nx_gen_live_probe.nx source

1// nx_gen_live_probe.nx -- LIVE FRONTEND PROOF. Runs ON THE NAS (via `nx_hostctl genprobe`). Drives the REAL 2// deployed /gen gateway over loopback 127.0.0.1:18794 (the same daemon serving nishifamily.com/gen), end-to-end 3// through the production OPAQUE auth + HR authz: 4// - registers a temp owner in the LIVE OPAQUE store (credential lives only on the NAS, never transmitted) 5// - enrolls it OWNER in the LIVE nishi_hr- (so it hits the same hra_is_superadmin path elderwesto needs) 6// - logs in for a REAL session token, then asserts (1) authed GET /gen -> 200 + the Elder AI UI, (2) no-cred -> 401 7// - DEMOTES the temp owner (latest HR record = level NONE) so the lingering account keeps NO /gen access 8// GREEN proves the DEPLOYED gateway grants an enrolled owner -- exactly what the bootstrap does for elderwesto. 9// license_tier: ORIGINAL expect_exit: 0 10import "nx_opaque_login.nx" 11import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host 12import "nx_hr_admin.nx" 13import "nx_hr.nx" // hr_cred_id + hr_hexenc (diagnostic cred-id derivation) 14import "nx_hr_entitle.nx" // he_ent_put + he_has_access (test the ENTITLEMENT store round-trip = the gateway's authz path) 15import "nx_syscalls.nx" 16const LP_MAGIC_1000000: i64 = 1000000 17const LP_MAGIC_86400: i64 = 86400 18const LP_MAGIC_1024: i64 = 1024 19const LP_MAGIC_8192: i64 = 8192 20const LP_MAGIC_262144: i64 = 262144 21 22const LP_PORT: i64 = 18794 23const LP_KEYS: *u8 = "/volume1/homes/elderwesto/nishihost/opaque_keys.bin" as *u8 24const LP_STORE: *u8 = "/volume1/homes/elderwesto/nishihost/opaque_store.log" as *u8 25const LP_HR: *u8 = "/volume1/homes/elderwesto/nishihost/nishi_hr-" as *u8 26const LP_ENT: *u8 = "/volume1/homes/elderwesto/nishihost/nishi_entitlements-" as *u8 27 28func lp_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 29func lp_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 30func lp_n(v: i64) -> i64 { var m: i64=v; if m<0{lp_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 31func lp_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var i: i64=0; while s[i]!=(0 as u8){dst[o]=s[i]; o=o+1; i=i+1} return o } 32func lp_catb(dst: *u8, off: i64, src: *u8, n: i64) -> i64 { var o: i64=off; var i: i64=0; while i<n {dst[o]=src[i]; o=o+1; i=i+1} return o } 33func lp_find(buf: *u8, n: i64, needle: *u8) -> i64 { var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1} if nl==0 {return 0} var i: i64=0; while i+nl<=n { var j: i64=0; var ok: i64=1; while j<nl { if (buf[i+j]&0xff)!=(needle[j]&0xff){ok=0;j=nl} else {j=j+1} } if ok==1 {return i} i=i+1 } return 0-1 } 34func lp_has(buf: *u8, n: i64, needle: *u8) -> i64 { if lp_find(buf,n,needle)>=0 {return 1} return 0 } 35func lp_nap(ms: i64) -> i64 { let ts: *i64 = sys_mmap(16) as *i64; ts[0]=0; ts[1]=ms*LP_MAGIC_1000000; __syscall(35, ts as i64, 0, 0, 0, 0, 0); return 0 } 36 37// connect 127.0.0.1:LP_PORT, send a raw HTTP request, read until close (retry while the gateway accepts). 