nx_mgmt_cap_candidate_t186.nx source

1// nx_mgmt_api.nx -- THE IO / TRANSPORT ring of the sovereign ecosystem control-plane API (the primary adapter). 2// THIN by design (clean three-tier / hexagonal -- see knowledge/library/arch_*): it owns ONLY transport -- 3// the socket loop, HTTP request parse, routing, JSON serialization, and auth gating. ALL business rules live in 4// the LOGIC core (nx_mgmt_core, mc_*); ALL outside-world access lives in the DATA adapters (nx_mgmt_data, md_*). 5// Dependency direction: api -> {core, data}, data -> core-free, core -> nothing (dependency inversion). The 6// router is a PURE FUNCTION ma_handle(ctx, req, req_n, snapfile, out) -> out_n (bytes in, bytes out, NO socket); 7// the gate drives it IN-PROCESS (no curl/shell). Reuses nx_status_daemon's HTTP-parse + Modern-Auth helpers. 8// 9// TRUE MONITORING (no false +/-): /api/health + /api/services read a live SNAPSHOT (md_read_file) and surface 10// dueling-supervisors / duplicate-instances / crash-loops via the core rules; missing snapshot -> UNKNOWN, 11// never OK. Health/services + all write actions are AUTH-gated; write actions are confirm-gated + fail-closed. 12// 13// Routes (auth = X-Nishi-Session Ed25519 session header, canonical Modern Auth, NO cookies): 14// GET /api -> 200 route index (public) 15// POST /api/login -> 200 {"token":...} | 401 16// GET /api/health -> (auth) 200 {overall,degraded,reasons[...]} | 401 17// GET /api/services -> (auth) 200 {services:[...]} | 401 18// POST /api/upload?target=&seq=&final=[&sha256=] -> (auth) chunked artifact publish; append raw body chunk -> 19// <target>.upload, on final rename -> <target>.new (staged for /api/deploy; NEVER promotes) | 400 | 401 20// POST /api/deploy -> (auth) allowlist+validate->promote->http-health->auto-rollback | 400 | 401 21// POST /api/rollback -> (auth, confirm=yes) | 400 | 401 22// POST /api/reconcile -> (auth, confirm=yes) single-supervisor | 400 | 401 23// POST /api/restart -> (auth, confirm=yes, service=) surgical kick | 400 | 401 24// POST /api/migrate|update -> (auth) 501 reserved (R3b: URL->.site ingest) | 401 25// (any other) -> 404 26// Snapshot line format (the monitor writes; md_* reads): "SUP <n>" / "SVC <name> <port> <state> <procs> <rwin> <rtot>" 27// argv: [1]=port [2]=keysfile [3]=storefile [4]=realm [5]=snapfile [6]=budget. license_tier: ORIGINAL 28import "nx_resource_arbiter.nx" // shared representable-size bound for checked request allocation 29import "nx_status_daemon.nx" 30import "nx_mgmt_cap_data_candidate_t186.nx" 31import "nx_builddeploy_lib.nx" 32import "nx_organkind.nx" // seq1492: ROLE beats NAME for promote/deploy eligibility 33import "nx_mgmt_core.nx" 34import "nx_access_lib.nx" // ag_uid_to_level -- the SHARED access-granting path (session uid -> handle -> level) 35import "nx_os_introspect.nx" // pon_pid_cmdline -- name the port-holder PID the snapshot carries (the os-axis rung) 36import "nx_shard_view.nx" // sv_build_shards_json -- the cross-shard fleet view for /api/shards (CAP-SHARD-VIEW) 37import "nx_srcfresh.nx" // sf_src_stale/sf_lag_sec -- is the gate ELF built from its own source? 38import "nx_fio.nx" // fio_unlink -- canonical sovereign unlinkat (shred a bad/aborted staging file), DRY 39import "nx_sha256.nx" // sha256_digest -- optional integrity check of the reassembled artifact on final chunk 40import "nx_buildecho.nx" // be_after_hex -- lift `closure_sha=` out of nx_closurehash's output. ADDITIVE ONLY (2026-08-08): the inline ma_compiled_name below is deliberately left in place, so this edit cannot change the cross-target guard's behaviour; it only adds a receipt. Bite-proven 9/9 by nx_buildecho_gate. 41import "nx_routeguard_lib.nx" // rg_extract/rg_missing -- the DEPLOY CONTRACT guard: refuse a candidate that DROPS live /api routes (5th regression, id=1785447778). Fail-open by construction. 42import "nx_mgmt_upload.nx" // mu_stage_chunk -- the SHIPPED ordered-chunk write primitive (seq0=truncate, seq>0=append); compose it, don't re-open inline (DRY / retire the orphan) 43import "nx_tool_exec_allow.nx" // tea_sync_promote_ms_from + TEA_WINDOW_CONF/TEA_SRC_CONF -- THE ONE OWNER of the edge deadline pair (knowledge/edge_window.conf). /api/gate_run promotes a still-running gate at (window - reply reserve), the instant the tools-API sync lane already does; DERIVED from the conf, never retyped (2026-08-23, lane J) 44const MA_MAGIC_4096: i64 = 4096 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 45const MA_MAGIC_16384: i64 = 16384 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 46const MA_MAGIC_8192: i64 = 8192 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 47const MA_MAGIC_262144: i64 = 262144 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 48const MA_MAGIC_1024: i64 = 1024 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 49const MA_MAGIC_2048: i64 = 2048 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 50const MA_MAGIC_2046: i64 = 2046 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 51const MA_MAGIC_8190: i64 = 8190 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 52const MA_MAGIC_65536: i64 = 65536 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 53const MA_MAGIC_16380: i64 = 16380 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 54const MA_MAGIC_262140: i64 = 262140 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 55const MA_MAGIC_60000: i64 = 60000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 56const MA_MAGIC_32768: i64 = 32768 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 57const MA_MAGIC_1400: i64 = 1400 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 58const MA_MAGIC_2040: i64 = 2040 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 59const MA_MAGIC_65500: i64 = 65500 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 60const MA_MAGIC_8000: i64 = 8000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 61const MA_MAGIC_16000: i64 = 16000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 62const MA_MAGIC_12000: i64 = 12000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 63const MA_MAGIC_300000: i64 = 300000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 64const MA_MAGIC_4000: i64 = 4000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 65const MA_MAGIC_8180: i64 = 8180 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 66const MA_MAGIC_10000: i64 = 10000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 67const MA_MAGIC_2000000: i64 = 2000000 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 68const MA_MAGIC_1600: i64 = 1600 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 69const MA_MAGIC_20480: i64 = 20480 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 70const MA_MAGIC_86400: i64 = 86400 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 71const MA_MAGIC_19456: i64 = 19456 // NX-UNNAMED: mechanical, collision-free placeholder -- this name RESTATES the value and so carries no meaning. Replace it with a domain term that says WHY, or move the number to a config row. 72 73// ---- ONE NAMED SOURCE FOR THE PROMOTE LEASE TTL (2026-08-20, debt 1787254670) ---------------- 74// It was TWO independent literals: the acquire below passed "300" and the lease-busy refusal advertised 75// retry_after_s:30. An honest caller obeying the advertised backoff re-hit a lock that could not 76// possibly be free for another 270 seconds -- roughly ten wasted round trips per holder, and a retry 77// storm invited by the error message itself. Rule 11: a bound and the advice about that bound must come 78// from the same place, or they drift; this pair had already drifted by 10x and nothing could see it, 79// because neither number was wrong ON ITS OWN. The acquire renders this const to text (nx_lease takes 80// its TTL as argv) and the refusal prints the same const, so they can no longer disagree. 81const MA_PROMOTE_LEASE_TTL_S: i64 = 300 82// THE SAME PAIR, FOUR MORE TIMES, AND THREE OF THEM WORSE. A full-population census of this file 83// (corpus_complete=1) found the build, async-build, deploy and restart lease-busy refusals ALL 84// advertising retry_after_s:30 against TTLs of 600, 600, 600 and 300 -- so the build lanes were 85// TWENTY times short, telling an honest caller to come back nineteen times before the lock can 86// possibly be free. A FIX THAT LIVES IN ONE LANE AND NOT ITS SIBLINGS IS HALF A FIX, AND THE HALF 87// LEFT UNDONE IS INVISIBLE UNTIL SOMEONE IS RETRYING AGAINST IT. 88const MA_BUILD_LEASE_TTL_S: i64 = 600 89const MA_DEPLOY_LEASE_TTL_S: i64 = 600 90const MA_RESTART_LEASE_TTL_S: i64 = 300 91// TS9 ts_retry_after_derived (trafficsafety, 2026-08-30): the wait ADVICE on a lease-busy refusal. 92// The derived-constant half landed earlier (ma_lease_ttl_txt: acquire and refusal read ONE const). 93// Two halves the scalar alone did not give, per the banked Aug-2026 research (RFC 9110 puts no 94// accuracy obligation on Retry-After, so a bare scalar synchronises the herd -- measured on this 95// file's own promote lease; the field-grade mechanism is a DIFFERENT ERROR CLASS, overloaded-do-not- 96// retry, not a better number): 97// (1) at or above TS_NONRETRY_TTL_S the refusal advertises LEASE-HELD-DO-NOT-RETRY and NO wait 98// hint at all -- a lock held for minutes is not a retry situation; the caller queues the work 99// (a deployq row fires via nx_orchestrate on the first pass with headroom) instead of polling 100// a lock that cannot be free sooner. 300 is not tuned: it is the SMALLEST TTL in this file's 101// lease set, so every exclusive lease lands in the do-not-retry class BY CONSTRUCTION; the 102// jitter branch serves any future sub-300s lease honestly rather than being dead code. 103// (2) below the bar the scalar is JITTERED by up to TTL/TS_JITTER_DIV seconds (time-derived -- 104// this estate has no RNG by design), fanning synchronized refusals over a quarter-TTL window. 105const TS_NONRETRY_TTL_S: i64 = 300 106const TS_JITTER_DIV: i64 = 4 107 108const MA_BODYCAP: i64 = 131072 109// UPLOAD PERFORMANCE (scoped full-body read for /api/upload ONLY): the shared nx_http_server_read_request does a 110// SINGLE sys_read, so a chunk body larger than one read (or split across the wire into >1 read) would be TRUNCATED. 111// That capped the client at ~48KB chunks => ~54 handshakes for a 2.6MB artifact (each handshake ~300-400ms off-LAN). 112// This dedicated 2 MiB reassembly buffer lets the /api/upload path carry a MUCH bigger chunk (collapsing ~54 113// handshakes to ~3), WITHOUT touching the shared reader (blast radius = every daemon) and WITHOUT a hang risk: 114// the continue-read is bounded STRICTLY by Content-Length and this cap, and EOF (sys_read<=0) terminates it. A body 115// whose declared Content-Length exceeds this cap is REFUSED (413) -- never a partial-append-then-success. Rule 11: 116// the cap is a named const, not a magic number; Rule 26: still staging-only (ma_do_upload never touches the live artifact). 117const MA_UPLOAD_REQCAP: i64 = 2097152 // 2 MiB -- the scoped upload-request buffer (headers + one big chunk body) 118const MA_UPLOAD_TOOBIG: i64 = 0 - 1 // sentinel: declared Content-Length would overflow MA_UPLOAD_REQCAP -> 413 refuse 119const MA_SHARDS_CONF: *u8 = "/volume1/homes/elderwesto/nishihost/shards.conf" as *u8 // the shard-registry SSOT the control plane reads 120// ACCESS-GRANTING (lined up with the ecosystem, NOT a private mgmt island): the roles registry + uid->handle index 121// are the SAME files the hub gateway reads, so ONE login + ONE roles row (elderwesto=3) grants access everywhere. 122const MA_ROLES: *u8 = "/volume1/ai/hub/roles.tsv" as *u8 123const MA_IDX: *u8 = "/volume1/homes/elderwesto/nishihost/nishi_uid_handle.tsv" as *u8 124const MA_LVL_READ: i64 = 2 // member+ may READ /api/health + /api/services 125const MA_LVL_ACT: i64 = 3 // OPERATOR required for the write actions (deploy/rollback/reconcile/restart) 126// /api/cap/mint tunables (rule-11: every threshold named -- charset/buffer literals stay inline to match the 127// ma_sanitize_* idiom, but the cap lifetime bounds + allow-length cap are real knobs). 128const CM_DAYS_DEFAULT: i64 = 30 // default cap lifetime when `days` is omitted 129const CM_DAYS_MAX: i64 = 730 // 2 years -- upper bound so a mint can't grant a near-eternal cap 130const CM_SECS_PER_DAY: i64 = 86400 // exp = now + days * this 131// Capability content extents derive from validated request bytes; expiry policy is separate. 132 133// ---- response assembly (transport serialization) ---------------------------------------------------- 134 135func ma_emit_json(out: *u8, prefix: *u8, body: *u8, body_n: i64) -> i64 { 136 var o: i64 = sd_cat(out, 0, prefix) 137 o = sd_catn(out, o, body_n) 138 // api-versioning: every response carries the API-Version header (explicit version negotiation, not just a body 139 // field); Vary: Accept declares content-negotiation. Single point so ALL endpoints are covered uniformly. 140 o = sd_cat(out, o, "\r\nAPI-Version: 2\r\nVary: Accept\r\n\r\n" as *u8) 141 var i: i64 = 0 142 while i < body_n { out[o] = body[i]; o = o + 1; i = i + 1 } 143 return o 144} 145 146// content-negotiation: does the request's Accept header ask for text/plain? (index is header-only, so a match can 147// only come from Accept). Server then serves the text representation instead of JSON -> real Accept-driven negotiation. 148func ma_wants_text(req: *u8, req_n: i64) -> i64 { 149 let t: *u8 = "text/plain" as *u8 150 var i: i64 = 0 151 while i + 10 <= req_n { 152 if req[i] == (116 as u8) { 153 var k: i64 = 0 154 while k < 10 { if req[i + k] != t[k] { k = 100 } else { k = k + 1 } } 155 if k == 10 { return 1 } 156 } 157 i = i + 1 158 } 159 return 0 160} 161// ---- THE ONE ROUTE LIST (2026-08-21) -------------------------------------------------------------- 162// MEASURED: this daemon carried TWO hand-maintained route lists -- the plain-text one below and the 163// JSON array clients actually parse (ma_index) -- and they had diverged IN BOTH DIRECTIONS at once: 164// the JSON array was missing /api/promote_toolchain, so a WORKING route (it answers 400, while a real 165// absence answers 404) read as MISSING and cost a full false investigation; and the plain-text list 166// was missing /api/gate_run and /api/proc_kill, which the JSON array had. 167// *TWO HAND-MAINTAINED LISTS OF THE SAME THING WILL DIVERGE, AND NEITHER ONE TELLS YOU WHICH IS STALE. 168// Both emitters now render from THIS literal. Space-separated so the plain-text form IS the literal and 169// the JSON form is one walk of it -- adding a route is ONE edit, and the two can no longer disagree. 170const MA_ROUTES: *u8 = "/api/login /api/health /api/release_identity /api/services /api/upload /api/deploy /api/deploy_status /api/unpack /api/build /api/gate_run /api/proc_kill /api/promote /api/promote_toolchain /api/tools/register /api/cap/mint /api/hostctl /api/promote_content /api/rollback /api/reconcile /api/restart /api/openapi.json /api/migrate /api/update /api/compare/registry /api/compare/upsert /api/compare/regen /api/compare/publish" 171const MA_RT_SP: i64 = 32 // ' ' -- the separator in MA_ROUTES 172const MA_RT_QUOTE: i64 = 34 // '"' -- JSON string delimiter 173const MA_RT_COMMA: i64 = 44 // ',' -- JSON element separator 174const MA_RT_BUF: i64 = 4096 // one index body; MA_ROUTES is ~420 B and the JSON wrapper ~250 B 175// Render MA_ROUTES as JSON array ELEMENTS ("a","b","c") -- the caller supplies the brackets. 176func ma_routes_json(b: *u8, off: i64) -> i64 { 177 var o: i64 = off 178 var i: i64 = 0 179 var first: i64 = 1 180 while MA_ROUTES[i] != (0 as u8) { 181 if MA_ROUTES[i] == (MA_RT_SP as u8) { 182 i = i + 1 183 } else { 184 if first == 0 { b[o] = MA_RT_COMMA as u8; o = o + 1 } 185 first = 0 186 b[o] = MA_RT_QUOTE as u8; o = o + 1 187 var run: i64 = 1 188 while run == 1 { 189 if MA_ROUTES[i] == (0 as u8) { run = 0 } else { 190 if MA_ROUTES[i] == (MA_RT_SP as u8) { run = 0 } else { 191 b[o] = MA_ROUTES[i]; o = o + 1; i = i + 1 192 } 193 } 194 } 195 b[o] = MA_RT_QUOTE as u8; o = o + 1 196 } 197 } 198 return o 199} 200func ma_index_text(out: *u8) -> i64 { 201 let body: *u8 = sys_mmap(MA_RT_BUF) 202 var o: i64 = sd_cat(body, 0, "nishi-mgmt API v2\nspec: /api/openapi.json\nroutes: " as *u8) 203 o = sd_cat(body, o, MA_ROUTES) 204 o = sd_cat(body, o, "\n" as *u8) 205 body[o] = 0 as u8 206 return ma_emit_json(out, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nConnection: close\r\nContent-Length: " as *u8, body, o) 207} 208// NISHI-NATIVE API CONSOLE (NOT swagger/openapi-ui): a fully-sovereign, self-contained console (no CDN, no third-party 209// UI lib) rendered from OUR OWN /api index, surfacing every ecosystem rung -- mgmt API + MCP agent surface (tools/ 210// resources/prompts) + search + the live SOTA critic + SSE + binary RPC. OpenAPI kept only as an interop LINK, not the 211// UI. (nx_cc trap: no '#' or '!' in the literal -> color names, no doctype.) 