13_RECORD_HEADER_LEN) as *u8
81 let tag_out: *u8 = ((rec_buf as i64) + NX_TLS13_RECORD_HEADER_LEN + rn + 1) as *u8
82 let ev: i64 = nx_tls13_record_encrypt_v2(s.cipher_suite, s.client_app_traffic_key, s.client_app_iv, s.client_app_seq, req, rn, NX_TLS13_CT_APPLICATION_DATA, 0, header_out, ct_out, tag_out)
83 s.client_app_seq = s.client_app_seq + 1
84 if ev != NX_TLS13_REC_VERDICT_OK { return NX_WSCU_WRITE_FAIL }
85 let total: i64 = NX_TLS13_RECORD_HEADER_LEN + rn + 1 + NX_TLS13_RECORD_TAG_LEN
86 var woff: i64 = 0
87 while woff < total { let w: i64 = sys_write(fd, ((rec_buf as i64) + woff) as *u8, total - woff); if w <= 0 { return NX_WSCU_WRITE_FAIL } woff = woff + w }
88 // read + decrypt response records (server_app keys) until the header terminator (a 101 has no body)
89 let resp: *u8 = sys_mmap(FC_MAGIC_65536)
90 var acc: i64 = 0
91 let rec_in: *u8 = sys_mmap(FC_MAGIC_16645)
92 let pt: *u8 = sys_mmap(FC_MAGIC_16645)
93 let ctp: *i64 = sys_mmap(16) as *i64
94 let lenp: *i64 = sys_mmap(16) as *i64
95 var go: i64 = 1
96 while go == 1 {
97 let rt: i64 = nx_tls13_read_record_from_fd(fd, rec_in, FC_MAGIC_16645)
98 if rt < 0 { go = 0 } else {
99 let ct_len: i64 = rt - NX_TLS13_RECORD_HEADER_LEN - NX_TLS13_RECORD_TAG_LEN
100 let tag: *u8 = ((rec_in as i64) + rt - NX_TLS13_RECORD_TAG_LEN) as *u8
101 let dv: i64 = nx_tls13_record_decrypt_v2(s.cipher_suite, s.server_app_traffic_key, s.server_app_iv, s.server_app_seq, rec_in, ((rec_in as i64) + NX_TLS13_RECORD_HEADER_LEN) as *u8, ct_len, tag, pt, ctp, lenp)
102 s.server_app_seq = s.server_app_seq + 1
103 if dv != NX_TLS13_REC_VERDICT_OK { return NX_WSCU_READ_FAIL }
104 if ctp[0] == NX_TLS13_CT_APPLICATION_DATA {
105 var i: i64 = 0
106 while i < lenp[0] { if acc < FC_MAGIC_65536 { resp[acc] = pt[i]; acc = acc + 1 } i = i + 1 }
107 if _wscu_find_header_end(resp, acc) >= 0 { go = 0 }
108 }
109 if ctp[0] == NX_TLS13_CT_ALERT { go = 0 }
110 }
111 }
112 return nx_ws_client_validate_response(resp, acc, key24)
113}
114
115// DISCRIMINATE cert-expiry from a generic handshake fail: re-connect + retry the handshake with `now`
116// BACKDATED by back_seconds. If it then SUCCEEDS, the cert was valid in the past but not now = EXPIRED
117// (or clock skew) -- the ONLY thing that changed is the validity-window check (ctx.now_epoch). Reuses the
118// exact connect+session machinery; no cert parsing, no shared-stack change. Returns 1 if the backdated
119// handshake succeeds. Runs ONLY on an already-failing flow, so the extra handshake cost is bounded.
120func fc_diag_expiry(store: *TrustStore, url: *u8, back_seconds: i64) -> i64 {
121 let cr: *u8 = sys_mmap(32); var i: i64=0; while i<32{cr[i]=(0xC0+i) as u8;i=i+1}
122 let priv: *u8 = sys_mmap(32); i=0; while i<32{priv[i]=(0xA0+i) as u8;i=i+1}
123 let url_p: *NxUrl = nx_url_new()
124 let target_raw: *u8 = sys_mmap(32)
125 let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
126 target.url = url_p; target.port = 0
127 if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { return 0 }
128 let fd_p: *i64 = sys_mmap(16) as *i64
129 if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK { return 0 }
130 let fd: i64 = *fd_p
131 sys_set_socket_timeout(fd, FC_TIMEOUT_S)
132 let host: *u8 = url + target.url.host_off
133 let hlen: i64 = target.url.host_len
134 let vc_raw: *u8 = sys_mmap(128)
135 let vc: *TlsValidationContext = vc_raw as *TlsValidationContext
136 vc.store = store; vc.sni_host = host; vc.sni_host_len = hlen
137 vc.now_epoch = sys_now_realtime_sec() - back_seconds
138 let sr: i64 = nx_tls13_client_session_run(fd, host, hlen, cr, priv, vc)
139 sys_close(fd)
140 if sr > 0 { return 1 }
141 return 0
142}
143
144// extract a same-host (leading '/') Location header value into out (NUL-term); returns len or 0.