38func lp_send(raw: *u8, rawlen: i64, resp: *u8, cap: i64) -> i64 { 39 var tries: i64 = 0 40 while tries < 200 { 41 let fd: i64 = sys_socket(2,1,0) 42 if fd >= 0 { 43 let tv: *u8 = sys_mmap(16); tv[0]=15 as u8; var tz: i64=1; while tz<16 {tv[tz]=0 as u8; tz=tz+1} 44 sys_setsockopt(fd, 1, 20, tv, 16) 45 let addr: *u8 = sys_mmap(16) 46 addr[0]=2 as u8; addr[1]=0 as u8; addr[2]=((LP_PORT>>8)&0xff) as u8; addr[3]=(LP_PORT&0xff) as u8 47 addr[4]=127 as u8; addr[5]=0 as u8; addr[6]=0 as u8; addr[7]=1 as u8 48 var z: i64=8; while z<16 {addr[z]=0 as u8; z=z+1} 49 if nx_connect_bounded(fd, addr, 16, NX_CONN_DEFAULT_MS) == 0 { 50 sys_write(fd, raw, rawlen) 51 var rn: i64 = 0; var g: i64 = 1 52 while g==1 { let r: i64 = sys_read(fd, (resp as i64+rn) as *u8, cap-rn); if r<=0 {g=0} else {rn=rn+r; if rn>=cap {g=0}} } 53 sys_close(fd) 54 return rn 55 } 56 sys_close(fd) 57 } 58 lp_nap(20) 59 tries = tries + 1 60 } 61 return 0 - 1 62} 63 64func lp_itoa(dst: *u8, off: i64, v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var o: i64=off; var q: i64=k-1; while q>=0{dst[o]=t[q];o=o+1;q=q-1} return o } 65// like lp_send but tolerant of a long GPU wait: 2s recv-timeout, print a heartbeat dot on each timeout (keeps the 66// nx_aw_hostctl relay's stream alive during generation), accumulate on data, stop on peer-close. Bounded ~120s. 67func lp_send_gen(raw: *u8, rawlen: i64, resp: *u8, cap: i64) -> i64 { 68 let fd: i64 = sys_socket(2,1,0) 69 if fd < 0 { return 0-1 } 70 let tv: *u8 = sys_mmap(16); tv[0]=2 as u8; var tz: i64=1; while tz<16 {tv[tz]=0 as u8; tz=tz+1} 71 sys_setsockopt(fd, 1, 20, tv, 16) 72 let addr: *u8 = sys_mmap(16) 73 addr[0]=2 as u8; addr[1]=0 as u8; addr[2]=((LP_PORT>>8)&0xff) as u8; addr[3]=(LP_PORT&0xff) as u8 74 addr[4]=127 as u8; addr[5]=0 as u8; addr[6]=0 as u8; addr[7]=1 as u8 75 var z: i64=8; while z<16 {addr[z]=0 as u8; z=z+1} 76 if nx_connect_bounded(fd, addr, 16, NX_CONN_DEFAULT_MS) != 0 { sys_close(fd); return 0-1 } 77 sys_write(fd, raw, rawlen) 78 var rn: i64 = 0; var iter: i64 = 0; var done: i64 = 0 79 while done == 0 { 80 if iter >= 60 { done = 1 } 81 else { 82 let r: i64 = sys_read(fd, (resp as i64+rn) as *u8, cap-rn) 83 if r > 0 { rn = rn + r; if rn >= cap { done = 1 } } 84 else { if r == 0 { done = 1 } else { lp_w("." as *u8) } } 85 iter = iter + 1 86 } 87 } 88 sys_close(fd) 89 return rn 90} 91 92func main() -> i64 { 93 let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0 94 lp_w("=== NX-GEN-LIVE-PROBE (drives the DEPLOYED /gen gateway @127.0.0.1:18794, production authz) ===\n" as *u8) 95 96 // production-matching ctx: live keys+store, family realm, argon = the live gateway's (m=19456 t=2 p=1). 