212func ma_docs(out: *u8) -> i64 { 213 let body: *u8 = "<html><head><meta charset=utf-8><title>Nishi Sovereign API Console</title><style>body{font-family:system-ui;max-width:64em;margin:0 auto;padding:1.5em;background:snow;color:midnightblue}h1{color:seagreen;margin-bottom:.1em}h2{color:seagreen;border-bottom:2px solid mediumseagreen;padding-bottom:.2em;margin-top:1.4em}.sub{color:slategray;margin-top:0}.card{background:white;border:1px solid gainsboro;border-left:4px solid seagreen;border-radius:6px;padding:.6em 1em;margin:.5em 0}code{background:honeydew;color:darkgreen;padding:2px 6px;border-radius:3px}a{color:seagreen}.tag{font-size:.75em;background:mediumseagreen;color:white;padding:1px 7px;border-radius:10px;margin-left:.4em}</style></head><body><h1>Nishi Sovereign API Console</h1><p class=sub>Own TLS 1.3, own auth (OPAQUE + object-capability), never-brick deploys. Zero third-party framework or UI library.</p><h2>Management control plane</h2><div id=routes>loading...</div><h2>Agent surface (MCP)</h2><div class=card><code>POST /mcp</code> <span class=tag>JSON-RPC 2.0</span><br>tools + resources + prompts. Auth: X-Nishi-Cap / Authorization: Bearer / params._cap.</div><div class=card><code>nishi_search</code> / <code>nishi_doc</code><br>sovereign corpus search + document fetch.</div><div class=card><code>nx_ecosystem_maturity_rollup</code> <span class=tag>live</span><br>measured, liar-killed per-domain SOTA grade.</div><div class=card><code>nx_mgmt</code> <span class=tag>admin</span><br>build / deploy / reconcile / restart over the never-brick control plane.</div><h2>Streaming + RPC</h2><div class=card><code>GET /api/events</code> <span class=tag>SSE</span><br>text/event-stream status events (reconnecting).</div><div class=card><code>POST /api/rpc</code> <span class=tag>binary</span><br>sovereign contract-first binary RPC (contract: <a href=/api/rpc.contract>/api/rpc.contract</a>).</div><h2>Machine-readable</h2><div class=card><a href=/api/openapi.json>/api/openapi.json</a> OpenAPI 3.1 for interop &middot; <a href=/api/inventory>/api/inventory</a> versioned artifacts</div><script>fetch('/api').then(function(r){return r.json()}).then(function(s){var h='<p class=sub>version '+s.version+'</p>';var rs=s.routes;for(var i=0;i<rs.length;i++){h+='<div class=card><code>'+rs[i]+'</code></div>'}document.getElementById('routes').innerHTML=h})</script></body></html>" as *u8 214 return ma_emit_json(out, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: " as *u8, body, sd_len(body)) 215} 216// webhooks/SSE: GET /api/events -> text/event-stream. Emits status events then closes; EventSource clients auto- 217// reconnect per the retry hint (fits our single-accept server -- no long-lived hold). Real event-driven delivery. 218func ma_events(out: *u8) -> i64 { 219 var o: i64 = sd_cat(out, 0, "HTTP/1.1 200 OK\r\nContent-Type: text/event-stream\r\nCache-Control: no-cache\r\nConnection: close\r\nAPI-Version: 2\r\n\r\n" as *u8) 220 o = sd_cat(out, o, "retry: 5000\nevent: hello\ndata: {\"api\":\"nishi-mgmt\",\"stream\":\"status\"}\n\n" as *u8) 221 o = sd_cat(out, o, "event: tick\ndata: {\"ts\":" as *u8) 222 o = sd_catn(out, o, sys_now_realtime_sec()) 223 o = sd_cat(out, o, ",\"health\":\"/api/health\",\"deploy_status\":\"/api/deploy_status\",\"inventory\":\"/api/inventory\"}\n\n" as *u8) 224 return o 225} 226// binary emitter (payload may contain NUL -> explicit length, not sd_len). 227func ma_emit_binary(out: *u8, body: *u8, body_n: i64) -> i64 { 228 var o: i64 = sd_cat(out, 0, "HTTP/1.1 200 OK\r\nContent-Type: application/octet-stream\r\nConnection: close\r\nAPI-Version: 2\r\nContent-Length: " as *u8) 229 o = sd_catn(out, o, body_n) 230 o = sd_cat(out, o, "\r\n\r\n" as *u8) 231 var i: i64 = 0 232 while i < body_n { out[o] = body[i]; o = o + 1; i = i + 1 } 233 return o 234} 235// grpc-contract-first: SOVEREIGN binary contract-first RPC. POST /api/rpc body = [u32be method_id][args]; response = 236// [u32be status][payload]. Own framing (not gRPC/HTTP2/protobuf -- deliberate, same sovereignty stance as our TLS). 237func ma_rpc(req: *u8, req_n: i64, out: *u8) -> i64 { 238 let boff: i64 = sd_body_off(req, req_n) 239 let body: *u8 = ((req as i64) + boff) as *u8 240 let body_n: i64 = req_n - boff 241 var method: i64 = 0 242 if body_n >= 4 { method = ((body[0] as i64) << 24) | ((body[1] as i64) << 16) | ((body[2] as i64) << 8) | (body[3] as i64) } 243 let resp: *u8 = sys_mmap(MA_MAGIC_4096) 244 resp[0] = 0 as u8; resp[1] = 0 as u8; resp[2] = 0 as u8; resp[3] = 0 as u8 245 var rn: i64 = 4 246 if method == 1 { 247 let p: *u8 = "PONG" as *u8; var k: i64 = 0; while k < 4 { resp[rn] = p[k]; rn = rn + 1; k = k + 1 } 248 } else { if method == 2 { 249 let p: *u8 = "nishi-mgmt v2" as *u8; var k: i64 = 0; while p[k] != (0 as u8) { resp[rn] = p[k]; rn = rn + 1; k = k + 1 } 250 } else { 251 resp[3] = 1 as u8 252 let p: *u8 = "unknown-method" as *u8; var k: i64 = 0; while p[k] != (0 as u8) { resp[rn] = p[k]; rn = rn + 1; k = k + 1 } 253 } } 254 return ma_emit_binary(out, resp, rn) 255} 256func ma_rpc_contract(out: *u8) -> i64 { 257 let body: *u8 = "{\"rpc\":\"nishi-sovereign-binary-rpc\",\"transport\":\"POST /api/rpc over TLS 1.3\",\"framing\":{\"request\":\"[u32be method_id][args]\",\"response\":\"[u32be status][payload]\"},\"note\":\"sovereign binary contract-first RPC -- own framing, not gRPC/HTTP2/protobuf (same sovereignty stance as our own TLS stack)\",\"methods\":[{\"id\":1,\"name\":\"ping\",\"returns\":\"PONG\"},{\"id\":2,\"name\":\"version\",\"returns\":\"version string\"}]}" as *u8 258 return ma_emit_200(out, body) 259} 260// inventory-mgmt-api9: a versioned inventory of the managed deployable artifacts. Each is never-brick-managed (a 261// staged .new + a rollback .prev), built via /api/build and promoted via /api/deploy; GET /api/deploy_status gives 262// the live version verdict. Public discovery (artifact NAMES only, no secrets). 263// ★★★★★★ DERIVED, NOT DECLARED (R0, 2026-07-31). This list was HAND-AUTHORED and had drifted: it named 264// nx_hub_gw.elf and nx_torrent_gw.elf as "managed deployable artifacts" while deploy_targets.conf -- 265// the allowlist /api/deploy ACTUALLY READS -- contained NEITHER. A caller who trusted this route was 266// told a fix could be landed that could not. Declared coverage overstated real coverage, and only the 267// smaller number was ever true. 268// A DERIVED ARTIFACT MUST NOT BE AUTHORABLE: the moment a summary can be written by hand it can disagree 269// with the thing it summarises. This now reads the SAME FILE the deploy path reads, so the two cannot 270// diverge -- if a row is absent the route says so, which is the honest answer. 271// AN INVENTORY THAT OVERSTATES COVERAGE IS WORSE THAN NO INVENTORY: it converts a known gap into a 272// false assurance. 273func ma_inventory(out: *u8) -> i64 { 274 let b: *u8 = sys_mmap(MA_MAGIC_16384) 275 var o: i64 = 0 276 o = sd_cat(b, o, "{\"inventory\":\"managed deployable artifacts -- DERIVED from deploy_targets.conf, the same allowlist /api/deploy reads (never hand-authored: a declared list drifts from the real one and only the smaller is true)\",\"source\":\"deploy_targets.conf\",\"targets\":[" as *u8) 277 278 let lp: *i64 = sys_mmap(16) as *i64 279 lp[0] = 0 280 let f: *u8 = sys_read_file("deploy_targets.conf" as *u8, lp) 281 let n: i64 = lp[0] 282 var count: i64 = 0 283 if n > 0 { 284 var line: i64 = 0 285 while line < n { 286 var eol: i64 = line 287 var es: i64 = 0 288 while es == 0 { if eol >= n { es = 1 } else { if f[eol] == (10 as u8) { es = 1 } else { eol = eol + 1 } } } 289 var skip: i64 = 0 290 if line >= eol { skip = 1 } 291 if skip == 0 { if f[line] == (35 as u8) { skip = 1 } } 292 if skip == 0 { 293 var p: i64 = line 294 var fe: i64 = 0 295 while fe == 0 { if p < eol { if f[p] == (32 as u8) { fe = 1 } else { p = p + 1 } } else { fe = 1 } } 296 if p > line { 297 if count > 0 { o = sd_cat(b, o, "," as *u8) } 298 o = sd_cat(b, o, "\"" as *u8) 299 var z: i64 = line 300 while z < p { b[o] = f[z]; o = o + 1; z = z + 1 } 301 o = sd_cat(b, o, "\"" as *u8) 302 count = count + 1 303 } 304 } 305 line = eol + 1 306 } 307 } 308 o = sd_cat(b, o, "],\"count\":" as *u8) 309 // Inline decimal append -- there is no sd_catn in this file, and REFERENCING A HELPER THAT DOES NOT 310 // EXIST is how a build breaks for a reason unrelated to the change being made. 311 if count <= 0 { b[o] = 48 as u8; o = o + 1 } else { 312 let tmp: *u8 = sys_mmap(32) 313 var m: i64 = count 314 var k: i64 = 0 315 while m > 0 { tmp[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 316 var j: i64 = k - 1 317 while j >= 0 { b[o] = tmp[j]; o = o + 1; j = j - 1 } 318 } 319 // NON-VACUITY: if the conf could not be read the list is EMPTY, and an empty inventory must be 320 // legible as "I could not read the source", never as "nothing is deployable". 321 if count <= 0 { 322 o = sd_cat(b, o, ",\"warning\":\"ZERO targets parsed -- deploy_targets.conf unreadable or empty. This is a READ FAILURE, not an empty fleet.\"" as *u8) 323 } 324 o = sd_cat(b, o, ",\"lifecycle\":{\"build\":\"POST /api/build\",\"stage\":\"POST /api/upload\",\"promote\":\"POST /api/deploy\",\"version_verdict\":\"GET /api/deploy_status\",\"rollback\":\"POST /api/rollback\"}}" as *u8) 325 b[o] = 0 as u8 326 return ma_emit_200(out, b) 327} 328func ma_index(out: *u8) -> i64 { 329 // RENDERED FROM MA_ROUTES -- the same literal ma_index_text prints. The hand-maintained twin that 330 // stood here had already drifted from it in BOTH directions; there is now nothing left to keep in sync. 331 let body: *u8 = sys_mmap(MA_RT_BUF) 332 var o: i64 = sd_cat(body, 0, "{\"api\":\"nishi-mgmt\",\"version\":2,\"spec\":\"/api/openapi.json\",\"routes\":[" as *u8) 333 o = ma_routes_json(body, o) 334 o = sd_cat(body, o, "],\"_links\":{\"self\":{\"href\":\"/api\"},\"spec\":{\"href\":\"/api/openapi.json\"},\"health\":{\"href\":\"/api/health\"},\"services\":{\"href\":\"/api/services\"},\"deploy_status\":{\"href\":\"/api/deploy_status\"}}}" as *u8) 335 body[o] = 0 as u8 336 return ma_emit_json(out, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8, body, o) 337} 338 339// ---- /api/openapi.json (SOTA machine-readable API description == Swagger; enables API-only agent use) -------- 340// GENERATED from the route table (data->JSON), not hand-authored. Public (specs are discovery). Declares the 341// OPAQUE session security scheme + the RFC9457 Problem schema so errors are machine-typed. 342func op_path(out: *u8, o: i64, path: *u8, method: *u8, summary: *u8, authed: i64) -> i64 { 343 o = sd_cat(out, o, "\"" as *u8); o = sd_cat(out, o, path); o = sd_cat(out, o, "\":{\"" as *u8); o = sd_cat(out, o, method) 344 o = sd_cat(out, o, "\":{\"summary\":\"" as *u8); o = sd_cat(out, o, summary); o = sd_cat(out, o, "\",\"security\":" as *u8) 345 if authed == 1 { o = sd_cat(out, o, "[{\"nishiSession\":[]}]" as *u8) } else { o = sd_cat(out, o, "[]" as *u8) } 346 // json-schema-params: POST endpoints declare a typed requestBody; every op declares typed 200 + Problem-typed errors. 347 if (method[0] as i64) == 112 { // 'p' -> post 348 o = sd_cat(out, o, ",\"requestBody\":{\"content\":{\"application/x-www-form-urlencoded\":{\"schema\":{\"type\":\"object\",\"additionalProperties\":{\"type\":\"string\"}}}}}" as *u8) 349 } 350 o = sd_cat(out, o, ",\"responses\":{\"200\":{\"description\":\"ok\",\"content\":{\"application/json\":{\"schema\":{\"type\":\"object\"}}}},\"400\":{\"description\":\"bad request\",\"content\":{\"application/problem+json\":{\"schema\":{\"$ref\":\"#/components/schemas/Problem\"}}}},\"401\":{\"description\":\"unauthorized\"},\"403\":{\"description\":\"insufficient level\"}}}}" as *u8) 351 return o 352} 353func ma_openapi(out: *u8) -> i64 { 354 let b: *u8 = sys_mmap(MA_MAGIC_16384); var o: i64 = 0 355 o = sd_cat(b, o, "{\"openapi\":\"3.1.0\",\"info\":{\"title\":\"Nishi Sovereign Management API\",\"version\":\"2\",\"description\":\"Sovereign control plane: deploy any binary + run any control action off-LAN. OPAQUE-PAKE auth, never-brick staged deploys (health+auto-rollback), own TLS 1.3.\"},\"servers\":[{\"url\":\"https://nishifamily.com\"}]," as *u8) 356 o = sd_cat(b, o, "\"components\":{\"securitySchemes\":{\"nishiSession\":{\"type\":\"apiKey\",\"in\":\"header\",\"name\":\"X-Nishi-Session\",\"description\":\"OPAQUE-PAKE session token from POST /api/login\"}},\"schemas\":{\"Problem\":{\"type\":\"object\",\"description\":\"RFC9457 problem detail\",\"properties\":{\"type\":{\"type\":\"string\"},\"title\":{\"type\":\"string\"},\"status\":{\"type\":\"integer\"},\"detail\":{\"type\":\"string\"},\"instance\":{\"type\":\"string\"}}}}}," as *u8) 357 o = sd_cat(b, o, "\"paths\":{" as *u8) 358 o = op_path(b, o, "/api/login" as *u8, "post" as *u8, "OPAQUE-PAKE login -> session token" as *u8, 0) 359 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/health" as *u8, "get" as *u8, "control-plane health snapshot" as *u8, 1) 360 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/release_identity", "get", "SHA-256 of the executable answering this request; authenticated process identity, not a health or hardware attestation", 1) 361 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/services" as *u8, "get" as *u8, "per-service status" as *u8, 1) 362 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/upload" as *u8, "post" as *u8, "stage a binary (.new; sha256; never promotes)" as *u8, 1) 363 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/deploy" as *u8, "post" as *u8, "promote a registry target (validate->promote->async health+auto-rollback watchdog)" as *u8, 1) 364 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/deploy_status" as *u8, "get" as *u8, "last deploy watchdog verdict (RUNNING|DEPLOYED-GREEN|ROLLED-BACK)" as *u8, 1) 365 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/unpack" as *u8, "post" as *u8, "unpack a staged source-tree .pack blob into an allowlisted NAS dir (build-over-API tree-sync). REQUIRES sha256=<hex of the pack YOU uploaded>: the staging slot is shared across sessions, so the unpack is pinned to your exact bytes and REFUSES on mismatch rather than applying a tree you never reviewed (seq1807)" as *u8, 1) 366 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/ship" as *u8, "post" as *u8, "BUILD then PROMOTE-or-DEPLOY then VERIFY in ONE call: {target,confirm=yes,[allow_capability_loss=yes],[deploy_target=<deploy_targets.conf row>]}. Without deploy_target it promotes a one-shot organ; WITH it the artefact takes the DAEMON path (/api/deploy: validate->promote->http health->auto-rollback) and the reply names route=deploy plus the armed watchdog. The deploy ROW NAME differs from the build target (build nx_mgmt_api, deploy row mgmtapi) so it is taken explicitly and never guessed. No nx_stage_alias step is needed or performed -- /api/deploy already falls back from <t>.elf.new to <t>.sov.elf.new, so that step in the old shell recipe was redundant (measured 2026-08-07). Delegates verbatim to /api/build and /api/promote, so build admission, the D001 ratchet, tree-canon, provenance and the staging-hygiene guard all apply unchanged -- it is a composition, not a second deploy path. Hashes the staged bytes itself and passes them as expect_sha256, closing the stale-artefact window the three-call loop leaves open, then RE-READS the live file and returns staged_sha256, live_sha256 and verified. A failed build is passed through unchanged. NOTE: it holds the connection for the whole compile, so a slow target can exceed the edge window and return 503 while the ship COMPLETES -- the artefact, not the response, is authoritative" as *u8, 1) 367 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/build" as *u8, "post" as *u8, "compile a target on the NAS (build-over-API) -> stage <target>.sov.elf.new for /api/deploy; on failure returns BUILD-FAILED with a diag tail of the nx_cc/nxasm output plus diag_errors, a window anchored at the first nx_parse: line (multi-error recovery leaves error lines mid-log) (fail-loud)" as *u8, 1) 368 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/promote" as *u8, "post" as *u8, "promote a built one-shot organ ELF (<target>.sov.elf.new -> <target>.elf); STRUCTURAL policy: daemon/oracle names always refused -> /api/deploy, any owner-staged one-shot promotable; confirm=yes; never-brick .prev backup" as *u8, 1) 369 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/tools/register" as *u8, "post" as *u8, "expose an organ as an MCP tool (append GREEN tool_allowlist.conf row + optional tool_schemas.conf row); {name,elf,confirm=yes,[args],[title],[update=yes]}; fail-closed + idempotent; update=yes atomically REPLACES an existing row (repoint elf/args; can never create); callable via the tools daemon's hot-read, discoverable after nx_toolreg_reconcile" as *u8, 1) 370 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/cap/mint" as *u8, "post" as *u8, "mint a root tools-capability token via the on-NAS oracle; {allow=<csv of registered tools>,confirm=yes,[days],[nonce]}; least-authority (* refused, every name must be registered), audited in cap_consent.log" as *u8, 1) 371 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/hostctl" as *u8, "post" as *u8, "run one allowlisted control action (status/torstat/routerctl/kick*/trackerrefresh)" as *u8, 1) 372 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/restart" as *u8, "post" as *u8, "restart a supervised service" as *u8, 1) 373 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/rollback" as *u8, "post" as *u8, "roll back a deploy" as *u8, 1) 374 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/promote_content" as *u8, "post" as *u8, "promote a staged static file" as *u8, 1) 375 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/promote_toolchain" as *u8, "post" as *u8, "promote a staged BUILD TOOLCHAIN binary into buildroot/_offc -- ELF-validated, .prev-banked, canary-compiled+run, auto-rollback on failure" as *u8, 1) 376 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/compare/registry" as *u8, "get" as *u8, "the Nishi Compare registry SSOT (text/plain, save-as-is)" as *u8, 1) 377 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/compare/upsert" as *u8, "post" as *u8, "merge ONE registry line by /compare/<domain> key (commutative across domains; replaced line kept in .hist) then regen the hub" as *u8, 1) 378 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/compare/regen" as *u8, "post" as *u8, "regenerate /compare hub index.html + api.json from the SSOT (idempotent)" as *u8, 1) 379 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/compare/publish" as *u8, "post" as *u8, "promote the staged compare.page bytes as /compare/<domain> page|frontier|bench|api (sha256-pinned, confirm=yes)" as *u8, 1) 380 o = sd_cat(b, o, "," as *u8); o = op_path(b, o, "/api/openapi.json" as *u8, "get" as *u8, "this OpenAPI 3.1 spec (machine-readable)" as *u8, 0) 381 o = sd_cat(b, o, "}}" as *u8) 382 return ma_emit_json(out, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8, b, o) 383} 384 385// RFC 9457 Problem Details: all error responses are application/problem+json with type/title/status members. 