145func fc_hdr_location(buf: *u8, n: i64, out: *u8) -> i64 {
146 let key: *u8 = "Location:" as *u8
147 let kl: i64 = 9
148 var i: i64 = 0
149 while i + kl < n {
150 var m: i64 = 1; var j: i64 = 0
151 while j < kl { if buf[i+j] != key[j] { m=0; j=kl } else { j=j+1 } }
152 if m==1 {
153 var p: i64 = i + kl
154 var go: i64 = 1
155 while go==1 { if p<n { if buf[p]==(32 as u8) { p=p+1 } else { go=0 } } else { go=0 } }
156 if p < n { if buf[p]==(47 as u8) {
157 var o: i64 = 0
158 var go2: i64 = 1
159 while go2==1 { if p<n { let c: i64 = buf[p] as i64; if c==13 { go2=0 } else { if c==10 { go2=0 } else { out[o]=buf[p]; o=o+1; p=p+1 } } } else { go2=0 } }
160 out[o]=0 as u8
161 return o
162 } }
163 return 0
164 }
165 i = i + 1
166 }
167 return 0
168}
169
170// run ONE check. returns 1 pass / 0 fail; prints the verdict + the failure MODE.
171// parse a dotted-ipv4 string into packed BE, or 0 if not a valid quad (so "" / garbage -> DNS path).
172func fc_parse_ip(s: *u8) -> i64 {
173 var parts: i64=0; var cur: i64=0; var packed: i64=0; var any: i64=0; var i: i64=0
174 var run: i64=1
175 while run==1 {
176 let c: i64 = s[i] as i64
177 if c == 0 { if any==1 { packed=(packed<<8)|cur; parts=parts+1 } run=0 }
178 else { if c == 46 { packed=(packed<<8)|cur; cur=0; parts=parts+1; any=0 }
179 else { if c>=48 { if c<=57 { cur=cur*10+(c-48); any=1 } else { return 0 } } else { return 0 } } }
180 i = i + 1
181 }
182 if parts != 4 { return 0 }
183 return packed
184}
185// TCP-connect to an EXPLICIT packed-BE ipv4 : port. fd in *fd_p; returns 0 ok / -1 fail. Used for the
186// per-row connect-IP override (8th conf column): test a capability SUBDOMAIN's real edge chain by
187// hitting the edge IP directly while the SNI/Host stays the subdomain -- the honest way to monitor a
188// split-horizon/hairpin'd subdomain from the LAN (the sni_router still routes by SNI = the real path).
189func fc_connect_explicit(packed: i64, port: i64, fd_p: *i64) -> i64 {
190 let fd: i64 = sys_socket(2, 1, 0)
191 if fd < 0 { return 0 - 1 }
192 let sa: *u8 = sys_mmap(16)
193 sa[0]=2 as u8; sa[1]=0 as u8
194 sa[2]=((port>>8)&0xff) as u8; sa[3]=(port&0xff) as u8
195 sa[4]=((packed>>24)&0xff) as u8; sa[5]=((packed>>16)&0xff) as u8; sa[6]=((packed>>8)&0xff) as u8; sa[7]=(packed&0xff) as u8
196 var z: i64=8; while z<16 { sa[z]=0 as u8; z=z+1 }
197 if nx_connect_bounded(fd, sa, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); return 0 - 1 }
198 fd_p[0] = fd
199 return 0
200}
201
202func fc_one(store: *TrustStore, name: *u8, method: *u8, url: *u8, path: *u8, expect: *u8, body: *u8, tmo_s: i64, connect_ip: *u8) -> i64 {
203 let cr: *u8 = sys_mmap(32); var i: i64=0; while i<32{cr[i]=(0xC0+i) as u8;i=i+1}
204 let priv: *u8 = sys_mmap(32); i=0; while i<32{priv[i]=(0xA0+i) as u8;i=i+1}
205 let url_p: *NxUrl = nx_url_new()
206 let target_raw: *u8 = sys_mmap(32)
207 let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
208 target.url = url_p; target.port = 0
209 if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { fc_puts(" FAIL " as *u8); fc_puts(name); fc_puts(" -> BAD-URL\n" as *u8); return 0 }
210 let fd_p: *i64 = sys_mmap(16) as *i64
211 let t0: i64 = sys_now_us()
212 // connect-IP override: dotted-quad -> connect to that edge IP directly (SNI/Host stay the URL host,
213 // so the sni_router routes by SNI = the true external path); else normal DNS resolve.
