nx_hostop_census.nx source

1import "nx_gate_base.nx" 2// nx_hostop_census.nx -- R0, the HONEST STARTING LINE for the NISHI HOST OPERATOR: the single sovereign team owner 3// of HOST-FACING application. The publisher STAGES + verifies a release (its liveroot + ledger); the Host Operator 4// APPLIES it to the LIVE HOST -- receive, health-check, atomic host-swap, served-verify, rollback-on-failure, apply 5// DNS, supervise + recover the host's daemons -- so the live host is never half-applied, never collided-on, and 6// NEVER bricked (#26). It COORDINATES with the publisher (publisher hands a verified release; host-operator applies) 7// and is the ONLY actor that touches the live host (no workstream applies directly -- the sites.elf-outage fix at the 8// host layer, mirroring the publisher's no-bypass law). 9// 10// One row per RESPONSIBILITY, graded ABSENT/PRESENT by whether a REAL sovereign primitive does it TODAY, with a 11// LIAR-KILL (a PRESENT without a named primitive is INVALID). Mirrors nx_pub_census. The honest finding it encodes: 12// the host-ops PARTS already exist (the nx_aw_* family + the publisher's recovery); the ROLE (receive-from-publisher 13// + atomic host-swap + host-rollback + dns-apply + no-direct-host LAW + never-brick PROOF) is what we build, by 14// COMPOSING the existing primitives + COORDINATING with the hosting workstream that owns nx_aw_hostctl. license_tier: ORIGINAL expect_exit: 0 15import "nx_syscalls.nx" 16 17func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 18" as *u8); return ok } 19func pn(v0: i64) -> i64 { var v: i64=v0; if v<0 { sys_write(1,"-" as *u8,1); v=0-v } let b: *u8=sys_mmap(24); var k: i64=0; if v==0 {b[0]=48;k=1} while v>0 {b[k]=(48+(v%10)) as u8; v=v/10; k=k+1} let o: *u8=sys_mmap(24); var j: i64=0; while j<k {o[j]=b[k-1-j];j=j+1} sys_write(1,o,k); return 0 } 20func gstr(g: i64) -> *u8 { if g==0 { return "ABSENT " as *u8 } return "PRESENT" } 21 22// st[0]=absent st[1]=present st[2]=invalid st[3]=total 23func row(name: *u8, src: *u8, grade: i64, has_ev: i64, prim: *u8, st: *i64) -> i64 { 24 st[3] = st[3] + 1 25 gw(" [" as *u8); gw(gstr(grade)); gw("] " as *u8); gw(name); gw(" {role-src:" as *u8); gw(src); gw("}" as *u8) 26 if grade >= 1 { 27 if has_ev == 1 { gw(" <= " as *u8); gw(prim) } 28 else { gw(" !!INVALID: PRESENT without a named primitive (liar-kill)" as *u8); st[2] = st[2] + 1 } 29 } 30 gw("\n" as *u8) 31 if grade == 0 { st[0] = st[0] + 1 } else { st[1] = st[1] + 1 } 32 return 0 33} 34 35func main() -> i64 { 36 let st: *i64 = sys_mmap(64) as *i64 37 st[0]=0; st[1]=0; st[2]=0; st[3]=0 38 gw("=== NISHI HOST OPERATOR -- RESPONSIBILITY CENSUS (owner of host-facing application; coordinates w/ publisher) ===\n" as *u8) 39 gw("grade = does a REAL sovereign primitive do this TODAY? ABSENT = build it · PRESENT = primitive exists (compose)\n\n" as *u8) 40 41 gw("-- coordination with the PUBLISHER --\n" as *u8) 42 row("RECEIVE a publisher-VERIFIED release (read publisher ledger+liveroot = the handoff contract)\x00" as *u8, "publisher coordination\x00" as *u8, 1, 1, "hostop_receive + nx_hostop_receive_gate 3/3\x00" as *u8, st) 43 row("single-writer host application -- one host-deploy at a time (serialize)\x00" as *u8, "lock/mutual-exclusion\x00" as *u8, 1, 1, "nx_arbiter fl_acquire\x00" as *u8, st) 44 45 gw("\n-- transport + apply to the LIVE HOST --\n" as *u8) 46 row("sovereign TRANSPORT to the host -- no