386func ma_emit_404(out: *u8) -> i64 { 387 let body: *u8 = "{\"type\":\"about:blank\",\"title\":\"Not Found\",\"status\":404,\"detail\":\"no such route\"}" as *u8 388 return ma_emit_json(out, "HTTP/1.1 404 Not Found\r\nContent-Type: application/problem+json\r\nConnection: close\r\nContent-Length: " as *u8, body, sd_len(body)) 389} 390 391func ma_emit_403(out: *u8) -> i64 { 392 let body: *u8 = "{\"type\":\"about:blank\",\"title\":\"Forbidden\",\"status\":403,\"detail\":\"your access level is insufficient for this action\"}" as *u8 393 return ma_emit_json(out, "HTTP/1.1 403 Forbidden\r\nContent-Type: application/problem+json\r\nConnection: close\r\nContent-Length: " as *u8, body, sd_len(body)) 394} 395 396func ma_emit_501(out: *u8) -> i64 { 397 let body: *u8 = "{\"type\":\"about:blank\",\"title\":\"Not Implemented\",\"status\":501,\"detail\":\"route exists; action wired in a later rung\"}" as *u8 398 return ma_emit_json(out, "HTTP/1.1 501 Not Implemented\r\nContent-Type: application/problem+json\r\nConnection: close\r\nContent-Length: " as *u8, body, sd_len(body)) 399} 400 401// merge the caller's {"error":"..."} body into an RFC9457 problem+json object (type/title/status standard 402// members + the caller's "error" as an extension member) -> every /api 400 is machine-typed, zero caller churn. 403// Extract the target the BUILDER said it compiled, from its own echo: 404// [hostctl] buildrun: compile 'nx_seg_store_gate' on the NAS (nx_cc -> nxasm) 405// Returns 1 and fills `out` when the marker is found, 0 otherwise. Scans the WHOLE capture -- the echo is 406// not at offset 0, and a capture that merges stdout and stderr puts it somewhere different again. 407// ABSENCE IS NOT A MISMATCH: an older builder that does not print this line yields 0, and the caller then 408// proceeds exactly as before. A guard that cannot see its evidence must abstain, never accuse -- turning 409// "I could not look" into "it is wrong" would break every build the moment the echo format changed. 410func ma_compiled_name(buf: *u8, n: i64, out: *u8) -> i64 { 411 let k: *u8 = "compile '" as *u8 412 var i: i64 = 0 413 while i + 9 <= n { 414 var m: i64 = 0 415 var hit: i64 = 1 416 while m < 9 { if buf[i+m] != k[m] { hit = 0; m = 9 } else { m = m + 1 } } 417 if hit == 1 { 418 var s: i64 = i + 9 419 var o: i64 = 0 420 while s < n { 421 let c: i64 = buf[s] as i64 422 if c == 39 { s = n } else { 423 if o < 250 { out[o] = buf[s]; o = o + 1 } 424 s = s + 1 425 } 426 } 427 out[o] = 0 as u8 428 if o == 0 { return 0 } 429 return 1 430 } 431 i = i + 1 432 } 433 return 0 434} 435 436func ma_emit_400(out: *u8, body: *u8) -> i64 { 437 let b2: *u8 = sys_mmap(MA_MAGIC_4096); var o: i64 = 0 438 o = sd_cat(b2, o, "{\"type\":\"about:blank\",\"title\":\"Bad Request\",\"status\":400," as *u8) 439 var i: i64 = 0; if body[0] == (123 as u8) { i = 1 } // skip the caller body's leading '{' 440 while body[i] != (0 as u8) { b2[o] = body[i]; o = o + 1; i = i + 1 } 441 b2[o] = 0 as u8 442 return ma_emit_json(out, "HTTP/1.1 400 Bad Request\r\nContent-Type: application/problem+json\r\nConnection: close\r\nContent-Length: " as *u8, b2, o) 443} 444 445func ma_emit_200(out: *u8, body: *u8) -> i64 { 446 return ma_emit_json(out, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8, body, sd_len(body)) 447} 448 449// 503 + Retry-After for BUILD ADMISSION (seq708/768/1390). RFC9457 problem+json like the other emitters, 450// so callers stay machine-typed. Retry-After:30 makes the refusal ACTIONABLE -- a client that gets this 451// knows the host is memory-wedged and when to come back, instead of the current failure mode where the 452// build is accepted, the host OOMs, the supervisor reaps nx_mgmt_api, and the caller sees the deploy 453// path vanish with no explanation at all. A stated refusal beats a silent reap. 454func ma_emit_503(out: *u8, body: *u8) -> i64 { 455 let b2: *u8 = sys_mmap(MA_MAGIC_4096); var o: i64 = 0 456 o = sd_cat(b2, o, "{\"type\":\"about:blank\",\"title\":\"Service Unavailable\",\"status\":503," as *u8) 457 var i: i64 = 0; if body[0] == (123 as u8) { i = 1 } 458 while body[i] != (0 as u8) { b2[o] = body[i]; o = o + 1; i = i + 1 } 459 b2[o] = 0 as u8 460 return ma_emit_json(out, "HTTP/1.1 503 Service Unavailable\r\nContent-Type: application/problem+json\r\nRetry-After: 30\r\nConnection: close\r\nContent-Length: " as *u8, b2, o) 461} 462 463// 413 for an upload chunk whose declared Content-Length would overflow the scoped MA_UPLOAD_REQCAP buffer. 464// Fail-closed: emitted BEFORE any body is read/appended, so nothing is staged (the client must use a smaller chunk). 465func ma_emit_413(out: *u8) -> i64 { 466 let body: *u8 = "{\"error\":\"chunk too large; exceeds MA_UPLOAD_REQCAP (use a smaller chunk)\"}" as *u8 467 return ma_emit_json(out, "HTTP/1.1 413 Payload Too Large\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8, body, sd_len(body)) 468} 469 470func ma_comma(body: *u8, b: i64, first: *i64) -> i64 { 471 if first[0] == 1 { first[0] = 0; return b } 472 return sd_cat(body, b, "," as *u8) 473} 474 475// ---- /api/services (transport: read via DATA, classify via CORE, serialize here) -------------------- 476 477func ma_emit_services(snap: *u8, snap_n: i64, out: *u8) -> i64 { 478 let offs: *i64 = sys_mmap(64) as *i64 479 let lens: *i64 = sys_mmap(64) as *i64 480 let body: *u8 = sys_mmap(MA_BODYCAP) 481 var b: i64 = sd_cat(body, 0, "{\"services\":[" as *u8) 482 var first: i64 = 1 483 var cur: i64 = 0 484 while cur < snap_n { 485 let le: i64 = md_eol(snap, snap_n, cur) 486 let nf: i64 = md_split(snap, cur, le, offs, lens, 8) 487 if nf >= 6 { 488 if md_tok_eq(snap, offs[0], lens[0], "SVC" as *u8) == 1 { 489 if first == 0 { b = sd_cat(body, b, "," as *u8) } 490 first = 0 491 let procs: i64 = md_slice_atoi(snap, offs[4], lens[4]) 492 let rwin: i64 = md_slice_atoi(snap, offs[5], lens[5]) 493 let dup: i64 = mc_is_dup(procs) 494 let lp: i64 = mc_is_loop(rwin) 495 b = sd_cat(body, b, "{\"name\":\"" as *u8) 496 b = md_cat_slice(body, b, snap, offs[1], lens[1]) 497 b = sd_cat(body, b, "\",\"port\":" as *u8) 498 b = sd_catn(body, b, md_slice_atoi(snap, offs[2], lens[2])) 499 b = sd_cat(body, b, ",\"state\":\"" as *u8) 500 b = md_cat_slice(body, b, snap, offs[3], lens[3]) 501 b = sd_cat(body, b, "\",\"procs\":" as *u8) 502 b = sd_catn(body, b, procs) 503 b = sd_cat(body, b, ",\"dup\":" as *u8) 504 b = sd_catn(body, b, dup) 505 b = sd_cat(body, b, ",\"loop\":" as *u8) 506 b = sd_catn(body, b, lp) 507 if nf >= 8 { 508 let holder: i64 = md_slice_atoi(snap, offs[7], lens[7]) // the 8th snapshot token = who REALLY holds the port 509 b = sd_cat(body, b, ",\"holder_pid\":" as *u8); b = sd_catn(body, b, holder) 510 if holder > 0 { 511 var mism: i64 = 0; if md_tok_eq(snap, offs[3], lens[3], "DOWN" as *u8) == 1 { mism = 1 } // DOWN + a foreign holder = a squatter 512 b = sd_cat(body, b, ",\"port_mismatch\":" as *u8); b = sd_catn(body, b, mism) 513 b = sd_cat(body, b, ",\"holder_cmd\":\"" as *u8) 514 let hc: *u8 = sys_mmap(512); let hcn: i64 = pon_pid_cmdline(holder, hc, 512) 515 var z: i64 = 0 516 while z < hcn { let c: i64 = hc[z] & 0xff; if c == 34 { body[b] = 39 as u8; b = b + 1 } else { if c == 92 { body[b] = 47 as u8; b = b + 1 } else { body[b] = c as u8; b = b + 1 } } z = z + 1 } // JSON-safe: " -> ' , \ -> / 517 b = sd_cat(body, b, "\"" as *u8) 518 } 519 } 520 b = sd_cat(body, b, "}" as *u8) 521 } 522 } 523 cur = le + 1 524 } 525 b = sd_cat(body, b, "]}" as *u8) 526 return ma_emit_200(out, body) 527} 528 529func ma_emit_shards(out: *u8) -> i64 { 530 let body: *u8 = sys_mmap(MA_BODYCAP) 531 sv_build_shards_json(MA_SHARDS_CONF, body, MA_BODYCAP) 532 return ma_emit_200(out, body) 533} 534 535func ma_emit_services_file(snapfile: *u8, out: *u8) -> i64 { 536 let sbox: *i64 = sys_mmap(16) as *i64 537 let page: *u8 = md_read_file(snapfile, sbox) 538 if (page as i64) == 0 { 539 let empty: *u8 = sys_mmap(1) 540 return ma_emit_services(empty, 0, out) 541 } 542 return ma_emit_services(page, sbox[0], out) 543} 544 545// ---- /api/nodes (swarm MONITOR pillar: read THIS node's LIVE /proc directly -- the mgmt daemon runs on the NAS) -- 546// BOUNDED /proc reads (openat+read+close); NEVER sys_read_file (mmaps 4 GiB/call unfreed = the supervisor ENOMEM 547// F-class root, nx_hostctl.nx:311). Instantaneous only -- no CPU%-sample sleep -> never stalls the serve loop; 548// loadavg-per-core IS the scheduler-grade pressure signal (runqueue depth). SPOT verdict folded in. 549func mnp_readproc(path: *u8, buf: *u8, cap: i64) -> i64 { 550 if cap <= 0 { return 0 - 1 } 551 buf[0] = 0 as u8 552 let fd: i64 = sys_openat_rd(path) 553 if fd < 0 { return 0 - 1 } 554 var used: i64 = 0 555 // procfs can return a short non-EOF read even with a large destination. 556 while used < cap - 1 { 557 let r: i64 = sys_read(fd, buf + used, cap - 1 - used) 558 if r < 0 { sys_close(fd); buf[0] = 0 as u8; return 0 - 1 } 559 if r == 0 { sys_close(fd); buf[used] = 0 as u8; return used } 560 used = used + r 561 } 562 // Reserve the terminator byte for an EOF probe; never report a prefix as complete. 563 let probe: i64 = sys_read(fd, buf + used, 1) 564 sys_close(fd) 565 buf[used] = 0 as u8 566 if probe < 0 { buf[0] = 0 as u8; return 0 - 1 } 567 if probe > 0 { buf[0] = 0 as u8; return 0 - 2 } 568 return used 569} 570func mnp_skip_sp(buf: *u8, n: i64, p: i64) -> i64 { 571 var i: i64 = p 572 var go: i64 = 1 573 while go == 1 { 574 if i >= n { go = 0 } else { if (buf[i] as i64) == 32 { i = i + 1 } else { go = 0 } } 575 } 576 return i 577} 578func mnp_pdec(buf: *u8, n: i64, p: i64, pend: *i64) -> i64 { 579 var i: i64 = p 580 var v: i64 = 0 581 var go: i64 = 1 582 while go == 1 { 583 if i >= n { go = 0 } else { 584 let c: i64 = buf[i] as i64 585 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48); i = i + 1 } else { go = 0 } } else { go = 0 } 586 } 587 } 588 pend[0] = i 589 return v 590} 591func mnp_count_sub(buf: *u8, n: i64, needle: *u8, nl: i64) -> i64 { 592 var c: i64 = 0 593 var i: i64 = 0 594 while i <= n - nl { 595 var j: i64 = 0 596 var ok: i64 = 1 597 while j < nl { if buf[i + j] != needle[j] { ok = 0; j = nl } else { j = j + 1 } } 598 if ok == 1 { c = c + 1; i = i + nl } else { i = i + 1 } 599 } 600 return c 601} 602func mnp_find_after(buf: *u8, n: i64, key: *u8, klen: i64) -> i64 { 603 var i: i64 = 0 604 let last: i64 = n - klen 605 while i <= last { 606 var j: i64 = 0 607 var ok: i64 = 1 608 while j < klen { if buf[i + j] != key[j] { ok = 0; j = klen } else { j = j + 1 } } 609 if ok == 1 { return i + klen } 610 i = i + 1 611 } 612 return 0 - 1 613} 614func mnp_loadavg_milli(buf: *u8) -> i64 { 615 let r: i64 = mnp_readproc("/proc/loadavg" as *u8, buf, 256) 616 if r <= 0 { return 0 } 617 let pend: *i64 = sys_mmap(16) as *i64 618 let ip: i64 = mnp_pdec(buf, r, 0, pend) 619 var frac: i64 = 0 620 var p: i64 = pend[0] 621 if p < r { 622 if (buf[p] as i64) == 46 { 623 p = p + 1 624 var dd: i64 = 0 625 var go: i64 = 1 626 while go == 1 { 627 if dd >= 2 { go = 0 } else { 628 if p >= r { go = 0 } else { 629 let c: i64 = buf[p] as i64 630 if c >= 48 { if c <= 57 { frac = frac * 10 + (c - 48); p = p + 1; dd = dd + 1 } else { go = 0 } } else { go = 0 } 631 } 632 } 633 } 634 while dd < 2 { frac = frac * 10; dd = dd + 1 } 635 } 636 } 637 return ip * 1000 + frac * 10 638} 639func mnp_ncpu(buf: *u8, cap: i64) -> i64 { 640 let r: i64 = mnp_readproc("/proc/cpuinfo" as *u8, buf, cap) 641 if r <= 0 { return 1 } 642 let c: i64 = mnp_count_sub(buf, r, "processor" as *u8, 9) 643 if c < 1 { return 1 } 644 return c 645} 646func mnp_meminfo_kb(buf: *u8, n: i64, key: *u8, klen: i64) -> i64 { 647 let at: i64 = mnp_find_after(buf, n, key, klen) 648 if at < 0 { return 0 - 1 } 649 let s: i64 = mnp_skip_sp(buf, n, at) 650 let pend: *i64 = sys_mmap(16) as *i64 651 return mnp_pdec(buf, n, s, pend) 652} 653func ma_emit_nodes(out: *u8) -> i64 { 654 let small: *u8 = sys_mmap(MA_MAGIC_8192) 655 let big: *u8 = sys_mmap(MA_MAGIC_262144) 656 let load_milli: i64 = mnp_loadavg_milli(small) 657 let ncpu: i64 = mnp_ncpu(big, MA_MAGIC_262144) 658 var lpc: i64 = load_milli 659 if ncpu > 0 { lpc = load_milli / ncpu } 660 let rmem: i64 = mnp_readproc("/proc/meminfo" as *u8, small, MA_MAGIC_8192) 661 var mtot: i64 = mnp_meminfo_kb(small, rmem, "MemTotal:" as *u8, 9) 662 var mav: i64 = mnp_meminfo_kb(small, rmem, "MemAvailable:" as *u8, 13) 663 if mtot < 1 { mtot = 1 } 664 if mav < 0 { mav = 0 } 665 let mused_pct: i64 = (mtot - mav) * 100 / mtot 666 let rtcp: i64 = mnp_readproc("/proc/net/tcp" as *u8, big, MA_MAGIC_262144) 667 var conns: i64 = 0 668 if rtcp > 0 { let cc: i64 = mnp_count_sub(big, rtcp, ":20FB" as *u8, 5); if cc > 1 { conns = cc - 1 } } 669 var verdict: *u8 = "OK" as *u8 670 if lpc >= 700 { verdict = "BUSY" as *u8 } 671 if lpc >= 1000 { verdict = "OVERLOADED" as *u8 } 672 let body: *u8 = sys_mmap(MA_BODYCAP) 673 var b: i64 = sd_cat(body, 0, "{\"nodes\":[{\"name\":\"nas\",\"role\":\"orchestrator\",\"addr\":\"192.168.8.227\",\"load_milli\":" as *u8) 674 b = sd_catn(body, b, load_milli) 675 b = sd_cat(body, b, ",\"ncpu\":" as *u8); b = sd_catn(body, b, ncpu) 676 b = sd_cat(body, b, ",\"load_per_core_milli\":" as *u8); b = sd_catn(body, b, lpc) 677 b = sd_cat(body, b, ",\"mem_used_pct\":" as *u8); b = sd_catn(body, b, mused_pct) 678 b = sd_cat(body, b, ",\"mem_avail_mb\":" as *u8); b = sd_catn(body, b, mav / MA_MAGIC_1024) 679 b = sd_cat(body, b, ",\"mem_total_mb\":" as *u8); b = sd_catn(body, b, mtot / MA_MAGIC_1024) 680 b = sd_cat(body, b, ",\"conns8443\":" as *u8); b = sd_catn(body, b, conns) 681 b = sd_cat(body, b, ",\"verdict\":\"" as *u8); b = sd_cat(body, b, verdict) 682 b = sd_cat(body, b, "\",\"ts\":" as *u8); b = sd_catn(body, b, sys_now_realtime_sec()) 683 b = sd_cat(body, b, "}],\"workers\":[{\"name\":\"laptop-5080\",\"addr\":\"192.168.8.193:7861\",\"role\":\"gpu-image\",\"state\":\"probe-via-mesh\"},{\"name\":\"west-3090\",\"addr\":\"10.0.4.13:7861\",\"role\":\"gpu-video\",\"state\":\"probe-via-mesh\"}]," as *u8) 684 b = sd_cat(body, b, "\"thresholds\":{\"busy_per_core_milli\":700,\"overload_per_core_milli\":1000}}" as *u8) 685 body[b] = 0 as u8 686 return ma_emit_200(out, body) 687} 688 689// ---- /api/health (transport orchestration: DATA parse + CORE verdict + serialize) ------------------- 690 691func ma_health_count(snap: *u8, snap_n: i64, supb: *i64, nsvcb: *i64, ndownb: *i64) -> i64 { 692 let offs: *i64 = sys_mmap(64) as *i64 693 let lens: *i64 = sys_mmap(64) as *i64 694 var sup: i64 = 0 695 var nsvc: i64 = 0 696 var ndown: i64 = 0 697 var reasons: i64 = 0 698 var cur: i64 = 0 699 while cur < snap_n { 700 let le: i64 = md_eol(snap, snap_n, cur) 701 let nf: i64 = md_split(snap, cur, le, offs, lens, 8) 702 if nf >= 2 { 703 if md_tok_eq(snap, offs[0], lens[0], "SUP" as *u8) == 1 { sup = md_slice_atoi(snap, offs[1], lens[1]) } 704 } 705 if nf >= 6 { 706 if md_tok_eq(snap, offs[0], lens[0], "SVC" as *u8) == 1 { 707 nsvc = nsvc + 1 708 let procs: i64 = md_slice_atoi(snap, offs[4], lens[4]) 709 let rwin: i64 = md_slice_atoi(snap, offs[5], lens[5]) 710 if mc_is_dup(procs) == 1 { reasons = reasons + 1 } 711 if mc_is_loop(rwin) == 1 { reasons = reasons + 1 } 712 if md_tok_eq(snap, offs[3], lens[3], "DOWN" as *u8) == 1 { reasons = reasons + 1; ndown = ndown + 1 } 713 } 714 } 715 cur = le + 1 716 } 717 if mc_is_duel(sup) == 1 { reasons = reasons + 1 } 718 supb[0] = sup 719 nsvcb[0] = nsvc 720 ndownb[0] = ndown 721 return reasons 722} 723 724func ma_health_reasons(snap: *u8, snap_n: i64, sup: i64, body: *u8, b0: i64) -> i64 { 725 let offs: *i64 = sys_mmap(64) as *i64 726 let lens: *i64 = sys_mmap(64) as *i64 727 var b: i64 = b0 728 let firstbox: *i64 = sys_mmap(8) as *i64 729 firstbox[0] = 1 730 if mc_is_duel(sup) == 1 { 731 b = ma_comma(body, b, firstbox) 732 b = sd_cat(body, b, "\"dueling-supervisors\"" as *u8) 733 } 734 var cur: i64 = 0 735 while cur < snap_n { 736 let le: i64 = md_eol(snap, snap_n, cur) 737 let nf: i64 = md_split(snap, cur, le, offs, lens, 8) 738 if nf >= 6 { 739 if md_tok_eq(snap, offs[0], lens[0], "SVC" as *u8) == 1 { 740 let procs: i64 = md_slice_atoi(snap, offs[4], lens[4]) 741 let rwin: i64 = md_slice_atoi(snap, offs[5], lens[5]) 742 if mc_is_dup(procs) == 1 { 743 b = ma_comma(body, b, firstbox) 744 b = sd_cat(body, b, "\"duplicate-instance:" as *u8) 745 b = md_cat_slice(body, b, snap, offs[1], lens[1]) 746 b = sd_cat(body, b, "\"" as *u8) 747 } 748 if mc_is_loop(rwin) == 1 { 749 b = ma_comma(body, b, firstbox) 750 b = sd_cat(body, b, "\"crash-loop:" as *u8) 751 b = md_cat_slice(body, b, snap, offs[1], lens[1]) 752 b = sd_cat(body, b, "\"" as *u8) 753 } 754 if md_tok_eq(snap, offs[3], lens[3], "DOWN" as *u8) == 1 { 755 b = ma_comma(body, b, firstbox) 756 b = sd_cat(body, b, "\"down:" as *u8) 757 b = md_cat_slice(body, b, snap, offs[1], lens[1]) 758 b = sd_cat(body, b, "\"" as *u8) 759 } 760 } 761 } 762 cur = le + 1 763 } 764 return b 765} 766 767// ---- HOST MEMORY-PRESSURE AXIS (sev-9 1785048333: /api/health said OK while swap sat 99.995% exhausted 768// and MemAvailable=146 permil -- the rollup had NO resource signal at all). MemAvailable, not SwapFree, is 769// the near-term OOM guard (incident law), so it is the primary threshold; swap saturation is the secondary. 