214 var ov_packed: i64 = 0
215 if (connect_ip as i64) != 0 { ov_packed = fc_parse_ip(connect_ip) }
216 if ov_packed != 0 {
217 var oport: i64 = target.port
218 if oport <= 0 { oport = 443 }
219 if fc_connect_explicit(ov_packed, oport, fd_p) != 0 {
220 fc_puts(" FAIL " as *u8); fc_puts(name); fc_puts(" -> CONN-FAIL (edge-ip override; = 'Failed to fetch')\n" as *u8); return 0 }
221 } else {
222 if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK {
223 fc_puts(" FAIL " as *u8); fc_puts(name); fc_puts(" -> CONN-FAIL (TCP connect; = 'Failed to fetch')\n" as *u8); return 0 }
224 }
225 let fd: i64 = *fd_p
226 var tmo: i64 = tmo_s
227 if tmo <= 0 { tmo = FC_TIMEOUT_S } // per-flow timeout (7th conf column); default 15s
228 sys_set_socket_timeout(fd, tmo) // bound the handshake + HTTP read: a hung flow FAILS fast, never blocks downstream flows
229 let host: *u8 = url + target.url.host_off
230 let hlen: i64 = target.url.host_len
231 let vc_raw: *u8 = sys_mmap(64)
232 let vc: *TlsValidationContext = vc_raw as *TlsValidationContext
233 vc.store = store; vc.sni_host = host; vc.sni_host_len = hlen; vc.now_epoch = sys_now_realtime_sec()
234 let sr: i64 = nx_tls13_client_session_run(fd, host, hlen, cr, priv, vc)
235 if sr <= 0 {
236 sys_close(fd)
237 // make the failure ACTIONABLE: is it an EXPIRED cert? (backdated-now retry ladder: 30d/120d/400d)
238 var cexp: i64 = 0
239 if fc_diag_expiry(store, url, FC_MAGIC_2592000) == 1 { cexp = 1 }
240 else { if fc_diag_expiry(store, url, FC_MAGIC_10368000) == 1 { cexp = 1 }
241 else { if fc_diag_expiry(store, url, FC_MAGIC_34560000) == 1 { cexp = 1 } } }
242 fc_puts(" FAIL " as *u8); fc_puts(name)
243 if cexp == 1 { fc_puts(" -> CERT-EXPIRED (TLS cert past notAfter -- renew/reissue) sr=" as *u8) }
244 else { fc_puts(" -> TLS-HANDSHAKE-FAIL sr=" as *u8) }
245 fc_putn(sr); fc_puts("\n" as *u8); return 0 }
246 let session: *Tls13ClientSession = sr as *Tls13ClientSession
247 // @ws ENTERABILITY (R2): a real WebSocket-101 upgrade, not a status code. Catches a room that serves
248 // its shell but does NOT accept a socket = the "not enterable" false-green a GET is blind to.
249 if fc_contains(expect, fc_strlen(expect), "@ws" as *u8) == 1 {
250 let wv: i64 = fc_ws_probe(session, fd, host, hlen, path, fc_strlen(path))
251 let wms: i64 = (sys_now_us() - t0) / 1000
252 sys_close(fd)
253 if wv == NX_WSCU_OK {
254 fc_puts(" PASS " as *u8); fc_puts(name); fc_puts(" (WebSocket 101 upgrade OK) ms=" as *u8); fc_putn(wms); fc_puts("\n" as *u8); return 1 }
255 fc_puts(" FAIL " as *u8); fc_puts(name); fc_puts(" -> WS-UPGRADE-FAIL wscu=" as *u8); fc_putn(wv); fc_puts(" (room not enterable: no 101) ms=" as *u8); fc_putn(wms); fc_puts("\n" as *u8); return 0
256 }
257 let buf: *u8 = sys_mmap(FC_MAGIC_4194304)
258 var rc: i64 = 0
259 if fc_contains(method, fc_strlen(method), "POST" as *u8)==1 {
260 rc = nx_https_post_complete(session, fd, path, fc_strlen(path), host, hlen, "application/x-www-form-urlencoded" as *u8, 33, body, fc_strlen(body), buf, FC_MAGIC_4194304)
261 } else {
262 rc = nx_https_get_complete(session, fd, path, fc_strlen(path), host, hlen, buf, FC_MAGIC_4194304)
263 }
264 let ms: i64 = (sys_now_us() - t0) / 1000
265 sys_close(fd)
266 if rc < 0 { fc_puts(" FAIL " as *u8); fc_puts(name); fc_puts(" -> NO-RESPONSE rc="); fc_putn(rc); fc_puts(" (proxy hang/reset; = 'Failed to fetch') ms="); fc_putn(ms); fc_puts("\n" as *u8); return 0 }
267 // FOLLOW ONE same-host redirect (real browsers do; a monitor that doesn't = false-negative on
268 // canonicalized/clean-URL resources, e.g. /video/embed.html -> 301 -> the served page). GET only.