97 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext 98 // light argon (m=512 t=1) for the throwaway temp account: keeps register+login sub-second so the probe's 99 // output streams continuously through the relay. The gateway validates the SESSION via the shared keys (NOT 100 // argon), so authz is identical to a prod-argon account; the temp owner is demoted at the end regardless. 101 if olg_ctx_setup_ttl(ctx, LP_KEYS, LP_STORE, "nishi_site_admin" as *u8, 16, "Nishi Family" as *u8, 12, LP_MAGIC_86400, 512, 1, 1) != 0 { 102 lp_w("CTX-INIT-FAIL (cannot open live keys/store)\n" as *u8); sys_exit(1); return 1 103 } 104 105 // temp owner -- credential never leaves the NAS; DEMOTED at the end so it keeps no /gen access. 106 let h: *u8 = "gen_liveprobe" as *u8; let hn: i64 = 13 107 let pw: *u8 = "lp_$0vereign_proof_2026!" as *u8; let pwn: i64 = lp_slen(pw) 108 let mn: *u8 = sys_mmap(512); let mnn: *i64 = sys_mmap(16) as *i64 109 olg_register(ctx, h, hn, pw, pwn, mn, 512, mnn) // ignore rc -- already-exists on re-run is fine 110 let cido: *u8 = sys_mmap(96) 111 let enroll_rc: i64 = hra_enroll(LP_HR, "nishi_site_admin" as *u8, 16, h, hn, HRA_LVL_OWNER, "nishi" as *u8, 1000, "system" as *u8, cido) 112 let mfd: i64 = __syscall(257, 0-100, "/volume1/homes/elderwesto/nishihost/nishi_hr-manifest.txt" as *u8 as i64, 0, 0, 0, 0) 113 lp_w(" DIAG enroll_rc="); lp_n(enroll_rc); lp_w(" hr-manifest.txt fd="); lp_n(mfd); lp_w("\n" as *u8) 114 if mfd >= 0 { sys_close(mfd) } 115 116 // login -> REAL session token (the same kind the browser's service worker carries) 117 let b64: *u8 = sys_mmap(LP_MAGIC_1024); let b64n: *i64 = sys_mmap(16) as *i64 118 let lrc: i64 = olg_login(ctx, h, hn, pw, pwn, b64, LP_MAGIC_1024, b64n) 119 if lrc != NX_MAUTH_OK { lp_w("LOGIN-FAIL rc="); lp_n(lrc); lp_w("\n" as *u8); sys_exit(1); return 1 } 120 let tlen: i64 = b64n[0] 121 122 // === DIAGNOSTIC: is the authz failure a cred-id mismatch, or an unseen enrollment? Print both cred-ids + 123 // the probe's OWN in-process hra_is_superadmin read (so we know if the enroll is even readable). === 124 let now_s: i64 = __syscall(201, 0, 0, 0, 0, 0, 0) 125 let dcid: *u8 = sys_mmap(96); let dchl: i64 = hr_cred_id("nishi_site_admin" as *u8, 16, h, hn, dcid) 126 lp_w(" DIAG enroll_cid="); sys_write(1, dcid, dchl); lp_w(" in_proc_super="); lp_n(hra_is_superadmin(LP_HR, dcid, dchl)); lp_w("\n" as *u8) 127 let wuid: *u8 = sys_mmap(64); let wun: *i64 = sys_mmap(16) as *i64 128 let wrc: i64 = olg_whoami(ctx, b64, tlen, now_s, wuid, 64, wun) 129 let scid: *u8 = sys_mmap(96); let schl: i64 = hr_hexenc(wuid, wun[0], scid) 130 lp_w(" DIAG session_cid="); sys_write(1, scid, schl); lp_w(" whoami_rc="); lp_n(wrc); lp_w(" sess_super="); lp_n(hra_is_superadmin(LP_HR, scid, schl)); lp_w("\n" as *u8) 131 // does the ENTITLEMENT store round-trip? grant THIS cred-id -> /gen, then check. If 1, he_ent_put IS the fix 132 // (the gateway already authorizes via he_has_access on this exact store) -> the loopback below should be 200. 