770// Thresholds are DATA: knowledge/health_mem.conf rows `mem_avail_min_permil<TAB>N` / `swap_used_max_permil<TAB>N`, 771// compiled defaults when absent. /proc/meminfo unreadable -> permils stay -1 and the axis NEVER fires 772// (fail-safe: a blind instrument must say nothing, not false-DEGRADE). Buffers are lazy static pointers 773// (BSS-array class crashes the handler module; per-call sys_mmap is the debt-883 leak class). 774const MA_MEM_AVAIL_MIN_PERMIL: i64 = 150 775const MA_SWAP_USED_MAX_PERMIL: i64 = 950 776static ma_mi_buf: *u8 777static ma_mc_buf: *u8 778static ma_mem_scr: *i64 779// key -> integer after it (skips spaces/tabs); -1 = key absent / no digits. Serves BOTH /proc/meminfo 780// (`MemTotal: 36182312 kB`) and the conf (`mem_avail_min_permil<TAB>150`). 781func ma_key_int(buf: *u8, n: i64, key: *u8) -> i64 { 782 var kl: i64 = 0 783 while key[kl] != (0 as u8) { kl = kl + 1 } 784 var i: i64 = 0 785 while i + kl < n { 786 var m: i64 = 1 787 var j: i64 = 0 788 while j < kl { if buf[i+j] != key[j] { m = 0; j = kl } else { j = j + 1 } } 789 if m == 1 { 790 var p: i64 = i + kl 791 var sk: i64 = 1 792 while sk == 1 { 793 if p >= n { sk = 0 } else { 794 if buf[p] == (32 as u8) { p = p + 1 } else { if buf[p] == (9 as u8) { p = p + 1 } else { sk = 0 } } 795 } 796 } 797 var v: i64 = 0 798 var any: i64 = 0 799 var go: i64 = 1 800 while go == 1 { 801 if p >= n { go = 0 } else { 802 let c: i64 = buf[p] as i64 803 if c < 48 { go = 0 } else { if c > 57 { go = 0 } else { v = v*10 + (c - 48); any = 1; p = p + 1 } } 804 } 805 } 806 if any == 1 { return v } 807 return 0 - 1 808 } 809 while i < n { if buf[i] == (10 as u8) { break } i = i + 1 } 810 i = i + 1 811 } 812 return 0 - 1 813} 814func ma_read_small(path: *u8, buf: *u8, cap: i64) -> i64 { 815 let fd: i64 = sys_openat_rd(path) 816 if fd < 0 { return 0 - 1 } 817 let n: i64 = sys_read(fd, buf, cap) 818 sys_close(fd) 819 return n 820} 821func ma_mem_conf(key: *u8, defv: i64) -> i64 { 822 if (ma_mc_buf as i64) == 0 { ma_mc_buf = sys_mmap(MA_MAGIC_2048) } 823 let n: i64 = ma_read_small("knowledge/health_mem.conf" as *u8, ma_mc_buf, MA_MAGIC_2046) 824 if n <= 0 { return defv } 825 let v: i64 = ma_key_int(ma_mc_buf, n, key) 826 if v < 0 { return defv } 827 return v 828} 829// Measure + judge. ma_mem_scr[0]=mem_avail_permil, [1]=swap_used_permil (-1 = unmeasured). Returns 1 on breach. 830func ma_mem_pressure() -> i64 { 831 if (ma_mem_scr as i64) == 0 { ma_mem_scr = sys_mmap(16) as *i64 } 832 ma_mem_scr[0] = 0 - 1 833 ma_mem_scr[1] = 0 - 1 834 if (ma_mi_buf as i64) == 0 { ma_mi_buf = sys_mmap(MA_MAGIC_8192) } 835 let n: i64 = ma_read_small("/proc/meminfo" as *u8, ma_mi_buf, MA_MAGIC_8190) 836 if n <= 0 { return 0 } 837 let mt: i64 = ma_key_int(ma_mi_buf, n, "MemTotal:" as *u8) 838 let mav: i64 = ma_key_int(ma_mi_buf, n, "MemAvailable:" as *u8) 839 let st: i64 = ma_key_int(ma_mi_buf, n, "SwapTotal:" as *u8) 840 let sf: i64 = ma_key_int(ma_mi_buf, n, "SwapFree:" as *u8) 841 if mt > 0 { if mav >= 0 { ma_mem_scr[0] = mav * 1000 / mt } } 842 if st > 0 { if sf >= 0 { ma_mem_scr[1] = (st - sf) * 1000 / st } } 843 var breach: i64 = 0 844 if ma_mem_scr[0] >= 0 { if ma_mem_scr[0] < ma_mem_conf("mem_avail_min_permil" as *u8, MA_MEM_AVAIL_MIN_PERMIL) { breach = 1 } } 845 if ma_mem_scr[1] >= 0 { if ma_mem_scr[1] > ma_mem_conf("swap_used_max_permil" as *u8, MA_SWAP_USED_MAX_PERMIL) { breach = 1 } } 846 return breach 847} 848 849func ma_emit_health(snap: *u8, snap_n: i64, out: *u8) -> i64 { 850 let supb: *i64 = sys_mmap(8) as *i64 851 let nsvcb: *i64 = sys_mmap(8) as *i64 852 let ndownb: *i64 = sys_mmap(8) as *i64 853 let reasons: i64 = ma_health_count(snap, snap_n, supb, nsvcb, ndownb) 854 let sup: i64 = supb[0] 855 let nsvc: i64 = nsvcb[0] 856 let ndown: i64 = ndownb[0] 857 var noData: i64 = 0 858 if nsvc == 0 { noData = 1 } 859 let memb: i64 = ma_mem_pressure() 860 let verdict: i64 = mc_verdict(noData, reasons + memb) 861 let body: *u8 = sys_mmap(MA_BODYCAP) 862 var b: i64 = sd_cat(body, 0, "{\"overall\":\"" as *u8) 863 if verdict == 0 { b = sd_cat(body, b, "UNKNOWN" as *u8) } 864 if verdict == 1 { b = sd_cat(body, b, "OK" as *u8) } 865 if verdict == 2 { b = sd_cat(body, b, "DEGRADED" as *u8) } 866 b = sd_cat(body, b, "\",\"degraded\":" as *u8) 867 var degcount: i64 = reasons + memb 868 if noData == 1 { degcount = 1 + memb } 869 b = sd_catn(body, b, degcount) 870 b = sd_cat(body, b, ",\"down\":" as *u8) 871 b = sd_catn(body, b, ndown) 872 b = sd_cat(body, b, ",\"supervisors\":" as *u8) 873 b = sd_catn(body, b, sup) 874 b = sd_cat(body, b, ",\"services\":" as *u8) 875 b = sd_catn(body, b, nsvc) 876 if ma_mem_scr[0] >= 0 { 877 b = sd_cat(body, b, ",\"mem_avail_permil\":" as *u8) 878 b = sd_catn(body, b, ma_mem_scr[0]) 879 } 880 if ma_mem_scr[1] >= 0 { 881 b = sd_cat(body, b, ",\"swap_used_permil\":" as *u8) 882 b = sd_catn(body, b, ma_mem_scr[1]) 883 } 884 b = sd_cat(body, b, ",\"reasons\":[" as *u8) 885 if noData == 1 { 886 b = sd_cat(body, b, "\"no-snapshot\"" as *u8) 887 } else { 888 b = ma_health_reasons(snap, snap_n, sup, body, b) 889 } 890 if memb == 1 { 891 if noData == 1 { b = sd_cat(body, b, "," as *u8) } else { if reasons > 0 { b = sd_cat(body, b, "," as *u8) } } 892 b = sd_cat(body, b, "\"mem-pressure:avail_permil=" as *u8) 893 if ma_mem_scr[0] >= 0 { b = sd_catn(body, b, ma_mem_scr[0]) } else { b = sd_cat(body, b, "na" as *u8) } 894 b = sd_cat(body, b, "-swap_used_permil=" as *u8) 895 if ma_mem_scr[1] >= 0 { b = sd_catn(body, b, ma_mem_scr[1]) } else { b = sd_cat(body, b, "na" as *u8) } 896 b = sd_cat(body, b, "\"" as *u8) 897 } 898 b = sd_cat(body, b, "]}" as *u8) 899 return ma_emit_200(out, body) 900} 901 902func ma_emit_health_file(snapfile: *u8, out: *u8) -> i64 { 903 let sbox: *i64 = sys_mmap(16) as *i64 904 let page: *u8 = md_read_file(snapfile, sbox) 905 if (page as i64) == 0 { 906 let empty: *u8 = sys_mmap(1) 907 return ma_emit_health(empty, 0, out) 908 } 909 return ma_emit_health(page, sbox[0], out) 910} 911 912// ---- auth + login (transport) ----------------------------------------------------------------------- 913 914func ma_authed(ctx: *NxAuthContext, req: *u8, req_n: i64) -> i64 { 915 let now_s: i64 = sys_now_realtime_sec() 916 if nx_sa_validate(ctx, req, req_n, now_s) == NX_MAUTH_OK { return 1 } 917 return 0 918} 919 920// ma_level_of: the caller's ACCESS LEVEL for this request. -1 = no/invalid session (=> 401); else 0..3 from the 921// SHARED access-granting path (session uid -> nishi_uid_handle.tsv -> roles.tsv). Composes nx_sa_validate_handle 922// (the SAME realm-bound session validation) + ag_uid_to_level (nx_access_lib) -- so /health + /api gate EXACTLY 923// like the hub gateway. This is what "lines the OPAQUE up with the access-granting system" for the mgmt plane. 924static ma_auth_index_path:*u8 925static ma_auth_roles_path:*u8 926func ma_auth_index()->*u8 { if (ma_auth_index_path as i64)!=0 { return ma_auth_index_path };return MA_IDX } 927func ma_auth_roles()->*u8 { if (ma_auth_roles_path as i64)!=0 { return ma_auth_roles_path };return MA_ROLES } 928func ma_level_of(ctx: *NxAuthContext, req: *u8, req_n: i64) -> i64 { 929 let now_s: i64 = sys_now_realtime_sec() 930 let uid: *u8 = sys_mmap(64); let uidn: *i64 = sys_mmap(8) as *i64 931 if nx_sa_validate_handle(ctx, req, req_n, now_s, uid, 64, uidn) != NX_MAUTH_OK { return 0 - 1 } 932 return ag_uid_to_level(uid, uidn[0], ma_auth_index(), ma_auth_roles()) 933} 934 935func ma_confirmed(req: *u8, req_n: i64) -> i64 { 936 let body_off: i64 = sd_body_off(req, req_n) 937 let body: *u8 = ((req as i64) + body_off) as *u8 938 let body_n: i64 = req_n - body_off 939 let coff: *i64 = sys_mmap(8) as *i64 940 let cn: *i64 = sys_mmap(8) as *i64 941 if sd_form_field(body, body_n, "confirm" as *u8, 7, coff, cn) == 1 { 942 if md_slice_eq(body, coff[0], cn[0], "yes" as *u8, 0, 3) == 1 { return 1 } 943 } 944 return 0 945} 946 947func ma_login(ctx: *NxAuthContext, req: *u8, req_n: i64, out: *u8) -> i64 { 948 let body_off: i64 = sd_body_off(req, req_n) 949 let body: *u8 = ((req as i64) + body_off) as *u8 950 let body_n: i64 = req_n - body_off 951 let hoff: *i64 = sys_mmap(8) as *i64 952 let hn: *i64 = sys_mmap(8) as *i64 953 let poff2: *i64 = sys_mmap(8) as *i64 954 let pnn: *i64 = sys_mmap(8) as *i64 955 var got: i64 = 0 956 if sd_form_field(body, body_n, "handle" as *u8, 6, hoff, hn) == 1 { 957 if sd_form_field(body, body_n, "passphrase" as *u8, 10, poff2, pnn) == 1 { got = 1 } 958 } 959 var o: i64 = 0 960 var ok: i64 = 0 961 if got == 1 { 962 let hbuf: *u8 = sys_mmap(256) 963 let pbuf: *u8 = sys_mmap(512) 964 let h_dec: i64 = sd_urldecode(((body as i64) + hoff[0]) as *u8, hn[0], hbuf, 255) 965 let p_dec: i64 = sd_urldecode(((body as i64) + poff2[0]) as *u8, pnn[0], pbuf, 511) 966 if h_dec > 0 { if p_dec > 0 { 967 let tok: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES) 968 let tok_n: *i64 = sys_mmap(8) as *i64 969 tok_n[0] = 0 970 if nx_modern_auth_login(ctx, hbuf, h_dec, pbuf, p_dec, tok, NX_MAUTH_SESSION_TOKEN_BYTES, tok_n) == NX_MAUTH_OK { 971 let b64: *u8 = sys_mmap(256) 972 let b64_n: i64 = b64_encode(tok, NX_MAUTH_SESSION_TOKEN_BYTES, b64) 973 o = sd_cat(out, o, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8) 974 o = sd_catn(out, o, 12 + b64_n) 975 o = sd_cat(out, o, "\r\n\r\n{\"token\":\"" as *u8) 976 var z: i64 = 0 977 while z < b64_n { out[o] = b64[z]; o = o + 1; z = z + 1 } 978 o = sd_cat(out, o, "\"}" as *u8) 979 ok = 1 980 } 981 } } 982 } 983 if ok == 0 { o = sd_emit_401_json(out) } 984 return o 985} 986 987// ---- /api/upload (transport: parse query, allowlist via DATA, reassemble chunk -> stage <name>.new) -------- 988// THE keystone that lets an operator PUBLISH an artifact over the authenticated HTTPS API from ANYWHERE (the gap 989// nx_aw_send left: it needs the LAN). Chunked because ONE request (headers+body) must be <= SD_REQCAP (64KB) and 990// artifacts are megabytes: the client POSTs the raw bytes in <=48KB slices; here we APPEND them into <name>.upload 991// and, on the final chunk, atomically rename to <name>.new. ADDITIVE + NEVER-BRICK (#26): this ONLY writes the 992// staging files <name>.upload / <name>.new; it NEVER promotes/activates/touches the live <name>. Promotion + 993// health-check + auto-rollback stays entirely in /api/deploy. Fail-closed everywhere (unknown target/seq gap -> 994// 400 + nothing appended). The mgmt daemon is single-threaded (one request at a time, main's serve loop), so the 995// per-target expected-seq persisted in the <name>.upload.seq sidecar is race-free by construction. 996 997// ---- query-string helpers (the params ride in the request TARGET, since the body is the raw binary chunk) ----- 998 999// Locate the '?' in the request target slice path[0..pn); returns the index of the first byte AFTER '?', or -1. 1000func mau_query_off(path: *u8, pn: i64) -> i64 { 1001 var i: i64 = 0 1002 while i < pn { if (path[i] as i64) == 63 { return i + 1 } i = i + 1 } // 63 = '?' 1003 return 0 - 1 1004} 1005 1006// Extract query param `name` from the query string path[qoff..pn) into a null-terminated slice descriptor: 1007// on hit sets voff[0]/vlen[0] to the raw value slice (still %-encoded, terminated by '&' or end) and returns 1; 1008// 0 if absent. name matched as "name=" at a param boundary (start-of-query or just after '&'). Fail-closed: no 1009// url-decode here -- our params are ASCII names/ints/hex, and a stray '%' just stays literal (rejected downstream). 1010func mau_qparam(path: *u8, pn: i64, qoff: i64, name: *u8, name_n: i64, voff: *i64, vlen: *i64) -> i64 { 1011 if qoff < 0 { return 0 } 1012 var pos: i64 = qoff 1013 while pos < pn { 1014 var m: i64 = 1 1015 if pos + name_n + 1 > pn { m = 0 } 1016 if m == 1 { 1017 var i: i64 = 0 1018 while i < name_n { if (path[pos + i] as i64) != (name[i] as i64) { m = 0; i = name_n } else { i = i + 1 } } 1019 } 1020 if m == 1 { if (path[pos + name_n] as i64) != 61 { m = 0 } } // 61 = '=' 1021 // find end of this param's value (next '&' or end-of-query) 1022 var vend: i64 = pos 1023 var scan: i64 = 1 1024 while scan == 1 { 1025 if vend >= pn { scan = 0 } 1026 if scan == 1 { if (path[vend] as i64) == 38 { scan = 0 } } // 38 = '&' 1027 if scan == 1 { vend = vend + 1 } 1028 } 1029 if m == 1 { voff[0] = pos + name_n + 1; vlen[0] = vend - (pos + name_n + 1); return 1 } 1030 pos = vend + 1 1031 } 1032 return 0 1033} 1034 1035// parse a non-negative decimal from path[off..off+len). Returns the value, or -1 if empty / any non-digit byte 1036// (fail-closed: a malformed seq must NOT silently coerce to 0 and get treated as the truncating first chunk). 1037func mau_qint(path: *u8, off: i64, len: i64) -> i64 { 1038 if len <= 0 { return 0 - 1 } 1039 var v: i64 = 0 1040 var i: i64 = 0 1041 while i < len { 1042 let c: i64 = path[off + i] as i64 1043 if c < 48 { return 0 - 1 } 1044 if c > 57 { return 0 - 1 } 1045 v = v * 10 + (c - 48) 1046 i = i + 1 1047 } 1048 return v 1049} 1050 1051// build "<name>.upload" / "<name>.upload.seq" / "<name>.new" from the target slice path[toff..toff+tlen) into buf 1052// (null-terminated). suffix is a NUL-terminated cstr. Returns the length written. 1053func mau_build_path(path: *u8, toff: i64, tlen: i64, suffix: *u8, buf: *u8) -> i64 { 1054 var o: i64 = 0 1055 var i: i64 = 0 1056 while i < tlen { buf[o] = path[toff + i]; o = o + 1; i = i + 1 } 1057 var j: i64 = 0 1058 while suffix[j] != (0 as u8) { buf[o] = suffix[j]; o = o + 1; j = j + 1 } 1059 buf[o] = 0 as u8 1060 return o 1061} 1062 1063// read the expected-next seq from the sidecar file (ASCII int). Returns the int, or -1 if the sidecar is absent 1064// or unparseable (=> only seq 0 is valid, which (re)creates it -- a resumed/garbled sidecar can't inject a gap). 1065func mau_read_seq(sidecar: *u8) -> i64 { 1066 let szp: *i64 = sys_mmap(16) as *i64 1067 let buf: *u8 = sys_read_file(sidecar, szp) 1068 if (buf as i64) == 0 { return 0 - 1 } 1069 let n: i64 = szp[0] 1070 if n <= 0 { return 0 - 1 } 1071 return mau_qint(buf, 0, n) // reuse the strict digit parser; trailing '\n' -> -1, so keep it clean (no newline) 1072} 1073 1074// write the next-expected seq (ASCII, NO trailing newline) into the sidecar (O_CREAT|O_TRUNC 0644). Returns 0/-1. 1075func mau_write_seq(sidecar: *u8, val: i64) -> i64 { 1076 let fd: i64 = sys_openat_wr(sidecar, 0x1a4) // 0644 1077 if fd < 0 { return 0 - 1 } 1078 let t: *u8 = sys_mmap(24) 1079 var m: i64 = val 1080 var k: i64 = 0 1081 if m == 0 { t[0] = 48 as u8; k = 1 } 1082 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 1083 let ob: *u8 = sys_mmap(24) 1084 var i: i64 = 0 1085 while i < k { ob[i] = t[k - 1 - i]; i = i + 1 } 1086 sys_write(fd, ob, k) 1087 sys_close(fd) 1088 return 0 1089} 1090 1091// lowercase-hex of a 32-byte digest into out[0..64) (NUL-terminated). 1092func mau_hex32(dig: *u8, out: *u8) -> i64 { 1093 let hx: *u8 = "0123456789abcdef" as *u8 1094 var i: i64 = 0 1095 while i < 32 { 1096 let b: i64 = dig[i] & 0xff 1097 out[i * 2] = hx[(b >> 4) & 0xf] 1098 out[i * 2 + 1] = hx[b & 0xf] 1099 i = i + 1 1100 } 1101 out[64] = 0 as u8 1102 return 64 1103} 1104 1105// case-insensitive compare of the provided sha256 hex slice path[hoff..hoff+hlen) against the computed 64-char hex. 1106// 1 = match, 0 = mismatch (or a non-64-length provided value -> refuse, fail-closed). 