269 if rc > 12 { if buf[9]==(51 as u8) { if buf[10]==(48 as u8) {
270 let loc: *u8 = sys_mmap(FC_MAGIC_1024)
271 let locn: i64 = fc_hdr_location(buf, rc, loc)
272 if locn > 0 {
273 let fd2p: *i64 = sys_mmap(16) as *i64
274 if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd2p) == NX_HTTPS_CONNECT_OK {
275 let fd2: i64 = *fd2p
276 sys_set_socket_timeout(fd2, tmo)
277 let vc2_raw: *u8 = sys_mmap(128)
278 let vc2: *TlsValidationContext = vc2_raw as *TlsValidationContext
279 vc2.store = store; vc2.sni_host = host; vc2.sni_host_len = hlen; vc2.now_epoch = sys_now_realtime_sec()
280 let sr2: i64 = nx_tls13_client_session_run(fd2, host, hlen, cr, priv, vc2)
281 if sr2 > 0 {
282 let sess2: *Tls13ClientSession = sr2 as *Tls13ClientSession
283 let rc2: i64 = nx_https_get_complete(sess2, fd2, loc, fc_strlen(loc), host, hlen, buf, FC_MAGIC_4194304)
284 sys_close(fd2)
285 if rc2 > 0 { rc = rc2 }
286 } else { sys_close(fd2) }
287 }
288 }
289 } } }
290 // @js ASSET-INTEGRITY mode (200 is the beginning, not the end): a <script>/asset that comes back as
291 // text/html is a JS file served as a 404 HTML page -> the browser's "Uncaught SyntaxError: Unexpected
292 // token '<'". Catch it MECHANICALLY so no human has to open dev-tools. Would have caught the app.js break.
293 if fc_contains(expect, fc_strlen(expect), "@js" as *u8) == 1 {
294 if fc_contains(buf, rc, "text/html" as *u8) == 1 {
295 fc_puts(" FAIL " as *u8); fc_puts(name); fc_puts(" -> JS-AS-HTML (script served text/html = console 'Uncaught SyntaxError: Unexpected token <') " as *u8); fc_putn(rc); fc_puts("B ms=" as *u8); fc_putn(ms); fc_puts("\n" as *u8); return 0 }
296 fc_puts(" PASS " as *u8); fc_puts(name); fc_puts(" (JS asset OK, not HTML) " as *u8); fc_putn(rc); fc_puts("B ms=" as *u8); fc_putn(ms); fc_puts("\n" as *u8); return 1 }
297 if fc_contains(buf, rc, expect)==1 {
298 fc_puts(" PASS " as *u8); fc_puts(name); fc_puts(" ("); fc_putn(rc); fc_puts("B ms="); fc_putn(ms); fc_puts(")\n" as *u8); return 1 }
299 fc_puts(" FAIL " as *u8); fc_puts(name); fc_puts(" -> EXPECT-MISS '"); fc_puts(expect); fc_puts("' absent ("); fc_putn(rc); fc_puts("B ms="); fc_putn(ms); fc_puts(") got1st='" as *u8)
300 var gi: i64 = 0
301 while gi < rc { if gi >= 56 { gi = rc } else { let gc: i64 = buf[gi] as i64; if gc==13 { gi = rc } else { if gc==10 { gi = rc } else { sys_write(1, ((buf as i64)+gi) as *u8, 1); gi = gi + 1 } } } }
302 fc_puts("'\n" as *u8); return 0
303}
304
305func main() -> i64 {
306 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt\x00" as *u8, 512, FC_MAGIC_4194304)
307 if r <= 0 { fc_puts("FUNCHECK: certdata load failed (data/mozilla_certdata.txt)\n" as *u8); return 1 }
308 let store: *TrustStore = r as *TrustStore
309 fc_puts("FUNCHECK functional monitor -- CA=" as *u8); fc_putn(trust_store_count(store)); fc_puts(" (driving REAL user flows over TLS)\n" as *u8)
310 let szb: *i64 = sys_mmap(16) as *i64; szb[0]=0
311 let cfg: *u8 = sys_read_file("knowledge/hosting/funcchecks.conf\x00" as *u8, szb)