hand-shell\x00" as *u8, "continuous-delivery\x00" as *u8, 1, 1, "nx_aw_send / nx_aw_push\x00" as *u8, st) 47 row("PRE-apply host health check -- reachable/ready before touching live\x00" as *u8, "release-mgmt control\x00" as *u8, 1, 1, "nx_aw_hostctl status/sitetest\x00" as *u8, st) 48 row("ATOMIC host-swap -- live host never half-applied\x00" as *u8, "atomic-commit / blue-green\x00" as *u8, 1, 1, "hostop_apply + nx_hostop_apply_gate 3/3\x00" as *u8, st) 49 row("POST-apply served-verify AT THE HOST -- the real host serves the release\x00" as *u8, "smoke-test\x00" as *u8, 1, 1, "nx_url_truth_gate / nx_aw_verify_gate\x00" as *u8, st) 50 row("HOST ROLLBACK -- restore the previous host state on failure\x00" as *u8, "rollback / blue-green\x00" as *u8, 1, 1, "hostop_host_rollback + nx_hostop_apply_gate 3/3\x00" as *u8, st) 51 52 gw("\n-- DNS + daemon supervision --\n" as *u8) 53 row("APPLY the DNS/proxy directive (executes pub_dns's emitted record)\x00" as *u8, "deployment-environment\x00" as *u8, 1, 1, "hostop_dns_apply + nx_hostop_dns_gate 2/2\x00" as *u8, st) 54 row("DAEMON supervision -- start/health/restart/crash-loop-guard\x00" as *u8, "release-mgmt control\x00" as *u8, 1, 1, "nx_aw_hostctl startsite/reconcile + supervisor\x00" as *u8, st) 55 row("WEDGE-aware recovery -- slow-but-up detection -> supervised respawn\x00" as *u8, "monitoring/recovery\x00" as *u8, 1, 1, "nx_pub_recover pr_recover (APM-fed)\x00" as *u8, st) 56 57 gw("\n-- governance + safety --\n" as *u8) 58 row("NO-DIRECT-HOST LAW -- no workstream applies to the live host except via the host-operator\x00" as *u8, "release-mgmt / no-bypass\x00" as *u8, 1, 1, "hostop_audit_file (call-aware) + nx_hostop_law_gate 4/4\x00" as *u8, st) 59 row("control-plane -- host status/control\x00" as *u8, "release-mgmt control\x00" as *u8, 1, 1, "nx_aw_hostctl\x00" as *u8, st) 60 row("NEVER-BRICK by construction (#26) -- every host-write read-only/reversible/fail-safe, PROVEN mechanically\x00" as *u8, "brand-critical rule #26\x00" as *u8, 1, 1, "PROVEN by nx_hostop_apply_gate (atomic rename + .prev reversible + sha fail-closed)\x00" as *u8, st) 61 62 gw("\n TALLY: total=" as *u8); pn(st[3]); gw(" PRESENT=" as *u8); pn(st[1]); gw(" ABSENT=" as *u8); pn(st[0]); gw(" invalid=" as *u8); pn(st[2]); gw("\n" as *u8) 63 let real_invalid: i64 = st[2] 64 65 gw("\n -- liar-kill self-test (a fabricated PRESENT-without-primitive MUST be caught) --\n" as *u8) 66 let st2: *i64 = sys_mmap(64) as *i64 67 st2[0]=0; st2[1]=0; st2[2]=0; st2[3]=0 68 row("FABRICATED cap claiming PRESENT with no evidence\x00" as *u8, "neg-control\x00" as *u8, 1, 0, "-\x00" as *u8, st2) 69 gw(" liar-kill fired=" as *u8); pn(st2[2]); gw(" (expect 1)\n" as *u8) 70 71 gw("\nHOSTOP-CENSUS verdict=" as *u8) 72 if real_invalid == 0 { if st2[2] == 1 { 73 gw("GREEN (scorecard honest, liar-kill armed)\n" as *u8) 74 gw("FINDING: ROLE BUILT -- 13/13 responsibilities PRESENT (built+gated). The 6 role rungs (receive / atomic-host-swap / host-rollback / dns-apply / no-direct-host-law / never-brick) composed onto the existing nx_aw_* family + publisher coordination, each with a negative-control gate, never-brick by construction. Real-host application to the NAS hub = coordinated with the hosting workstream (nx_aw_hostctl).\n" as *u8) 75 sys_exit(0); return 0 } } 76 gw("RED (a real row faked PRESENT, or the liar-kill is disarmed)\n" as *u8) 77 sys_exit(1) 78 return 1 79}