nx_live_governor.nx source
↩ module page · 49 lines · 2521 B
1// nx_live_governor.nx -- THE NISHI LIVENESS GOVERNOR (grading core).
2//
3// The control plane that ends the "hide and seek / junk drawer": a data-
4// driven catalog of what SHOULD be live (route, expected status, auth
5// class) is probed by the sovereign TLS client (nx_ng_verify_live's
6// pattern), and each result GRADED here against its expectation -> a board
7// of LIVE / BROKEN / WRONG_WALL. Pure, deterministic grading (gated); the
8// live probe + board is the runner. Heal (publisher submit / hostctl
9// restart) is the next rung.
10//
11// THE EXCEED over ad-hoc go-live: liveness is a DECLARED desired-state that
12// is continuously VERIFIED, not a thing someone remembers to check. A
13// public asset hidden behind the login wall, or a walled asset exposed,
14// is caught as WRONG_WALL -- the exact failure class behind a broken hub.
15//
16// genealogy_id: sre_health_check_control_loop + declared_desired_state
17// + nishi_ng_verify_live_probe
18
19import "nx_syscalls.nx"
20
21// ===== verdicts =====
22const NX_LG_LIVE: i64 = 0
23const NX_LG_BROKEN: i64 = 1 // wrong status (404 / redirect-loop / dead backend) or wrong content
24const NX_LG_WRONG_WALL: i64 = 2 // a PUBLIC asset is behind the login wall (or a walled one exposed)
25
26// ===== auth classes (the "right provisions") =====
27const NX_LG_PUBLIC: i64 = 0 // must serve without a login wall
28const NX_LG_WALLED: i64 = 1 // must sit behind the opaque wall (showing the wall IS correct)
29
30// Grade one probe result against its catalogued expectation.
31// got_status : HTTP status our TLS client observed (0 = no response / loop)
32// marker_found : 1 if the expected content marker was present (1 = liveness-only ok)
33// login_wall_found : 1 if the opaque-login wall was present in the body
34func nx_lg_grade(expected_status: i64, expected_auth: i64,
35 got_status: i64, marker_found: i64, login_wall_found: i64) -> i64 {
36 if got_status != expected_status { return NX_LG_BROKEN } // dead backend / 404 / loop
37 if marker_found == 0 { return NX_LG_BROKEN } // wrong / empty content
38 if expected_auth == NX_LG_PUBLIC {
39 if login_wall_found == 1 { return NX_LG_WRONG_WALL } // public asset hidden behind the wall
40 }
41 return NX_LG_LIVE
42}
43
44func nx_lg_verdict_name(v: i64) -> *u8 {
45 if v == NX_LG_LIVE { return "LIVE " as *u8 }
46 if v == NX_LG_BROKEN { return "BROKEN " as *u8 }
47 if v == NX_LG_WRONG_WALL { return "WRONG_WALL" as *u8 }
48 return "UNKNOWN " as *u8
49}