312 if (cfg as i64)==0 { fc_puts("FUNCHECK: no knowledge/hosting/funcchecks.conf\n" as *u8); return 1 }
313 let n: i64 = szb[0]
314 let offs: *i64 = sys_mmap(256) as *i64
315 let lens: *i64 = sys_mmap(256) as *i64
316 let nm: *u8=sys_mmap(128); let mt: *u8=sys_mmap(16); let ur: *u8=sys_mmap(FC_MAGIC_1024); let pa: *u8=sys_mmap(FC_MAGIC_1024); let ex: *u8=sys_mmap(512); let bo: *u8=sys_mmap(FC_MAGIC_1024); let tb: *u8=sys_mmap(16)
317 var cur: i64=0; var total: i64=0; var pass: i64=0
318 let lb: *u8 = sys_mmap(FC_MAGIC_4096); var lbn: i64=0 // accumulates " <name>=PASS/FAIL" per flow for the persisted line
319 while cur < n {
320 let le: i64 = fc_eol(cfg, n, cur)
321 var ok_line: i64=1
322 if le<=cur {ok_line=0}
323 if ok_line==1 { if (cfg[cur] as i64)==35 {ok_line=0} }
324 if ok_line==1 {
325 let nf: i64 = fc_split_pipe(cfg, cur, le, offs, lens, 16)
326 if nf>=5 {
327 fc_copyz(nm, cfg, offs[0], lens[0]); fc_copyz(mt, cfg, offs[1], lens[1]); fc_copyz(ur, cfg, offs[2], lens[2])
328 fc_copyz(pa, cfg, offs[3], lens[3]); fc_copyz(ex, cfg, offs[4], lens[4]); bo[0]=0 as u8
329 if nf>=6 { fc_copyz(bo, cfg, offs[5], lens[5]) }
330 var tmo7: i64 = 0
331 if nf>=7 { fc_copyz(tb, cfg, offs[6], lens[6]); tmo7 = fc_atoi(tb) }
332 let cip: *u8 = sys_mmap(64); cip[0]=0 as u8
333 if nf>=8 { fc_copyz(cip, cfg, offs[7], lens[7]) } // 8th col: connect-IP override (edge probe)
334 total = total + 1
335 let r1: i64 = fc_one(store, nm, mt, ur, pa, ex, bo, tmo7, cip)
336 if r1==1 { pass=pass+1 }
337 lbn = fcl_apps(lb, lbn, " " as *u8)
338 lbn = fcl_apps(lb, lbn, nm)
339 if r1==1 { lbn = fcl_apps(lb, lbn, "=PASS" as *u8) } else { lbn = fcl_apps(lb, lbn, "=FAIL" as *u8) }
340 }
341 }
342 cur = le + 1
343 }
344 fc_puts("FUNCHECK RESULT pass=" as *u8); fc_putn(pass); fc_puts("/" as *u8); fc_putn(total); fc_puts("\n" as *u8)
345 // persist ONE status line (epoch + per-flow results + verdict) -> knowledge/status/funcheck.log so the
346 // rival census's LIVE axis + the keep-up loop consume a durable, freshness-checkable record (not stdout).
347 let bb: *u8 = sys_mmap(FC_MAGIC_8192); var bn: i64=0
348 bn = fcl_apps(bb, bn, "FUNCHECK epoch=" as *u8)
349 bn = fcl_appn(bb, bn, sys_now_realtime_sec())
350 bn = fcl_apps(bb, bn, " pass=" as *u8)
351 bn = fcl_appn(bb, bn, pass)
352 bn = fcl_apps(bb, bn, "/" as *u8)
353 bn = fcl_appn(bb, bn, total)
354 var li: i64=0
355 while li < lbn { bb[bn]=lb[li]; bn=bn+1; li=li+1 }
356 if pass==total { bn = fcl_apps(bb, bn, " verdict=GREEN" as *u8) } else { bn = fcl_apps(bb, bn, " verdict=RED" as *u8) }
357 bb[bn]=10 as u8; bn=bn+1
358 let lf: i64 = sys_openat_append("knowledge/status/funcheck.log" as *u8, 0x1a4)
359 if lf>=0 { sys_write(lf, bb, bn); sys_close(lf) }
360 if pass==total { fc_puts("FUNCHECK GREEN -- every user flow validated end-to-end\n" as *u8); return 0 }
361 fc_puts("FUNCHECK RED -- a real user flow is BROKEN (see the FAIL lines + failure MODE above)\n" as *u8)
362 return 1
363}