1107func mau_hex_eq(path: *u8, hoff: i64, hlen: i64, want: *u8) -> i64 { 1108 if hlen != 64 { return 0 } 1109 var i: i64 = 0 1110 while i < 64 { 1111 var a: i64 = path[hoff + i] as i64 1112 var b: i64 = want[i] as i64 1113 if a >= 65 { if a <= 90 { a = a + 32 } } // ASCII upper -> lower 1114 if b >= 65 { if b <= 90 { b = b + 32 } } 1115 if a != b { return 0 } 1116 i = i + 1 1117 } 1118 return 1 1119} 1120 1121// create every parent directory of `path` (idempotent; EEXIST is fine). Only ever called on paths that 1122// already passed the fail-closed target allowlists, so the walk stays inside the pinned namespace. 1123func mau_mkdirs(path: *u8) -> i64 { 1124 let tmp: *u8 = sys_mmap(320) 1125 var i: i64 = 0 1126 while path[i] != (0 as u8) { 1127 if (path[i] as i64) == 47 { if i > 0 { 1128 var k: i64 = 0 1129 while k < i { tmp[k] = path[k]; k = k + 1 } 1130 tmp[i] = 0 as u8 1131 sys_mkdir(tmp, 0x1ed) 1132 } } 1133 i = i + 1 1134 } 1135 return 0 1136} 1137 1138// THE handler: parse ?target&seq&final[&sha256] from the request target, allowlist-check the target, then APPEND 1139// the raw body chunk into <target>.upload with strict monotonic-seq enforcement; on final=1 (optionally verifying 1140// sha256) atomically rename to <target>.new. Returns response bytes. Never touches the live artifact. 1141func ma_do_upload(req: *u8, req_n: i64, out: *u8) -> i64 { 1142 // -- locate the request target (path + query) and the body slice -- 1143 let poff: *i64 = sys_mmap(8) as *i64 1144 let plen: *i64 = sys_mmap(8) as *i64 1145 poff[0] = 0; plen[0] = 0 1146 sd_find_path(req, req_n, poff, plen) 1147 let path: *u8 = ((req as i64) + poff[0]) as *u8 1148 let pn: i64 = plen[0] 1149 let qoff: i64 = mau_query_off(path, pn) 1150 if qoff < 0 { return ma_emit_400(out, "{\"error\":\"missing query params (target/seq/final)\"}" as *u8) } 1151 1152 let toff: *i64 = sys_mmap(8) as *i64 1153 let tlen: *i64 = sys_mmap(8) as *i64 1154 let soff: *i64 = sys_mmap(8) as *i64 1155 let slen: *i64 = sys_mmap(8) as *i64 1156 let foff: *i64 = sys_mmap(8) as *i64 1157 let flen: *i64 = sys_mmap(8) as *i64 1158 if mau_qparam(path, pn, qoff, "target" as *u8, 6, toff, tlen) != 1 { return ma_emit_400(out, "{\"error\":\"missing target\"}" as *u8) } 1159 if mau_qparam(path, pn, qoff, "seq" as *u8, 3, soff, slen) != 1 { return ma_emit_400(out, "{\"error\":\"missing seq\"}" as *u8) } 1160 if mau_qparam(path, pn, qoff, "final" as *u8, 5, foff, flen) != 1 { return ma_emit_400(out, "{\"error\":\"missing final\"}" as *u8) } 1161 1162 // -- fail-closed allowlist (DATA ring): service binary OR static-content namespace. unknown -> nothing written. -- 1163 var tok_ok: i64 = md_upload_target_ok(path, toff[0], tlen[0]) 1164 if tok_ok != 1 { tok_ok = md_content_target_ok(path, toff[0], tlen[0]) } 1165 if tok_ok != 1 { return ma_emit_400(out, "{\"error\":\"target not allowlisted\"}" as *u8) } 1166 1167 let seq: i64 = mau_qint(path, soff[0], slen[0]) 1168 let fin: i64 = mau_qint(path, foff[0], flen[0]) 1169 if seq < 0 { return ma_emit_400(out, "{\"error\":\"bad seq (non-numeric)\"}" as *u8) } 1170 if fin < 0 { return ma_emit_400(out, "{\"error\":\"bad final (non-numeric)\"}" as *u8) } 1171 1172 // -- build the staging + sidecar + promote paths from the (allowlisted) target basename -- 1173 let stage: *u8 = sys_mmap(256) 1174 let sidecar: *u8 = sys_mmap(256) 1175 let newp: *u8 = sys_mmap(256) 1176 mau_build_path(path, toff[0], tlen[0], ".upload" as *u8, stage) 1177 mau_build_path(path, toff[0], tlen[0], ".upload.seq" as *u8, sidecar) 1178 mau_build_path(path, toff[0], tlen[0], ".new" as *u8, newp) 1179 1180 // -- strict monotonic-seq gate (single-threaded daemon => race-free sidecar) -- 1181 if seq == 0 { 1182 // first chunk: (re)start the transfer -- TRUNCATE stage, reset sidecar. Any prior partial is discarded. 1183 // Multi-page content targets may live in subdirs (wholesale sites): create parents inside the 1184 // pinned, allowlist-validated namespace so the stage write cannot fail on a missing directory. 1185 mau_mkdirs(stage) 1186 } else { 1187 let expected: i64 = mau_read_seq(sidecar) 1188 if expected != seq { 1189 // IDEMPOTENT REPLAY-ACK (safe-to-run-twice): the edge relay LOSES responses AND re-delivers STALE 1190 // earlier chunks under rapid chunk storms; the client then re-sees a chunk the daemon ALREADY 1191 // appended, and a plain bad-seq reject desyncs+aborts the whole transfer (observed: 650KB/80-chunk 1192 // uploads dying at ~12-14). (a) non-final replay: seq < expected -> those bytes are ALREADY in the 1193 // stage; ack WITHOUT appending (a second append would corrupt the artifact; the final sha256 1194 // still end-to-end verifies the reassembled bytes). BROADENED from seq==expected-1 to seq<expected 1195 // (2026-07-24) so a stale duplicate of ANY earlier chunk is a no-op, not a fatal bad-seq. 1196 if expected >= 1 { if seq < expected { if fin != 1 { 1197 let ab2: *u8 = sys_mmap(256) 1198 var a2: i64 = sd_cat(ab2, 0, "{\"action\":\"UPLOAD\",\"target\":\"" as *u8) 1199 a2 = md_cat_slice(ab2, a2, path, toff[0], tlen[0]) 1200 a2 = sd_cat(ab2, a2, "\",\"seq\":" as *u8) 1201 a2 = sd_catn(ab2, a2, seq) 1202 a2 = sd_cat(ab2, a2, ",\"final\":0,\"replay\":1}" as *u8) 1203 return ma_emit_200(out, ab2) 1204 } } } 1205 // (b) final-chunk replay AFTER a completed transfer: sidecar already dropped (expected=-1) and 1206 // <target>.new exists. Fail-closed: ack ONLY when the client's sha256 param matches the 1207 // staged .new bytes (the client always sends sha on final) -- then this replay IS the same 1208 // completed upload; re-emit the STAGED response instead of desyncing the client. 1209 if expected < 0 { if fin == 1 { 1210 let rhoff: *i64 = sys_mmap(8) as *i64 1211 let rhlen: *i64 = sys_mmap(8) as *i64 1212 if mau_qparam(path, pn, qoff, "sha256" as *u8, 6, rhoff, rhlen) == 1 { 1213 let rszp: *i64 = sys_mmap(16) as *i64 1214 let rfull: *u8 = sys_read_file(newp, rszp) 1215 if (rfull as i64) != 0 { 1216 let rdig: *u8 = sys_mmap(32) 1217 sha256_digest(rfull, rszp[0], rdig) 1218 let rhex: *u8 = sys_mmap(72) 1219 mau_hex32(rdig, rhex) 1220 if mau_hex_eq(path, rhoff[0], rhlen[0], rhex) == 1 { 1221 let rb2: *u8 = sys_mmap(320) 1222 var b3: i64 = sd_cat(rb2, 0, "{\"action\":\"UPLOAD\",\"target\":\"" as *u8) 1223 b3 = md_cat_slice(rb2, b3, path, toff[0], tlen[0]) 1224 b3 = sd_cat(rb2, b3, "\",\"bytes\":" as *u8) 1225 b3 = sd_catn(rb2, b3, rszp[0]) 1226 b3 = sd_cat(rb2, b3, ",\"final\":1,\"replay\":1,\"staged\":\"" as *u8) 1227 b3 = md_cat_slice(rb2, b3, path, toff[0], tlen[0]) 1228 b3 = sd_cat(rb2, b3, ".new\"}" as *u8) 1229 return ma_emit_200(out, rb2) 1230 } 1231 } 1232 } 1233 } } 1234 return ma_emit_400(out, "{\"error\":\"bad seq\"}" as *u8) // gap / out-of-order / no prior seq=0 -> reject, append NOTHING 1235 } 1236 } 1237 1238 // -- body slice: everything past the CRLFCRLF header terminator (raw chunk bytes) -- 1239 let body_off: i64 = sd_body_off(req, req_n) 1240 let body: *u8 = ((req as i64) + body_off) as *u8 1241 let body_n: i64 = req_n - body_off 1242 1243 // -- write the chunk via the SHIPPED primitive (seq0 truncates+creates, seq>0 appends) -- compose, don't re-open -- 1244 if mu_stage_chunk(stage, seq, body, body_n) < 0 { return ma_emit_400(out, "{\"error\":\"cannot open staging file\"}" as *u8) } 1245 // advance the expected-seq sidecar to the next chunk number 1246 mau_write_seq(sidecar, seq + 1) 1247 1248 // -- non-final chunk: ack and wait for the next -- 1249 if fin != 1 { 1250 let ab: *u8 = sys_mmap(256) 1251 var a: i64 = sd_cat(ab, 0, "{\"action\":\"UPLOAD\",\"target\":\"" as *u8) 1252 a = md_cat_slice(ab, a, path, toff[0], tlen[0]) 1253 a = sd_cat(ab, a, "\",\"seq\":" as *u8) 1254 a = sd_catn(ab, a, seq) 1255 a = sd_cat(ab, a, ",\"final\":0}" as *u8) 1256 return ma_emit_200(out, ab) 1257 } 1258 1259 // -- FINAL chunk: read back the assembled staging file (for size + optional integrity) -- 1260 let szp: *i64 = sys_mmap(16) as *i64 1261 let full: *u8 = sys_read_file(stage, szp) 1262 let total: i64 = szp[0] 1263 if (full as i64) == 0 { return ma_emit_400(out, "{\"error\":\"staging file vanished before finalize\"}" as *u8) } 1264 1265 // -- optional sha256 verification of the WHOLE assembled artifact -- 1266 let hoff: *i64 = sys_mmap(8) as *i64 1267 let hlen: *i64 = sys_mmap(8) as *i64 1268 if mau_qparam(path, pn, qoff, "sha256" as *u8, 6, hoff, hlen) == 1 { 1269 let dig: *u8 = sys_mmap(32) 1270 sha256_digest(full, total, dig) 1271 let hexbuf: *u8 = sys_mmap(72) 1272 mau_hex32(dig, hexbuf) 1273 if mau_hex_eq(path, hoff[0], hlen[0], hexbuf) != 1 { 1274 fio_unlink(stage) // shred the corrupt upload (never leave a bad .upload around) 1275 fio_unlink(sidecar) 1276 return ma_emit_400(out, "{\"error\":\"sha256 mismatch; staging deleted\"}" as *u8) 1277 } 1278 } 1279 1280 // -- atomically stage for /api/deploy: <target>.upload -> <target>.new (never the live <target>) -- 1281 let rr: i64 = sys_renameat(stage, newp) 1282 fio_unlink(sidecar) // transfer done; drop the seq sidecar 1283 if rr != 0 { return ma_emit_400(out, "{\"error\":\"stage rename failed\"}" as *u8) } 1284 1285 let rb: *u8 = sys_mmap(320) 1286 var b: i64 = sd_cat(rb, 0, "{\"action\":\"UPLOAD\",\"target\":\"" as *u8) 1287 b = md_cat_slice(rb, b, path, toff[0], tlen[0]) 1288 b = sd_cat(rb, b, "\",\"bytes\":" as *u8) 1289 b = sd_catn(rb, b, total) 1290 b = sd_cat(rb, b, ",\"final\":1,\"staged\":\"" as *u8) 1291 b = md_cat_slice(rb, b, path, toff[0], tlen[0]) 1292 b = sd_cat(rb, b, ".new\"}" as *u8) 1293 return ma_emit_200(out, rb) 1294} 1295 1296// ---- write actions (transport orchestration: parse here, allowlist/exec/probe via DATA, decide via CORE) -- 1297// Each is a thin pipeline: parse request -> (data) resolve/validate/exec/probe -> (core) decide -> serialize. 1298 1299const MA_DEPLOY_STATUS: *u8 = "/tmp/nx_ma_deploy_status" as *u8 1300func ma_write_status(s: *u8) -> i64 { 1301 let fd: i64 = sys_openat_wr(MA_DEPLOY_STATUS, 0x1a4) 1302 if fd >= 0 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd, s, n); sys_close(fd) } 1303 return 0 1304} 1305// GET /api/deploy_status -> the last deploy's async watchdog verdict (RUNNING|DEPLOYED-GREEN|ROLLED-BACK|PROMOTE-FAILED|none). 1306// ---- GET /api/adnet/invoice (debt 1785513943): make the billing pipeline REACHABLE --------------- 1307// nx_adnet_bill held correct CPM/CPC math that NOTHING called -- zero production callers, only its gate. 1308// A green gate on an uncallable library is still the baseline, so the capability ships as a ROUTE: a 1309// mgmt route is instantly callable, whereas a new MCP tool needs every seat to reconnect. 1310// THIN BY CONSTRUCTION: file access is md_adnet_invoice_report (data ring), money math is nx_adnet_bill, 1311// the rate/event join is nx_adnet_invoice. This function owns transport and nothing else. 1312// 503 rather than 200-with-nothing: an empty invoice and an unreadable one must never look alike. 1313// ---- POST /api/adnet/creative (debt 1785512202): advertiser creative upload ----------------------- 1314// CLOSES THE CHICKEN-AND-EGG: nx_adnet_selfserve requires the img field to be a FIRST-PARTY url, and 1315// nothing in the ecosystem ever let an advertiser produce one -- so no client could onboard at all. 1316// The raw request body IS the png. THIN BY CONSTRUCTION: validation and content-addressed naming are 1317// nx_adnet_creative (gated 13/13), the write is md_adnet_creative_store (data ring); this owns transport. 1318// EVERY REFUSAL NAMES A REMEDIABLE REASON. An advertiser who cannot tell WHY their upload bounced will 1319// mail the operator a png instead, and the self-serve path quietly dies of support load. 1320func ma_do_adnet_creative(req: *u8, req_n: i64, out: *u8) -> i64 { 1321 let body_off: i64 = sd_body_off(req, req_n) 1322 let body: *u8 = ((req as i64) + body_off) as *u8 1323 let body_n: i64 = req_n - body_off 1324 if body_n <= 0 { 1325 return ma_emit_400(out, "{\"error\":\"empty body: POST the png bytes as the raw request body\",\"spec\":\"png, exactly 728x90, at most 65536 bytes\"}" as *u8) 1326 } 1327 let url: *u8 = sys_mmap(256) 1328 let v: i64 = md_adnet_creative_store(body, body_n, url, 256) 1329 if v == ACR_OK { 1330 let rb: *u8 = sys_mmap(MA_MAGIC_1024) 1331 var b: i64 = sd_cat(rb, 0, "{\"action\":\"CREATIVE-ACCEPTED\",\"url\":\"" as *u8) 1332 b = sd_cat(rb, b, url) 1333 b = sd_cat(rb, b, "\",\"note\":\"content-addressed. Put this url in the img field of your inventory row. Re-uploading identical bytes is idempotent; changed artwork mints a NEW url, so the creative can be cached without ever going stale.\"}" as *u8) 1334 rb[b] = 0 as u8 1335 return ma_emit_200(out, rb) 1336 } 1337 if v < 0 { 1338 return ma_emit_503(out, "{\"error\":\"creative validated but could not be written to the docroot; NOTHING was stored\"}" as *u8) 1339 } 1340 let rsn: *u8 = sys_mmap(128) 1341 acr_reason(v, rsn) 1342 let eb: *u8 = sys_mmap(512) 1343 var e: i64 = sd_cat(eb, 0, "{\"action\":\"CREATIVE-REFUSED\",\"reason\":\"" as *u8) 1344 e = sd_cat(eb, e, rsn) 1345 e = sd_cat(eb, e, "\",\"spec\":\"png, exactly 728x90, at most 65536 bytes\",\"why\":\"the weight ceiling is enforced at intake: a banner heavy enough to slow the host page reflects on the client who paid for it\"}" as *u8) 1346 eb[e] = 0 as u8 1347 return ma_emit_400(out, eb) 1348} 1349 1350func ma_do_adnet_invoice(out: *u8) -> i64 { 1351 let rep: *u8 = sys_mmap(MA_MAGIC_65536) 1352 let n: i64 = md_adnet_invoice_report(rep, MA_MAGIC_65536) 1353 if n <= 0 { 1354 return ma_emit_503(out, "{\"error\":\"adnet invoice unavailable: inventory or rate card unreadable. Refusing to emit an empty invoice, which a biller cannot tell apart from a genuinely zero one.\",\"basis\":\"viewable\"}" as *u8) 1355 } 1356 return ma_emit_json(out, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nConnection: close\r\nContent-Length: " as *u8, rep, n) 1357} 1358 1359func ma_do_deploy_status(out: *u8) -> i64 { 1360 let b: *u8 = sys_mmap(256); var n: i64 = 0 1361 let fd: i64 = sys_openat_rd(MA_DEPLOY_STATUS) 1362 if fd >= 0 { n = sys_read(fd, b, 200); sys_close(fd) } 1363 let rb: *u8 = sys_mmap(512); var o: i64 = sd_cat(rb, 0, "{\"deploy_status\":\"" as *u8) 1364 if n > 0 { var i: i64=0; while i<n { if b[i]!=(10 as u8) { if b[i]!=(13 as u8) { rb[o]=b[i]; o=o+1 } } i=i+1 } } else { o = sd_cat(rb, o, "none" as *u8) } 1365 o = sd_cat(rb, o, "\"}" as *u8); rb[o] = 0 as u8 1366 return ma_emit_200(out, rb) 1367} 1368 1369// sanitize a build target name to [a-zA-Z0-9_] ONLY (no /, ., ..) -> prevents path escape in runtime/<name>.nx. 1370// Copies the slice into buf (NUL-terminated). Returns 1 if valid+copied, 0 if empty/too-long/illegal char. 1371func ma_sanitize_name(src: *u8, off: i64, len: i64, buf: *u8, cap: i64) -> i64 { 1372 if len <= 0 { return 0 } 1373 if len >= cap { return 0 } 1374 var i: i64 = 0 1375 while i < len { 1376 let c: i64 = src[off + i] as i64 1377 var ok: i64 = 0 1378 if c >= 48 { if c <= 57 { ok = 1 } } 1379 if c >= 65 { if c <= 90 { ok = 1 } } 1380 if c >= 97 { if c <= 122 { ok = 1 } } 1381 if c == 95 { ok = 1 } 1382 if ok == 0 { return 0 } 1383 buf[i] = src[off + i] 1384 i = i + 1 1385 } 1386 buf[len] = 0 as u8 1387 return 1 1388} 1389// JSON-escape the LAST <maxsrc> bytes of src[0..n) into dst (NUL-terminated), for a build-diagnostic tail. 1390// Escapes " and \ and control bytes (newline/CR/tab -> \n \r \t; other <0x20 dropped). Bounds dst to <cap>. 1391// Returns the dst byte length. Surfaces the real nx_cc/nxasm error+line in a BUILD-FAILED JSON string field. 1392func ma_json_esc_tail(src: *u8, n: i64, maxsrc: i64, dst: *u8, cap: i64) -> i64 { 1393 var start: i64 = 0 1394 if n > maxsrc { start = n - maxsrc } 1395 var o: i64 = 0 1396 var i: i64 = start 1397 while i < n { 1398 if o + 8 >= cap { i = n } else { 1399 let c: i64 = src[i] as i64 1400 if c == 34 { dst[o] = 92 as u8; o = o + 1; dst[o] = 34 as u8; o = o + 1 } 1401 else { if c == 92 { dst[o] = 92 as u8; o = o + 1; dst[o] = 92 as u8; o = o + 1 } 1402 else { if c == 10 { dst[o] = 92 as u8; o = o + 1; dst[o] = 110 as u8; o = o + 1 } 1403 else { if c == 13 { dst[o] = 92 as u8; o = o + 1; dst[o] = 114 as u8; o = o + 1 } 1404 else { if c == 9 { dst[o] = 92 as u8; o = o + 1; dst[o] = 116 as u8; o = o + 1 } 1405 else { if c >= 32 { dst[o] = src[i]; o = o + 1 } } } } } } 1406 i = i + 1 1407 } 1408 } 1409 dst[o] = 0 as u8 1410 return o 1411} 1412// Read the LAST <cap> bytes of a file (0 if unreadable). The builder's full capture can be 1413// megabytes of per-function progress dots; the diagnostics sit at the END, so a bounded tail 1414// always contains them without ever loading the whole log. 1415func ma_read_tail(path: *u8, buf: *u8, cap: i64) -> i64 { 1416 let fd: i64 = sys_openat_rd(path) 1417 if fd < 0 { return 0 } 1418 let sz: i64 = sys_lseek(fd, 0, 2) 1419 var off: i64 = 0 1420 if sz > cap { off = sz - cap } 1421 sys_lseek(fd, off, 0) 1422 let n: i64 = sys_read(fd, buf, cap) 1423 sys_close(fd) 1424 if n < 0 { return 0 } 1425 return n 1426} 1427// First offset of NUL-terminated needle in src[0..n), or -1. Naive scan -- build logs are 1428// tail-bounded 16KB here, so there is no pathological input to be clever about. 1429func ma_find(src: *u8, n: i64, pat: *u8) -> i64 { 1430 var pl: i64 = 0 1431 while pat[pl] != (0 as u8) { pl = pl + 1 } 1432 if pl == 0 { return 0 - 1 } 1433 var i: i64 = 0 1434 var found: i64 = 0 - 1 1435 while i + pl <= n { 1436 var k: i64 = 0 1437 var ok: i64 = 1 1438 while k < pl { 1439 if src[i + k] != pat[k] { ok = 0; k = pl } else { k = k + 1 } 1440 } 1441 if ok == 1 { found = i; i = n } else { i = i + 1 } 1442 } 1443 return found 1444} 1445// file exists (openable for read)? 