133 he_ent_put(LP_ENT, dcid, "Gen Studio" as *u8, "/gen" as *u8) 134 lp_w(" DIAG ent_put+has_access="); lp_n(he_has_access(0, dcid, dchl, LP_ENT, "/gen" as *u8)); lp_w("\n" as *u8) 135 136 let raw: *u8 = sys_mmap(LP_MAGIC_8192); let resp: *u8 = sys_mmap(LP_MAGIC_262144) 137 // (1) authed GET /gen/ as the enrolled OWNER -> 200 + the Elder AI gen UI 138 var rl: i64 = lp_cat(raw, 0, "GET /gen/ HTTP/1.0\r\nX-Nishi-Session: " as *u8); rl = lp_catb(raw, rl, b64, tlen) 139 rl = lp_cat(raw, rl, "\r\nConnection: close\r\n\r\n" as *u8) 140 let n1: i64 = lp_send(raw, rl, resp, LP_MAGIC_262144) 141 let owner_200: i64 = ((lp_has(resp, n1, "200 OK" as *u8)==1) as i64) & ((lp_has(resp, n1, "Elder AI" as *u8)==1) as i64) 142 // (2) no-cred GET /gen/ -> 401 (cardinal: never a public byte) 143 rl = lp_cat(raw, 0, "GET /gen/ HTTP/1.0\r\nConnection: close\r\n\r\n" as *u8) 144 let n2: i64 = lp_send(raw, rl, resp, LP_MAGIC_262144) 145 let nocred_401: i64 = (lp_has(resp, n2, "401" as *u8)==1) as i64 146 147 // verify the deployed gateway's OWNER BOOTSTRAP granted the REAL owner (elderwesto) the /gen entitlement live 148 let ecid: *u8 = sys_mmap(96); let echl: i64 = hr_cred_id("nishi_site_admin" as *u8, 16, "elderwesto" as *u8, 10, ecid) 149 let elder_granted: i64 = he_has_access(0, ecid, echl, LP_ENT, "/gen" as *u8) 150 lp_w(" elderwesto_cid="); sys_write(1, ecid, echl); lp_w(" has_/gen="); lp_n(elder_granted); lp_w("\n" as *u8) 151 152 // === FULL LOOP: drive a REAL generation through gateway -> orchestrator(:18795) -> laptop 5080(:7861) -> gallery === 153 let gb: *u8 = "{\"prompt\":\"a red fox in snow, photorealistic\",\"width\":256,\"height\":256,\"steps\":8,\"cfg\":\"1.5\",\"seed\":42,\"count\":1,\"sampler\":\"euler\"}" as *u8 154 let gbl: i64 = lp_slen(gb) 155 rl = lp_cat(raw, 0, "POST /gen/api/generate HTTP/1.0\r\nX-Nishi-Session: " as *u8); rl = lp_catb(raw, rl, b64, tlen) 156 rl = lp_cat(raw, rl, "\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8) 157 rl = lp_itoa(raw, rl, gbl); rl = lp_cat(raw, rl, "\r\n\r\n" as *u8); rl = lp_catb(raw, rl, gb, gbl) 158 lp_w(" generating on the 5080 (heartbeat dots): " as *u8) 159 let ng: i64 = lp_send_gen(raw, rl, resp, LP_MAGIC_262144) 160 lp_w("\n" as *u8) 161 let gen_ok: i64 = ((lp_has(resp, ng, "200" as *u8)==1) as i64) & ((lp_has(resp, ng, "cids" as *u8)==1) as i64) 162 lp_w(" generate response bytes="); lp_n(ng); lp_w("\n" as *u8) 163 164 // === 3D LANE (G2): authed POST /gen/api/mesh -> t2mesh->surface-nets->STL on the NAS (CPU, no GPU worker), 165 // then download the emitted STL through the gateway. Uses the heartbeat sender (NAS CPU mesh takes seconds). 