1 yes / 0 no. 1446func ma_path_exists(path: *u8) -> i64 { 1447 let fd: i64 = sys_openat_rd(path) 1448 if fd >= 0 { sys_close(fd); return 1 } 1449 return 0 1450} 1451// CROSS-TREE DUP-SHADOW detector (seq207/seq164, the clobber-landmine class): a <name>.nx present in BOTH 1452// buildroot/runtime/_hdl_build (probed FIRST by nx_sov_build_run) AND buildroot/runtime (the flat shadow) is a 1453// hazard -- a resolution-order change or a stale flat copy silently regresses the service (it detonated on 1454// nx_mgmt_api this session, dropping the F-210 control plane). Returns 1 if <name>.nx exists in both dirs. 1455// Composes nx_dup_source_check's exact detection logic, wired INLINE at build time = fail-loud, non-blocking. 1456// BANK THE STAGED SLOT BEFORE A REBUILD OVERWRITES IT (2026-08-03, debt 1785771729). 1457// MEASURED: /api/build stages <t>.sov.elf.new by overwrite, with NO warning and NO backup -- so a second 1458// seat's pending release vanishes without a trace the moment anyone rebuilds that target. That is the SAME 1459// blind-clobber class nx_fs_write already refuses via expect= (seq1379); here BANKING is the right remedy 1460// rather than refusing, because refusing would break every ordinary rebuild, while a .prev costs one rename 1461// and keeps the bytes. Wires the EXISTING .prev primitive (promote/deploy/route all use it) -- never a 2nd. 1462// Returns 1 if a prior staged artifact was banked, else 0. Fail-safe: any failure leaves the slot untouched. 1463func ma_bank_staged(nm: *u8) -> i64 { 1464 let cur: *u8 = sys_mmap(512) 1465 var c: i64 = sd_cat(cur, 0, nm) 1466 c = sd_cat(cur, c, ".sov.elf.new" as *u8) 1467 cur[c] = 0 as u8 1468 let fd: i64 = sys_openat_rd(cur) 1469 if fd < 0 { return 0 } 1470 sys_close(fd) 1471 let prev: *u8 = sys_mmap(512) 1472 var p: i64 = sd_cat(prev, 0, cur) 1473 p = sd_cat(prev, p, ".prev" as *u8) 1474 prev[p] = 0 as u8 1475 if sys_renameat(cur, prev) != 0 { return 0 } 1476 return 1 1477} 1478// RESTORE the banked staged artifact when the compile FAILED (2026-08-03, same debt). 1479// WHY THIS IS MANDATORY, not tidiness: 45 tool_allowlist rows EXECUTE a `<t>.sov.elf.new` directly (the 1480// `stagedref` class, incl. 5 deliberate `*_staged` tools). BEFORE banking, a failed rebuild left the old .new 1481// untouched and those tools kept working; WITH banking and no restore, a failed compile would leave the slot 1482// EMPTY and silently break every one of them. A BANK WITHOUT A RESTORE-ON-FAILURE CONVERTS A HARMLESS FAILED 1483// BUILD INTO AN OUTAGE -- pair the copy with the exit code, always. 1484func ma_restore_staged(nm: *u8) -> i64 { 1485 let cur: *u8 = sys_mmap(512) 1486 var c: i64 = sd_cat(cur, 0, nm) 1487 c = sd_cat(cur, c, ".sov.elf.new" as *u8) 1488 cur[c] = 0 as u8 1489 let prev: *u8 = sys_mmap(512) 1490 var p: i64 = sd_cat(prev, 0, cur) 1491 p = sd_cat(prev, p, ".prev" as *u8) 1492 prev[p] = 0 as u8 1493 // Only restore into an EMPTY slot: if the compile actually produced a .new we must never clobber it 1494 // with the older banked copy (that would be the very silent-overwrite this whole change exists to stop). 1495 let fd: i64 = sys_openat_rd(cur) 1496 if fd >= 0 { sys_close(fd); return 0 } 1497 if sys_renameat(prev, cur) != 0 { return 0 } 1498 return 1 1499} 1500// hex-STRING equality (two NUL-terminated renderings). NAMED ma_hexstr_eq because ma_hex_eq is ALREADY 1501// TAKEN at nx_mgmt_api.nx:2582 with a different arity (hex, buf, off, n) -- NishiLang has no overloading, so 1502// the build failed CLOSED on the collision. ⚠the compiler reported the clash at "line 21181", which is BEYOND 1503// EOF for this 290KB file; the real prior definition is at 2582. A diagnostic with a bogus line number sends 1504// you to the wrong place -- grep the NAME, do not trust the number. 1505func ma_hexstr_eq(a: *u8, b: *u8) -> i64 { 1506 var i: i64 = 0 1507 while a[i] != (0 as u8) { 1508 if a[i] != b[i] { return 0 } 1509 i = i + 1 1510 } 1511 if b[i] != (0 as u8) { return 0 } 1512 return 1 1513} 1514// sha256 of a file bytes, rendered hex into `hexout` (65 bytes incl NUL). 1 = ok, 0 = unreadable. 1515// Same sha256_digest + mau_hex32 pair the staged-artifact digest already uses -- not a second derivation. 1516 1517// Identity is read from the executing inode, never the mutable install pathname. 1518// This identifies the process answering this request; it is not a hardware attestation. 1519func ma_release_identity(out: *u8) -> i64 { 1520 let hex: *u8=sys_mmap(65) 1521 if ma_file_sha_hex("/proc/self/exe",hex) != 1 { 1522 sys_munmap(hex,65) 1523 return ma_emit_503(out,"{\"error\":\"running executable identity could not be read\",\"stage\":\"release-identity\",\"action\":\"inspect this process executable mapping; do not accept release readiness\"}") 1524 } 1525 let prefix: *u8="{\"schema\":\"nishi.release-identity.v1\",\"sha256\":\"" 1526 let suffix: *u8="\",\"basis\":\"running-executable\"}" 1527 let capacity: i64=sd_len(prefix)+64+sd_len(suffix)+1 1528 let body: *u8=sys_mmap(capacity) 1529 var n: i64=sd_cat(body,0,prefix) 1530 n=sd_cat(body,n,hex);n=sd_cat(body,n,suffix);body[n]=0 as u8 1531 let result: i64=ma_emit_200(out,body) 1532 sys_munmap(body,capacity);sys_munmap(hex,65) 1533 return result 1534} 1535func ma_file_sha_hex(path: *u8, hexout: *u8) -> i64 { 1536 var size: i64=0 1537 let bytes: *u8 = tea_read_conf(path, &size) 1538 if (bytes as i64) == 0 { return 0 } 1539 let dig: *u8 = sys_mmap(32) 1540 sha256_digest(bytes, size, dig) 1541 mau_hex32(dig, hexout) 1542 sys_munmap(bytes,size+1) 1543 sys_munmap(dig,32) 1544 return 1 1545} 1546 1547func ma_build_dup_shadow(nm: *u8) -> i64 { 1548 let pa: *u8 = sys_mmap(256) 1549 var a: i64 = sd_cat(pa, 0, "buildroot/runtime/_hdl_build/" as *u8) 1550 a = sd_cat(pa, a, nm); a = sd_cat(pa, a, ".nx" as *u8); pa[a] = 0 as u8 1551 let pb: *u8 = sys_mmap(256) 1552 var b: i64 = sd_cat(pb, 0, "buildroot/runtime/" as *u8) 1553 b = sd_cat(pb, b, nm); b = sd_cat(pb, b, ".nx" as *u8); pb[b] = 0 as u8 1554 if ma_path_exists(pa) == 1 { if ma_path_exists(pb) == 1 { return 1 } } 1555 return 0 1556} 1557// POST /api/build {target=<name>}: COMPILE a target ON THE NAS via the on-NAS toolchain (nx_hostctl buildrun) 1558// -> stage <name>.sov.elf.new for /api/deploy. The build half of build-over-API: source->binary with ZERO WSL. 1559// Name sanitized to [a-zA-Z0-9_] (no path escape); target must already exist in the synced buildroot/runtime. 1560// On success, a `dup_shadow` field warns fail-loud if the source basename exists in BOTH source dirs (seq207). 1561// PURE RENDERER FOR THE BUILD-ADMISSION REFUSAL, EXTRACTED 2026-08-20 SO THE PROPERTY IS TESTABLE. 1562// The branch that produces this body only fires when the real host is saturated, and a gate must never 1563// be asked to reproduce a volatile host condition -- that is a request to remove the sensor, not to test 1564// it. Splitting the DECISION (host state, nx_build_admit's job) from the RENDERING (this function) puts 1565// the half that can silently drift -- the words -- somewhere a gate can hold it with a fixture. 1566// A MESSAGE NOBODY CAN TEST IS A MESSAGE THAT WILL DRIFT, AND THIS ONE DRIFTED LONG ENOUGH TO COST A DAY 1567// OF LANES RE-PLANNING AROUND A CAUSE THAT COULD NOT HAVE FIRED. 1568// 1569// AND THE PROSE BRANCHES ON THE RECEIPT (2026-08-20, closes debt 1787178882). It used to promise "NOT 1570// forgotten: an enqueue was launched" UNCONDITIONALLY, while the rc it printed two fields later said the 1571// enqueue had failed -- measured 2026-08-19 as queue_launch_rc=4 with the deployq- row MISSING and the 1572// capture file ABSENT. A RECEIPT THAT STATES AN OUTCOME IT ALSO REPORTS AS FAILED IS WORSE THAN SILENCE: 1573// the machine-readable field was right and the sentence everybody actually reads was wrong, so callers 1574// went away to wait for a build nothing was going to run. The rc now decides the sentence. 1575func ma_build_refusal_body(bao: *u8, ban: i64, batr: i64, nm: *u8, qrc: i64, qout: *u8) -> *u8 { 1576 let qb: *u8 = sys_mmap(MA_MAGIC_32768) 1577 var qp: i64 = sd_cat(qb, 0, "{\"error\":\"build REFUSED by nx_build_admit. THIS ENDPOINT DELIBERATELY DOES NOT RESTATE THE CAUSE -- read admit_detail: it is the detector's own verdict line plus the live /proc figures behind it, and those figures name WHICH of its three conjuncts fired (an I/O storm on the D-state roster, run-queue CPU saturation, or the storm load ceiling). Do not assume CPU: on this host the load ceiling is set far above any reachable load, so an I/O storm is the usual firing conjunct. The build did NOT run. " as *u8) 1578 if qrc == 0 { qp = sd_cat(qb, qp, "It is NOT forgotten: the enqueue was LAUNCHED AND RETURNED rc=0, so this build fires on the first nx_orchestrate pass with build headroom (headroom: predicate, ~5 min cadence) -- verify the row landed with nx_store_put knowledge/store/deployq- load and find the BQ-<target> row: its status column reads queued until nx_orchestrate fires it and fired-rc0 afterwards. DO NOT reach for nx_planepeek here -- it resolves a RAW SEG-STORE KEY (q:<n>), never a row id, so nx_planepeek deployq- BQ-<target> answers MISS for a row that IS present, which reads exactly like a failed enqueue. That instruction was wrong from 2026-08-18 until it was measured and corrected 2026-08-20: A RECEIPT THAT NAMES THE WRONG VERIFICATION COMMAND MANUFACTURES THE VERY FAILURE IT WAS WRITTEN TO DISPROVE. The build result lands in knowledge/store/planrun-build-<target>-; promote deliberately afterwards. WHERE THIS AND admit_detail DISAGREE ABOUT QUEUING, BELIEVE THIS ONE -- queue_launch_rc is the receipt and the detector cannot see it. The detector's own text was CORRECTED 2026-08-20 and now agrees: it says it queues nothing itself and points at this very field, so the two should no longer disagree at all. If you are reading an admit_detail that still ends NOTHING IS QUEUED for you anywhere, you are looking at an OLDER nx_build_admit binary -- that is staleness in the detector, not here. " as *u8) } 1579 if qrc != 0 { qp = sd_cat(qb, qp, "AND THE ENQUEUE FAILED -- NOTHING IS QUEUED FOR YOU ANYWHERE. queue_launch_rc below is NON-ZERO, so the absorber did not take this build and nothing will retry it on your behalf: RE-ISSUE IT YOURSELF once the load clears, paced a minute or more apart, and read queue_launch_out for the capture. This endpoint used to promise an enqueue unconditionally while its rc said otherwise (debt 1787178882, measured rc=4 with the deployq- row MISSING), which sent callers away to wait for a build nobody was going to run. " as *u8) } 1580 qp = sd_cat(qb, qp, "If this build is itself the repair for the saturation, use the sovereign path _offc/nx_sov_build_run.elf <target> --build-only, which does not consult mgmt admission.\",\"detector\":\"nx_build_admit\",\"verdict\":\"REFUSED-BUILD-ADMIT\",\"queued\":" as *u8) 1581 var qok: i64 = 0 1582 if qrc == 0 { qok = 1 } 1583 qp = sd_catn(qb, qp, qok) 1584 qp = sd_cat(qb, qp, ",\"admit_detail\":\"" as *u8) 1585 qp = ma_gate_esc(qb, qp, bao, ban) 1586 qp = sd_cat(qb, qp, "\",\"admit_detail_bytes\":" as *u8) 1587 qp = sd_catn(qb, qp, ban) 1588 qp = sd_cat(qb, qp, ",\"admit_detail_truncated\":" as *u8) 1589 qp = sd_catn(qb, qp, batr) 1590 qp = sd_cat(qb, qp, ",\"queue_row\":\"BQ-" as *u8) 1591 qp = sd_cat(qb, qp, nm) 1592 qp = sd_cat(qb, qp, "\",\"queue_launch\":\"nx_job_run nx_buildq add\",\"queue_launch_rc\":" as *u8) 1593 qp = sd_catn(qb, qp, qrc) 1594 qp = sd_cat(qb, qp, ",\"queue_launch_out\":\"" as *u8) 1595 qp = sd_cat(qb, qp, qout) 1596 qp = sd_cat(qb, qp, "\"}}" as *u8) 1597 qb[qp] = 0 as u8 1598 return qb 1599} 1600 1601// PURE RENDERER FOR THE PROMOTE REFUSAL, EXTRACTED 2026-08-20 -- the same move, for the same reason, as 1602// ma_build_refusal_body directly above it. The branch that produces this body needs a staged artifact 1603// PLUS a provenance history to fire, and a gate must never be asked to reproduce that state; splitting 1604// the DECISION (md_promote_staged_ex) from the RENDERING (here) puts the half that silently drifts -- 1605// the words -- somewhere a fixture can hold it. 1606// A MESSAGE NOBODY CAN TEST IS A MESSAGE THAT WILL DRIFT, AND THIS ONE'S DRIFT WAS MEASURED IN 1607// BREAK-GLASS COPIES: labelled NOTHING-STAGED, it sent a seat to nx_filecopy twice in one day to restore 1608// gate binaries by hand, because a refusal that misdescribes itself teaches every reader to bypass it. 1609// Returns 0 for any code this renderer does not own -- the caller falls through to its existing paths. 1610const MA_PROMOTE_REFUSE_BACKWARDS: i64 = 0 - 2 1611const MA_PROMOTE_REFUSE_CAPLOSS: i64 = 0 - 3 1612func ma_promote_refusal_body(mprc: i64, nm: *u8, livehex: *u8) -> *u8 { 1613 var owned: i64 = 0 1614 if mprc == MA_PROMOTE_REFUSE_BACKWARDS { owned = 1 } 1615 if mprc == MA_PROMOTE_REFUSE_CAPLOSS { owned = 1 } 1616 if owned == 0 { return 0 as *u8 } 1617 let pb: *u8 = sys_mmap(MA_MAGIC_4096) 1618 var p: i64 = 0 1619 if mprc == MA_PROMOTE_REFUSE_BACKWARDS { p = sd_cat(pb, 0, "{\"action\":\"REFUSED-BACKWARDS-WALK\",\"target\":\"" as *u8) } 1620 if mprc == MA_PROMOTE_REFUSE_CAPLOSS { p = sd_cat(pb, 0, "{\"action\":\"REFUSED-CAPABILITY-LOSS\",\"target\":\"" as *u8) } 1621 p = sd_cat(pb, p, nm) 1622 p = sd_cat(pb, p, "\",\"staged\":\"the staged .elf.new IS in place and UNTOUCHED -- this is a REFUSAL, not an absence\",\"live_sha256\":\"" as *u8) 1623 p = sd_cat(pb, p, livehex) 1624 p = sd_cat(pb, p, "\",\"reason\":\"" as *u8) 1625 if mprc == MA_PROMOTE_REFUSE_BACKWARDS { p = sd_cat(pb, p, "PROVENANCE (seq1484): the staged bytes are a generation this target ALREADY HELD and are not its newest, so promoting them would walk it BACKWARDS. THE allow_capability_loss FLAG DOES NOT COVER THIS AND NEVER DID -- md_prov_ok runs unconditionally and that flag gates a different conjunct entirely. WHAT TO DO: if this is a deliberate rollback use /api/rollback, which is the reverse gear and records itself as one -- do NOT copy the binary into place by hand, that is how a restore stops being auditable. If you believe these bytes are NEW, compare live_sha256 above with the artefact you built: equal means it is ALREADY live and only your receipt was lost in transport. If you are re-promoting a rebuilt organ, rebuild from CURRENT source -- a binary identical to an older generation means your source is behind, not that the guard is wrong." as *u8) } 1626 if mprc == MA_PROMOTE_REFUSE_CAPLOSS { p = sd_cat(pb, p, "STAGING HYGIENE: the staged artifact would replace the live one with something the hygiene classifier judges a capability LOSS -- older than what it replaces, or dropping live capability tokens even while LARGER, since neither mtime nor size alone catches the class. THIS is the conjunct that allow_capability_loss=yes covers. WHAT TO DO: run nx_contentdiff on the live elf against the staged one and READ ITS LOST lines. If every lost run is a deliberate reword you can NAME, re-issue with allow_capability_loss=yes and name them in the same breath; if you cannot name them, the staged build is a regression and the flag would ship it." as *u8) } 1627 p = sd_cat(pb, p, "\"}" as *u8) 1628 pb[p] = 0 as u8 1629 return pb 1630} 1631 1632// ---- THE ENQUEUE, EXTRACTED (2026-09-02) so the two refusal sites below cannot drift ------------------- 1633// Launch `nx_buildq add <target>` DETACHED through nx_job_run (it forks the job and returns in milliseconds; 1634// a plane put can take ~90 s under contention and this handler must never block on it). Returns the 1635// launcher rc. The row id is deterministic (BQ-<target>) and nx_store_put re-puts BY ID, so calling this 1636// twice for one target yields ONE row -- MEASURED 2026-09-02 over the whole deployq- plane: 231 rows, 1637// 231 distinct ids, zero duplicates. The queue is idempotent by construction, which is why every refusal 1638// path may call this without dedupe bookkeeping. 1639func ma_build_enqueue(nm: *u8, qout: *u8) -> i64 { 1640 var qo: i64 = sd_cat(qout, 0, "/tmp/nx_buildq_" as *u8) 1641 qo = sd_cat(qout, qo, nm) 1642 qo = sd_cat(qout, qo, ".out" as *u8) 1643 qout[qo] = 0 as u8 1644 let qargs: *i64 = sys_mmap(8 * 6) as *i64 1645 qargs[0] = "nx_buildq" as *u8 as i64 1646 qargs[1] = qout as i64 1647 qargs[2] = "add" as *u8 as i64 1648 qargs[3] = nm as i64 1649 return dep_run_capture("/volume1/homes/elderwesto/nishihost/nx_job_run.elf" as *u8, qargs, 4, "/tmp/nx_buildq_launch.out" as *u8) 1650} 1651// ---- THE RUNNER'S OWN ADMISSION REFUSAL, RECOGNISED (2026-09-02; debt 1787939090, the FIFTH filing) ----- 1652// /api/build admits ONCE (md_exec_build_admit) and then forks hostctl buildrun, whose child 1653// nx_sov_build_run consults the SAME ruler again moments later and exits SBR_ADMIT_REFUSED (6) when the 1654// box moved under it. hostctl echoes `child exit=6 sig=0` into the capture. Until now that fell through 1655// to BUILD-FAILED ("nx_cc/nxasm produced no elf; is the target in buildroot/runtime?") -- an admission 1656// refusal wearing a compile failure's clothes -- so under a real storm the absorber branch was NEVER 1657// REACHED, nothing was queued, and the caller was sent to inspect a target that was never compiled. 