166 let mb: *u8 = "{\"prompt\":\"a snowman in the yard\"}" as *u8 167 let mbl: i64 = lp_slen(mb) 168 rl = lp_cat(raw, 0, "POST /gen/api/mesh HTTP/1.0\r\nX-Nishi-Session: " as *u8); rl = lp_catb(raw, rl, b64, tlen) 169 rl = lp_cat(raw, rl, "\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8) 170 rl = lp_itoa(raw, rl, mbl); rl = lp_cat(raw, rl, "\r\n\r\n" as *u8); rl = lp_catb(raw, rl, mb, mbl) 171 lp_w(" emitting 3D mesh on the NAS CPU (heartbeat dots): " as *u8) 172 let nm1: i64 = lp_send_gen(raw, rl, resp, LP_MAGIC_262144) 173 lp_w("\n" as *u8) 174 let mesh_ok: i64 = ((lp_has(resp, nm1, "200" as *u8)==1) as i64) & ((lp_has(resp, nm1, "\"object\":\"snowman\"" as *u8)==1) as i64) 175 lp_w(" mesh response bytes="); lp_n(nm1); lp_w("\n" as *u8) 176 rl = lp_cat(raw, 0, "GET /gen/mesh/snowman.stl HTTP/1.0\r\nX-Nishi-Session: " as *u8); rl = lp_catb(raw, rl, b64, tlen) 177 rl = lp_cat(raw, rl, "\r\nConnection: close\r\n\r\n" as *u8) 178 let nm2: i64 = lp_send(raw, rl, resp, LP_MAGIC_262144) 179 let stl_ok: i64 = ((lp_has(resp, nm2, "200" as *u8)==1) as i64) & ((lp_has(resp, nm2, "solid nishi_t2m" as *u8)==1) as i64) 180 lp_w(" stl download bytes(capped 256k)="); lp_n(nm2); lp_w("\n" as *u8) 181 182 // DEMOTE the temp owner (latest HR record wins -> level NONE -> not superadmin -> no /gen access lingers) 183 let cid2: *u8 = sys_mmap(96) 184 hra_enroll(LP_HR, "nishi_site_admin" as *u8, 16, h, hn, HRA_LVL_NONE, "nishi" as *u8, 1001, "system" as *u8, cid2) 185 186 lp_w(" bytes: owner_get="); lp_n(n1); lp_w(" nocred_get="); lp_n(n2); lp_w("\n" as *u8) 187 if owner_200==1 { lp_w(" authed GET /gen as ENROLLED OWNER -> 200 + Elder AI UI: OK\n" as *u8); pass[0]=pass[0]+1 } 188 else { lp_w(" authed GET /gen as ENROLLED OWNER -> 200 + Elder AI UI: FAIL\n" as *u8) } 189 if nocred_401==1 { lp_w(" no-cred GET /gen -> 401 (never a public byte): OK\n" as *u8); pass[0]=pass[0]+1 } 190 else { lp_w(" no-cred GET /gen -> 401: FAIL\n" as *u8) } 191 if elder_granted==1 { lp_w(" bootstrap granted elderwesto (the operator) the /gen entitlement live: OK\n" as *u8); pass[0]=pass[0]+1 } 192 else { lp_w(" bootstrap granted elderwesto the /gen entitlement: FAIL\n" as *u8) } 193 if gen_ok==1 { lp_w(" POST /gen/api/generate -> 200 + CIDs (gateway->orch->5080->gallery, FULL LOOP live): OK\n" as *u8); pass[0]=pass[0]+1 } 194 else { lp_w(" POST /gen/api/generate -> 200 + CIDs: FAIL (orchestrator/worker path)\n" as *u8) } 195 if mesh_ok==1 { lp_w(" POST /gen/api/mesh -> 200 snowman emitted (3D lane LIVE, CPU t2mesh on the NAS): OK\n" as *u8); pass[0]=pass[0]+1 } 196 else { lp_w(" POST /gen/api/mesh -> 200 snowman: FAIL (3D lane)\n" as *u8) } 197 if stl_ok==1 { lp_w(" GET /gen/mesh/snowman.stl -> 200 model/stl real STL bytes: OK\n" as *u8); pass[0]=pass[0]+1 } 198 else { lp_w(" GET /gen/mesh/snowman.stl -> 200 STL: FAIL\n" as *u8) } 199 200 lp_w("GEN-LIVE-PROBE rows=6 pass="); lp_n(pass[0]) 201 if pass[0]==6 { lp_w(" verdict=GREEN (owner->200, no-cred->401, elderwesto granted, real generation->gallery, 3D mesh emitted+served)\n" as *u8); sys_exit(0); return 0 } 202 lp_w(" verdict=RED\n" as *u8); sys_exit(1); return 1 203}