1658// Measured 2026-08-28 at procs_blocked=8 of 8 and re-derived here from source. TWO ADMISSION CHECKS IN 1659// SERIES ARE A RACE WHOSE LOSING BRANCH MUST STILL LAND IN THE QUEUE, OR THE QUEUE IS DECORATION. 1660// Returns 1 iff the capture carries the runner's refusal; the caller then takes the QUEUE branch. 1661func ma_runner_refused(pbuf: *u8, pn: i64) -> i64 { 1662 if ma_find(pbuf, pn, "child exit=6 sig=0" as *u8) >= 0 { return 1 } 1663 return 0 1664} 1665 1666func ma_do_build(req: *u8, req_n: i64, out: *u8) -> i64 { 1667 let body_off: i64 = sd_body_off(req, req_n) 1668 let body: *u8 = ((req as i64) + body_off) as *u8 1669 let body_n: i64 = req_n - body_off 1670 let toff: *i64 = sys_mmap(8) as *i64 1671 let tn: *i64 = sys_mmap(8) as *i64 1672 if sd_form_field(body, body_n, "target" as *u8, 6, toff, tn) != 1 { 1673 return ma_emit_400(out, "{\"error\":\"missing target\"}" as *u8) 1674 } 1675 let nm: *u8 = sys_mmap(128) 1676 if ma_sanitize_name(body, toff[0], tn[0], nm, 120) != 1 { 1677 return ma_emit_400(out, "{\"error\":\"invalid target name (only [a-zA-Z0-9_])\"}" as *u8) 1678 } 1679 // BUILD ADMISSION -- MUST run BEFORE the nx_cc fork below (seq708/768/1390). Forking the compiler on 1680 // a memory-wedged host is what OOM-reaps this very daemon and takes the deploy path down for every 1681 // seat, so the check has to gate the fork, not report on it afterwards. 1682 // 1683 // TWO BLOCKING VERDICTS (corrected 2026-07-30). Exit 3 = DENY, MemAvailable below the floor: the 1684 // measured 2026-07-20 wedge, where userspace could not fork at all. Exit 4 = QUEUE, the load ceiling. 1685 // THE EXIT-4 BLOCK WAS LIVE IN THE DEPLOYED BINARY AND IN THE LAPTOP TREE BUT ABSENT FROM THIS ONE -- 1686 // the buildroot /api/build actually compiles -- so the next build by ANY seat would have silently 1687 // deleted seq1475's backpressure, with no error anywhere. Landed here so a rebuild cannot lose it. 1688 // Blocking on exit 4 is safe ONLY because nx_build_admit now CONFIRMS the load against procs_running 1689 // (the TRUE run queue, R not D) before returning it: a disk-bound host no longer reads as CPU 1690 // saturation, so the false refusals that deadlocked every seat are gone. Gate nx_build_admit_gate 1691 // 10/10 including a revert-detecting neg-control. usage/unreadable-proc still fall through to build. 1692 let admit: i64 = md_exec_build_admit() 1693 if admit == 3 { 1694 return ma_emit_503(out, "{\"error\":\"build refused: host below the memory floor. Forking the compiler now risks wedging the host and OOM-reaping the mgmt API for every seat. The detector prints the live figure and the floor it used -- run nx_build_admit.elf check to see both. Retry after 30s.\",\"detector\":\"nx_build_admit\",\"verdict\":\"DENY-MEM\"}" as *u8) 1695 } 1696 if admit == 4 { 1697 // QUEUE INSTEAD OF FORGET (2026-08-18). This branch used to say "nothing is queued for you anywhere -- 1698 // re-issue it yourself", which made every seat the retry loop for the box. The absorber now exists: 1699 // nx_orchestrate's `headroom:` predicate + nx_buildq (plan-build-<t>- + deployq BQ-<t>). Launch the 1700 // enqueue DETACHED through nx_job_run (it forks the job and returns in milliseconds; a plane put can 1701 // take ~90 s under contention and this handler must never block on it), then answer honestly: the 1702 // build did NOT run (still 503), the enqueue was LAUNCHED (rc reported), and the row is the proof -- 1703 // the response names where to look rather than claiming QUEUED from intention. Fail-open: a failed 1704 // launch changes nothing about the refusal, it only reports its rc. 1705 let qout: *u8 = sys_mmap(MA_MAGIC_1024) 1706 // no thresholds relayed: the queue row's bare `headroom:` and this path's own admission both read 1707 // knowledge/build_admit.conf, so "fires when this build would have been admitted" holds by 1708 // construction with ONE definition of the envelope. The launch itself is ma_build_enqueue (above), 1709 // SHARED with the runner-refusal branch in the BUILD-FAILED path so the two sites cannot drift. 1710 let qrc: i64 = ma_build_enqueue(nm, qout) 1711 // ---- STOP PARAPHRASING ANOTHER ORGAN'S VERDICT (2026-08-20, upgrades debt 1787178882) ---- 1712 // A HAND-COPIED RESTATEMENT OF ANOTHER ORGAN'S VERDICT IS A DUPLICATE RULER MADE OF PROSE: it 1713 // drifts silently, no gate can see it drift, and it sends every reader at the wrong cause. 1714 // WHAT THIS SAID AND WHY IT WAS WRONG: "host load above 1.00 x ncpu AND the run queue confirms 1715 // CPU saturation". nx_build_admit's OWN verdict text states a THREE-WAY DISJUNCTION -- the 1716 // D-state roster shows an I/O storm (procs_blocked >= blocked_max), OR the run queue confirms 1717 // CPU saturation (procs_running >= ncpu), OR load exceeds the storm ceiling -- and it adds "the 1718 // figures above name which fired". The paraphrase collapsed that into a definite AND, which is a 1719 // COMPOUND ASSERTION THAT WILL NOT NAME ITS FAILING CONJUNCT, so the reader always guesses. 1720 // MEASURED HERE 2026-08-20 from the detector's own live line: max_centiload=100000 against 1721 // load1_centi=1552, so the LOAD conjunct is structurally unreachable on this lane -- the one 1722 // cause this sentence named is the one cause that cannot have fired, while procs_blocked was 1723 // observed at 7 of 8. Lanes spent a day re-planning around a cause that was never the cause. 1724 // THE FIX IS PASS-THROUGH, NOT A BETTER SENTENCE. Correcting the paraphrase would only reset its 1725 // drift clock. md_exec_build_admit already captures the detector's stdout to this exact path, so 1726 // the authoritative text costs one read; it is carried VERBATIM in admit_detail and this handler 1727 // now asserts NOTHING about the cause. 1728 // ONE CLAIM STAYS LOCAL, DELIBERATELY, AND THE CONTRADICTION IS NAMED RATHER THAN INHERITED: 1729 // the detector's text still ends "NOTHING IS QUEUED for you anywhere (the planned wait-for- 1730 // opening absorber was retired unbuilt)". That sentence is stale IN THE DETECTOR, not here -- 1731 // the absorber was built on 2026-08-18 (nx_buildq + nx_orchestrate's headroom: predicate) and 1732 // THIS branch launches the enqueue a few lines above and holds its rc. A blind pass-through 1733 // would therefore have shipped a REGRESSION, replacing a true local statement with a stale 1734 // remote one. Pass through what the other organ OWNS (the cause); keep what this one owns (that 1735 // it queued, and the receipt); and say which is authoritative so the next reader fixes the 1736 // detector's sentence instead of re-deriving all of this. 1737 let bao: *u8 = sys_mmap(MA_MAGIC_4096) 1738 let ban: i64 = dp_read("/tmp/nx_build_admit.out" as *u8, bao, MA_MAGIC_4000) 1739 // NO SILENT CAP: the read is bounded, so the bound and whether it bit are both reported. 1740 var batr: i64 = 0 1741 if ban >= MA_MAGIC_4000 { batr = 1 } 1742 return ma_emit_503(out, ma_build_refusal_body(bao, ban, batr, nm, qrc, qout)) 1743 } 1744 // ---- GATE-DRY RATCHET (2026-07-31, debts 1785529506 / 1785530277): STOP THE BLEEDING ON D001 ---- 1745 // L009 -- gates that hand-roll their verdict instead of inheriting nx_gate_verdict -- grew from 1746 // 2035/2167 to 2041/2182 within a SINGLE SESSION on 2026-07-31. A campaign that only migrates old 1747 // gates LOSES to a tree that adds new ones, so the count is gated HERE, at the one act that admits 1748 // a new gate to the ecosystem. This is the missing half: the migrator removes, the ratchet holds. 1749 // 1750 // IT IS A RATCHET, NOT A WALL. Only a gate with NO deployed artefact -- a NEW one -- is held to the 1751 // base class. The 2041 existing breaches are GRANDFATHERED and migrated by their owner lanes; 1752 // refusing them here would stop every seat dead. Same grandfathering nx_magicratchet described. 1753 // 1754 // u26a0THE PREDECESSOR THIS SHOULD HAVE COPIED DOES NOT EXIST: nx_magicratchet is asserted "wired into 1755 // /api/build" in FOUR comments in nx_law_warden.nx, yet grep finds ZERO call sites here AND ZERO in 1756 // the deployed mgmt binary, and a two-build experiment (clean -> BUILT, +3 literals >=1024 -> BUILT) 1757 // proves it never fires. Rule 11 has no submission gate. This one is written fresh and, unlike that 1758 // one, is proven by a NEGATIVE CONTROL rather than by a comment. 1759 // 1760 // FAIL-OPEN: md_exec_gatedry returns -1 when the detector is absent, and the build proceeds. 1761 // u26a0ENFORCEMENT WITHDRAWN 2026-07-31, SAME SESSION IT LANDED -- MY GRANDFATHER TEST WAS WRONG. 1762 // I keyed "is this gate NEW?" on "has no deployed .elf". That is FALSE for most of the corpus: 1763 // the ledger measures 2877 gate sources against 175 binaries, i.e. ~94pc of gates WERE NEVER 1764 // COMPILED. So deployclass_gate and roleaccess_gate -- in the tree for weeks -- both read as NEW 1765 // and their rebuilds were REFUSED. A ratchet that blocks the existing corpus is a WALL, and a wall 1766 // at a shared chokepoint stops every seat. 1767 // The detector (nx_gatedry) is sound and stays live; only the REFUSAL is withdrawn until the 1768 // grandfather test is sound. A correct one needs a BANKED BASELINE of known gate names (the 1769 // Notion model: violations are recorded, and only an INCREASE against the record is refused) -- 1770 // absence of a build artefact is not evidence of newness. 1771 // Per the 2026 guidance this should also re-enter as a WARNING first and escalate to an error. 1772 if md_name_is_gate(nm) == 1 { 1773 if md_gate_in_baseline(nm) == 0 { 1774 let gsrc: *u8 = sys_mmap(256) 1775 var gp: i64 = 0 1776 let gpre: *u8 = "buildroot/runtime/_hdl_build/" 1777 var gi: i64 = 0 1778 while gpre[gi] != (0 as u8) { gsrc[gp] = gpre[gi]; gp = gp + 1; gi = gi + 1 } 1779 gi = 0 1780 while nm[gi] != (0 as u8) { gsrc[gp] = nm[gi]; gp = gp + 1; gi = gi + 1 } 1781 let gsuf: *u8 = ".nx" 1782 gi = 0 1783 while gsuf[gi] != (0 as u8) { gsrc[gp] = gsuf[gi]; gp = gp + 1; gi = gi + 1 } 1784 gsrc[gp] = 0 as u8 1785 let gdv: i64 = md_exec_gatedry(gsrc) 1786 if gdv == 1 { 1787 return ma_emit_400(out, "{\"error\":\"NEW GATE REFUSED: it hand-rolls its verdict instead of inheriting nx_gate_verdict (L009/D001). Existing gates are GRANDFATHERED -- this applies only to a gate with no deployed artefact, so the fix is to write the new one on the base class, not to migrate anything. Use gv_ctr/gv_head/gv_check/gv_verdict. Run nx_gatedry <src> to see the classification.\",\"detector\":\"nx_gatedry\",\"verdict\":\"CUSTOM-VERDICT\"}" as *u8) 1788 } 1789 if gdv == 2 { 1790 return ma_emit_400(out, "{\"error\":\"NEW GATE REFUSED: it emits no verdict= anchor, so nx_gate_green reads a PASSING run as NOT-GREEN and the gate is structurally unjudgeable (seq585). Emit through nx_gate_verdict (gv_verdict) and the anchor comes with it. Run nx_gatedry <src> to see the classification.\",\"detector\":\"nx_gatedry\",\"verdict\":\"NO-VERDICT\"}" as *u8) 1791 } 1792 } 1793 } 1794 1795 // ---- F881: RULE 11 FINALLY GETS ITS SUBMISSION GATE (2026-08-15, debt 1785530277) ----------------- 1796 // OUTSIDE the gate-name test on purpose: rule 11 is not a gate-only law, so every organ is checked. 1797 // nx_magicratchet exits 0 GRANT -- including first-sight self-baseline and ALLOW-UNCOUNTED -- and 3 1798 // ONLY when a MEASURED count exceeds a MEASURED baseline. Absent detector, unreadable source and 1799 // usage error all return non-3 and the build proceeds. The failure direction is therefore "an organ 1800 // that should have been refused gets built", which is the correct direction at a shared chokepoint 1801 // and the same stance build admission and the gate-dry runner already take. 1802 // THE REFUSAL CARRIES THE DETECTOR'S OWN WORDS -- file, line, column, value, proposed const. A 1803 // refusal that does not say what and how is a guard people learn to route around. 1804 let mrv: i64 = md_exec_magicratchet(nm) 1805 if mrv == 3 { 1806 return ma_emit_400(out, "{\"error\":\"BUILD REFUSED: this build ADDS inline magic numbers (rule 11) against the organ's banked baseline. The ratchet only lets the count go DOWN, and existing violations are grandfathered at first sight -- so this is a NEW literal, not old debt. Run nx_magicratchet check <organ> for the offending line/col/value and a proposed const, then hoist it to a NAMED const -- named for its PURPOSE, never for its value.\",\"detector\":\"nx_magicratchet\",\"verdict\":\"MAGIC-INCREASE\"}" as *u8) 1807 } 1808 1809 // ---- R1 (seq1506): LEASE-GATE THE BUILD -- the flagger, not a brave driver ---------------------------- 1810 // OPERATOR: "why cant we clearly state when we are switching out or updating and coordinate like road 1811 // construction". Concurrent builds of the SAME target are how a session ships a regression from a 1812 // mid-churn snapshot: it happened TWICE today (mgmt lost /api/gate_run + /api/proc_kill, 21->19 routes, 1813 // because a sibling built while the tree was being edited). A race nobody can see is not a risk anyone 1814 // can manage -- so make the collision IMPOSSIBLE and, when it happens, NAME THE HOLDER. 1815 // ADOPTION not invention (seq1410, 4th instance today): nx_lease already existed, gate-proven, with ZERO 1816 // callers here. Reused by its exit-code contract (0=acquired, 3=BUSY) -- no import, no reimplementation. 1817 // TTL 600s is why this cannot deadlock the ecosystem: a session that dies mid-build cannot hold the lane 1818 // closed. A lock without a TTL would be a worse defect than the race it prevents. 1819 // ---- seq1337 RESTORED (lost to source churn; operator: "this is the top fix as its wasting our work") ---- 1820 // WHY THIS MUST EXIST: a compile that outlives the edge read window is INDISTINGUISHABLE from an infra 503 1821 // at the caller, which is exactly how a COMPILER HANG masquerades as an outage. I lived it repeatedly today: 1822 // FETCH-FAIL/503 with no way to tell "still compiling" from "the edge died" from "the host is wedged", so the 1823 // only strategy left is retry-hammering -- which adds load to the very condition being waited on. 1824 // async=yes DETACHES the compile and returns AT ONCE with a poll path. The caller then polls a marker that 1825 // can ONLY exist once the build actually finished, so the two states become DIFFERENT OBSERVABLES rather 1826 // than one ambiguous timeout. The marker is written to a tmp path and RENAMED (atomic), so a reader never 1827 // sees a half-written verdict. The path carries a millisecond timestamp, so a PREVIOUS run's marker can 1828 // never be mistaken for this one's result -- staleness is foreclosed by construction, not by cleanup. 1829 let aoff: *i64 = sys_mmap(8) as *i64 1830 let anf: *i64 = sys_mmap(8) as *i64 1831 var want_async: i64 = 0 1832 if sd_form_field(body, body_n, "async" as *u8, 5, aoff, anf) == 1 { if anf[0] >= 1 { if body[aoff[0]] == (121 as u8) { want_async = 1 } } } 1833 if want_async == 1 { 1834 sys_mkdir("_jobs" as *u8, 0x1ed) 1835 let stamp: i64 = sys_now_realtime_ms() 1836 let jdone: *u8 = sys_mmap(256) 1837 let jout: *u8 = sys_mmap(256) 1838 let jtmp: *u8 = sys_mmap(256) 1839 var jo: i64 = sd_cat(jdone, 0, "_jobs/build_" as *u8); jo = sd_cat(jdone, jo, nm); jo = sd_cat(jdone, jo, "_" as *u8); jo = sd_catn(jdone, jo, stamp); jo = sd_cat(jdone, jo, ".done" as *u8); jdone[jo] = 0 as u8 1840 var jq: i64 = sd_cat(jout, 0, "_jobs/build_" as *u8); jq = sd_cat(jout, jq, nm); jq = sd_cat(jout, jq, "_" as *u8); jq = sd_catn(jout, jq, stamp); jq = sd_cat(jout, jq, ".out" as *u8); jout[jq] = 0 as u8 1841 var jt: i64 = sd_cat(jtmp, 0, "_jobs/build_" as *u8); jt = sd_cat(jtmp, jt, nm); jt = sd_cat(jtmp, jt, "_" as *u8); jt = sd_catn(jtmp, jt, stamp); jt = sd_cat(jtmp, jt, ".tmp" as *u8); jtmp[jt] = 0 as u8 1842 // Acquire BEFORE forking: the parent returns immediately, so if we left the lease to the sync path 1843 // below an async build would run UNGATED and a sibling could start a racing build of the same target. 1844 // The CHILD releases it when the compile actually ends (see below) -- releasing in the parent would 1845 // reopen the lane while the compiler is still running, which is the exact race R1 exists to prevent. 1846 let alnm: *u8 = sys_mmap(192) 1847 md_lease_name(nm, alnm) 1848 if md_lease_run("acquire" as *u8, alnm, "mgmt-api-build" as *u8, ma_lease_ttl_txt(MA_BUILD_LEASE_TTL_S), 4, "/tmp/nx_ma_lease.out" as *u8) == 3 { 1849 let albb: *u8 = sys_mmap(MA_MAGIC_2048) 1850 let albn: i64 = dp_read("/tmp/nx_ma_lease.out" as *u8, albb, 900) 1851 let acb: *u8 = sys_mmap(MA_MAGIC_4096) 1852 var aco: i64 = sd_cat(acb, 0, "{\"conflict\":\"lease-busy\",\"error\":\"another session is ALREADY BUILDING this exact target -- refusing to race it (seq1506 R1). The holder is named below; the lease is TTL-bounded so a dead session cannot hold the lane closed.\",\"holder\":\"" as *u8) 1853 aco = ma_gate_esc(acb, aco, albb, albn) 1854 aco = ts_retry_after_derived(acb, aco, MA_BUILD_LEASE_TTL_S) 1855 acb[aco] = 0 as u8 1856 return ma_emit_400(out, acb) 1857 } 1858 let abanked: i64 = ma_bank_staged(nm) // bank BEFORE the fork so BOTH build paths are covered (debt 1785771729) 1859 let apid: i64 = sys_fork() 1860 if apid == 0 { 1861 // DETACHED WORKER: shed the request fds so the parent's response is not held open by us, then 1862 // compile, then publish the verdict by ATOMIC RENAME. The lease is released HERE, not in the 1863 // parent, because the parent returns long before the compile ends -- releasing early would let a 1864 // sibling start a racing build of the same target while this one is still running. 1865 nx_setsid() 1866 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4) 1867 if dn >= 0 { sys_dup3(dn, 0, 0); sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 1868 md_exec_hostctl_capture2("buildrun" as *u8, nm, jout) 1869 let abuf: *u8 = sys_mmap(MA_MAGIC_16384) 1870 let an2: i64 = dp_read(jout, abuf, MA_MAGIC_16380) 1871 var built: i64 = 0 1872 var abytes: i64 = 0 1873 if an2 > 0 { abytes = hh_after(abuf, an2, "size=" as *u8); if abytes > 0 { built = 1 } } 1874 // same restore contract as the sync path: a failed async compile must not strand a stagedref tool 1875 if built == 0 { if abanked == 1 { ma_restore_staged(nm) } } 1876 let mb: *u8 = sys_mmap(256) 1877 var mo: i64 = sd_cat(mb, 0, "state=DONE built=" as *u8) 1878 mo = sd_catn(mb, mo, built) 1879 mo = sd_cat(mb, mo, " bytes=" as *u8) 1880 mo = sd_catn(mb, mo, abytes) 1881 mo = sd_cat(mb, mo, "\n" as *u8) 1882 let mfd: i64 = sys_openat_wr(jtmp, 0x1a4) 1883 if mfd >= 0 { sys_write(mfd, mb, mo); sys_close(mfd); sys_renameat(jtmp, jdone) } 1884 md_lease_run("release" as *u8, alnm, "mgmt-api-build" as *u8, "0" as *u8, 3, "/tmp/nx_ma_lease_async.out" as *u8) 1885 sys_exit(0) 1886 } 1887 let ab: *u8 = sys_mmap(MA_MAGIC_2048) 1888 var abo: i64 = sd_cat(ab, 0, "{\"action\":\"BUILD-STARTED\",\"target\":\"" as *u8) 1889 abo = sd_cat(ab, abo, nm) 1890 abo = sd_cat(ab, abo, "\",\"poll\":\"" as *u8); abo = sd_cat(ab, abo, jdone) 1891 abo = sd_cat(ab, abo, "\",\"out\":\"" as *u8); abo = sd_cat(ab, abo, jout) 1892 abo = sd_cat(ab, abo, "\",\"note\":\"ABSENT poll-file = STILL COMPILING, which is NOT an edge failure -- do not retry the build. When it appears it reads state=DONE built=<0|1> bytes=<n> and is written by ATOMIC RENAME so you never read a partial verdict. A build that NEVER produces it is a COMPILER HANG (seq1337), not an outage. Read it with nx_fs read.\"}" as *u8) 1893 ab[abo] = 0 as u8 1894 return ma_emit_200(out, ab) 1895 } 1896 let lnm: *u8 = sys_mmap(192) 1897 md_lease_name(nm, lnm) 1898 if md_lease_run("acquire" as *u8, lnm, "mgmt-api-build" as *u8, ma_lease_ttl_txt(MA_BUILD_LEASE_TTL_S), 4, "/tmp/nx_ma_lease.out" as *u8) == 3 { 1899 let lb: *u8 = sys_mmap(MA_MAGIC_2048) 1900 let ln: i64 = dp_read("/tmp/nx_ma_lease.out" as *u8, lb, 900) 1901 let cb: *u8 = sys_mmap(MA_MAGIC_4096) 1902 var co: i64 = sd_cat(cb, 0, "{\"conflict\":\"lease-busy\",\"error\":\"another session is ALREADY BUILDING this exact target -- refusing to race it (seq1506 R1). Building concurrently is how a mid-churn snapshot ships a regression. The holder is named below; the lease carries a TTL so a dead session can never hold the lane closed.\",\"holder\":\"" as *u8) 1903 co = ma_gate_esc(cb, co, lb, ln) 1904 co = ts_retry_after_derived(cb, co, MA_BUILD_LEASE_TTL_S) 1905 cb[co] = 0 as u8 1906 return ma_emit_400(out, cb) 1907 } 1908 let banked: i64 = ma_bank_staged(nm) // debt 1785771729: never silently clobber a staged artifact 1909 // PROVENANCE, CAPTURED AT THE MOMENT OF PRODUCTION (2026-08-07, debt 1786113214). mtime can ORDER two 1910 // writes but it cannot say one was MADE from the other: any promote by any seat resets an artifact mtime 1911 // and erases the evidence of an unadopted source edit, so a freshness check built on mtime has a 1912 // FALSE-FRESH direction -- the dangerous one, because FRESH is the answer that stops you looking. 1913 // A CLOCK CANNOT ESTABLISH PROVENANCE. RECORD IT WHERE IT IS CHEAP: HERE. LATER IT IS UNRECOVERABLE. 1914 // Hashed BEFORE and AFTER the compile: this tree has concurrent writers as its NORMAL condition (proven 1915 // repeatedly today), so a single hash could describe a different version than the compiler read. If the 1916 // two disagree the source moved mid-build and src_stable=0 says so rather than pretending precision. 1917 let pv_src: *u8 = sys_mmap(512) 1918 let pv_a: *u8 = sys_mmap(80) 1919 var pv_have: i64 = 0 1920 if ma_gate_src(nm, pv_src) == 1 { pv_have = ma_file_sha_hex(pv_src, pv_a) } 1921 // ---- ROOT CAUSE OF THE CROSS-TARGET COMPILE (2026-08-07, debt 1786128134 sev-9) ------------------ 1922 // This captured to the FIXED path /tmp/nx_ma_build.out. Every concurrent /api/build wrote and then 1923 // READ THE SAME FILE, so under load one request parsed another request's builder output and reported 1924 // that compile as its own. MEASURED TWICE TODAY: a build of nx_filecopy echoed 'nx_seg_store_gate', 1925 // and a build of nx_mgmt_api echoed 'nx_wasm_craft_gate' -- both while census jobs were forking builds. 1926 // It was never a mysterious lane gremlin: it is shared mutable state with a hardcoded name. 1927 // *A PER-REQUEST RESULT WRITTEN TO A PROCESS-WIDE PATH IS A RACE THAT REPORTS SOMEONE ELSE'S ANSWER AS 1928 // YOURS* -- and it fails SILENTLY whenever the two compiles both succeed, which is the common case. 1929 // The capture path is now per-target, so two builds cannot collide by construction. The name echo is 1930 // still compared below: the unique path removes the race, the comparison proves it stayed removed. 1931 let capp: *u8 = sys_mmap(256) 1932 var capo: i64 = sd_cat(capp, 0, "/tmp/nx_ma_build_" as *u8) 1933 capo = sd_cat(capp, capo, nm) 1934 capo = sd_cat(capp, capo, ".out" as *u8) 1935 capp[capo] = 0 as u8 1936 md_exec_hostctl_capture2("buildrun" as *u8, nm, capp) 1937 // Release IMMEDIATELY after the compile: everything below is formatting, so every later return path is 1938 // already covered and no exit can strand the lease. 1939 md_lease_run("release" as *u8, lnm, "mgmt-api-build" as *u8, "0" as *u8, 3, "/tmp/nx_ma_lease.out" as *u8) 1940 let pbuf: *u8 = sys_mmap(MA_MAGIC_16384) 1941 let pn: i64 = dp_read(capp, pbuf, MA_MAGIC_16380) 1942 // ---- CROSS-TARGET COMPILE REFUSAL (2026-08-07, debt 1786128134 sev-9) ----------------------------- 1943 // MEASURED LIVE under concurrent load: `POST /api/build target=nx_filecopy` returned a diag reading 1944 // `[hostctl] buildrun: compile 'nx_seg_store_gate' on the NAS` -- the lane compiled a DIFFERENT TARGET 1945 // than the one requested. THAT run failed loudly. The silent case is the hazard: a SUCCESSFUL 1946 // wrong-target compile stages one organ's binary under another organ's name. 1947 // ★★★★★★expect_sha256 CANNOT CATCH THIS. It proves the staged bytes are the ones just built, and when 1948 // the wrong source was compiled that digest IS the wrong binary's digest -- so /api/promote installs 1949 // the wrong organ under the right name and answers PROMOTED. A GUARD THAT CHECKS THE ARTIFACT AGAINST 1950 // THE BUILD CANNOT TELL YOU THE BUILD WAS OF THE WRONG THING. 1951 // src_path/src_sha256 do not close it either: ma_gate_src DERIVES the path from the REQUESTED name, so 1952 // it agrees BY CONSTRUCTION regardless of what the compiler actually read. A field computed from the 1953 // question cannot corroborate the answer. 1954 // ★★★★★★THE ONLY WITNESS TO WHAT WAS COMPILED IS THE BUILDER'S OWN ECHO -- compare it HERE, once, in 1955 // the one place that already has it, instead of leaving the comparison to every caller forever. 1956 let xnm: *u8 = sys_mmap(256) 1957 if ma_compiled_name(pbuf, pn, xnm) == 1 { 1958 var xsame: i64 = 1 1959 var xi: i64 = 0 1960 var xgo: i64 = 1 1961 while xgo == 1 { 1962 let xa: i64 = xnm[xi] as i64 1963 let xbc: i64 = nm[xi] as i64 1964 if xa != xbc { xsame = 0; xgo = 0 } 1965 if xa == 0 { xgo = 0 } 1966 xi = xi + 1 1967 } 1968 if xsame == 0 { 1969 let xb: *u8 = sys_mmap(MA_MAGIC_2048) 1970 var xo: i64 = sd_cat(xb, 0, "{\"error\":\"CROSS-TARGET COMPILE REFUSED: you asked to build '" as *u8) 1971 xo = sd_cat(xb, xo, nm) 1972 xo = sd_cat(xb, xo, "' but the builder echoed compile '" as *u8) 1973 xo = sd_cat(xb, xo, xnm) 1974 xo = sd_cat(xb, xo, "'. NOTHING is reported as staged under your name from this run. expect_sha256 could not have caught this -- it verifies the artifact against the build, never the build against the request -- and src_path cannot either, because it is derived from the name you asked for. This is a concurrency fault in the lane, not a defect in your target: retry.\",\"requested\":\"" as *u8) 1975 xo = sd_cat(xb, xo, nm) 1976 xo = sd_cat(xb, xo, "\",\"compiled\":\"" as *u8) 1977 xo = sd_cat(xb, xo, xnm) 1978 xo = sd_cat(xb, xo, "\"" as *u8) 1979 xb[xo] = 0 as u8 1980 return ma_emit_400(out, xb) 1981 } 1982 } 1983 let sz: i64 = hh_after(pbuf, pn, "size=" as *u8) 1984 if sz > 0 { 1985 let rb: *u8 = sys_mmap(MA_MAGIC_2048) 1986 var b: i64 = sd_cat(rb, 0, "{\"action\":\"BUILT\",\"bytes\":" as *u8) 1987 b = sd_catn(rb, b, sz) 1988 b = sd_cat(rb, b, ",\"staged\":\"" as *u8) 1989 b = sd_cat(rb, b, nm) 1990 b = sd_cat(rb, b, ".sov.elf.new\"" as *u8) 1991 // ---- DL9 bq_dedupe_target (2026-09-02): A SYNC BUILD THAT SUCCEEDS CLOSES ITS OWN QUEUE ROW ---- 1992 // The QUEUE branch above seeds BQ-<nm> when admission refuses; if a later sync build of the same 1993 // target succeeds here, that row stayed `queued` and the poller rebuilt the same source on its next 1994 // opening. Launch `nx_buildq close <nm> 0` DETACHED through nx_job_run, exactly as the enqueue is 1995 // launched, and report its launch rc in the receipt. Fail-open: a failed launch changes nothing about 1996 // BUILT, it only reports; nothing to close is nx_buildq's own named NO-ROW, never an error. 1997 let cqout: *u8 = sys_mmap(MA_MAGIC_1024) 1998 var cqo: i64 = sd_cat(cqout, 0, "/tmp/nx_buildq_close_" as *u8) 1999 cqo = sd_cat(cqout, cqo, nm) 2000 cqo = sd_cat(cqout, cqo, ".out" as *u8) 2001 cqout[cqo] = 0 as u8 2002 let cqargs: *i64 = sys_mmap(8 * 6) as *i64 2003 cqargs[0] = "nx_buildq" as *u8 as i64 2004 cqargs[1] = cqout as i64 2005 cqargs[2] = "close" as *u8 as i64 2006 cqargs[3] = nm as i64 2007 cqargs[4] = "0" as *u8 as i64 2008 let cqrc: i64 = dep_run_capture("/volume1/homes/elderwesto/nishihost/nx_job_run.elf" as *u8, cqargs, 5, "/tmp/nx_buildq_close_launch.out" as *u8) 2009 b = sd_cat(rb, b, ",\"queue_close_launch\":\"nx_job_run nx_buildq close\",\"queue_close_launch_rc\":" as *u8) 2010 b = sd_catn(rb, b, cqrc) 2011 // ---- DIGEST RECEIPT ON THE BUILD (2026-08-06) ------------------------------------------------ 2012 // ★★★A GUARD WHOSE INPUT THE PREVIOUS STEP DOES NOT EMIT IS A GUARD NOBODY CAN USE. 2013 // /api/promote has carried an expect_sha256 refusal since 2026-07-30 -- it hashes the STAGED bytes 2014 // before any mutation and refuses if they are not the ones the caller says it built. That is exactly 2015 // the guard that stops a STALE <t>.sov.elf.new from being promoted and reported as a success. But 2016 // BUILD never emitted the digest, so nobody in the natural build->promote loop could supply it, and 2017 // in practice nobody ever did. The guard was live, correct, and unusable. 2018 // MEASURED THE COST 2026-08-06: promote installed a months-old build of the LIBRARY nx_https_get.nx 2019 // that happened to be sitting at nx_https_get.sov.elf.new, over a freshly staged artifact, and 2020 // answered {"action":"PROMOTED"} with the STALE artifact's bytes. It was caught only because the 2021 // byte count went DOWN after an addition -- i.e. by a human heuristic, not by the machine. 2022 // Emitting the digest here closes the loop: build hands you the number, promote refuses on mismatch. 2023 let sp: *u8 = sys_mmap(160) 2024 mau_build_path(nm, 0, sd_len(nm), ".sov.elf.new" as *u8, sp) 2025 let sszp: *i64 = sys_mmap(16) as *i64 2026 let sbytes: *u8 = md_read_file(sp, sszp) 2027 if (sbytes as i64) != 0 { 2028 let sdig: *u8 = sys_mmap(32) 2029 sha256_digest(sbytes, sszp[0], sdig) 2030 let shex: *u8 = sys_mmap(72) 2031 mau_hex32(sdig, shex) 2032 b = sd_cat(rb, b, ",\"sha256\":\"" as *u8) 2033 b = sd_cat(rb, b, shex) 2034 b = sd_cat(rb, b, "\",\"promote_hint\":\"pass expect_sha256=<this sha256> to /api/promote: it refuses unless the staged bytes are exactly these, which is the only mechanism that stops a stale or sibling-overwritten .sov.elf.new from going live and being reported as success\"" as *u8) 2035 // ---- PROVENANCE RECEIPT + SIDECAR (2026-08-07, debt 1786113214) -------------------------- 2036 // Re-hash the source now and compare with the pre-compile hash. Equal => the recorded digest 2037 // really describes the bytes that were compiled. Unequal => a concurrent writer moved the source 2038 // mid-build, and src_stable=0 declares that instead of implying a precision we do not have. 2039 if pv_have == 1 { 2040 let pv_b: *u8 = sys_mmap(80) 2041 var pv_stable: i64 = 0 2042 if ma_file_sha_hex(pv_src, pv_b) == 1 { pv_stable = ma_hexstr_eq(pv_a, pv_b) } 2043 b = sd_cat(rb, b, ",\"src_sha256\":\"" as *u8) 2044 b = sd_cat(rb, b, pv_a) 2045 b = sd_cat(rb, b, "\",\"src_path\":\"" as *u8) 2046 b = sd_cat(rb, b, pv_src) 2047 b = sd_cat(rb, b, "\",\"src_stable\":" as *u8) 2048 b = sd_catn(rb, b, pv_stable) 2049 // ---- CLOSURE PROVENANCE (written 2026-08-07, INSTALLED 2026-08-08) ---------------- 2050 // The receipt above describes the TARGET'S OWN source. It cannot answer the question 2051 // that actually blocks this estate: "was this artifact built from the same 2052 // DEPENDENCIES as that one?" -- the question the whole treecanon manifest exists to 2053 // approximate, and approximates BACKWARDS: the manifest is generated from the LAPTOP 2054 // mirror and used to judge the NAS tree, while edits land on the NAS via nx_fs_write 2055 // and builds compile FROM the NAS. So the guard compares truth against a stale mirror 2056 // and calls truth a fork. 2057 // ★★★★★★A MANIFEST IS A CLAIM ABOUT A TREE AT A PAST INSTANT; A CLOSURE HASH IS A 2058 // FACT ABOUT THE BINARY IN YOUR HAND. Recorded HERE it needs no push, no watermark, 2059 // no census, and nothing that can go stale between the write and the read. 2060 // ABSTAINS BY CONSTRUCTION: if nx_closurehash.elf is absent the field is simply 2061 // omitted and the build proceeds exactly as before. 2062 // ★A NEW RECEIPT MUST NEVER BE ABLE TO FAIL A BUILD. 2063 let clp: *u8 = sys_mmap(256) 2064 var clo: i64 = sd_cat(clp, 0, "/volume1/homes/elderwesto/nishihost/nx_closurehash.elf" as *u8) 2065 clp[clo] = 0 as u8 2066 let clh: *u8 = sys_mmap(80) 2067 var have_cl: i64 = 0 2068 let clfd: i64 = sys_openat_rd(clp) 2069 if clfd >= 0 { 2070 sys_close(clfd) 2071 let clout: *u8 = sys_mmap(MA_MAGIC_262144) 2072 let cll: *i64 = sys_mmap(16) as *i64 2073 let clav: *i64 = sys_mmap(64) as *i64 2074 clav[0] = clp as i64 2075 clav[1] = nm as i64 2076 clav[2] = "/volume1/homes/elderwesto/nishihost/buildroot" as *u8 as i64 2077 clav[3] = 0 2078 cll[0] = 0 2079 tr_run_capture_to(clp, clav, clout, MA_MAGIC_262140, cll, MA_MAGIC_60000) 2080 if be_after_hex(clout, cll[0], "closure_sha=" as *u8, clh) == 1 { have_cl = 1 } 2081 if have_cl == 1 { 2082 b = sd_cat(rb, b, ",\"closure_sha256\":\"" as *u8) 2083 b = sd_cat(rb, b, clh) 2084 b = sd_cat(rb, b, "\"" as *u8) 2085 } 2086 } 2087 // SIDECAR <target>.provenance: additive, one line, nothing reads it until something asks. 2088 // It exists so freshness can become an EXACT content comparison instead of a clock guess, 2089 // and it distinguishes the comment-only edit for free: the source hash moves while the elf 2090 // hash stays identical, which is precisely the pair a reader wants to see. 2091 let pvp: *u8 = sys_mmap(256) 2092 mau_build_path(nm, 0, sd_len(nm), ".provenance" as *u8, pvp) 2093 let pvb: *u8 = sys_mmap(MA_MAGIC_1024) 2094 var pvo: i64 = sd_cat(pvb, 0, "src_sha256=" as *u8) 2095 pvo = sd_cat(pvb, pvo, pv_a) 2096 pvo = sd_cat(pvb, pvo, " elf_sha256=" as *u8) 2097 pvo = sd_cat(pvb, pvo, shex) 2098 pvo = sd_cat(pvb, pvo, " src_stable=" as *u8) 2099 pvo = sd_catn(pvb, pvo, pv_stable) 2100 pvo = sd_cat(pvb, pvo, " src_path=" as *u8) 2101 pvo = sd_cat(pvb, pvo, pv_src) 2102 // CLOSURE ON THE SIDECAR, NOT JUST THE RESPONSE. A response is read once, by whoever 2103 // made the call; the sidecar is what a LATER reader can compare against. src_sha256 2104 // already makes freshness an exact content comparison for ONE file -- this extends the 2105 // same property to every dependency, which is the actual question the treecanon 2106 // manifest is trying to answer and cannot, because it describes a TREE instead of an 2107 // ARTIFACT. This field is what nx_provcheck reads to say CURRENT vs DRIFTED. 2108 // OMITTED WHEN UNKNOWN, never emitted empty: an absent field says "not measured", 2109 // while `closure_sha256=` with nothing after it would read as "measured, and it is 2110 // nothing". ★A GUARD THAT TURNS ABSENCE INTO A VERDICT IS THE ONE THAT GETS SWITCHED 2111 // OFF AFTER IT LIES ONCE -- which is why nx_provcheck's third state is UNRECORDED. 2112 if have_cl == 1 { 2113 pvo = sd_cat(pvb, pvo, " closure_sha256=" as *u8) 2114 pvo = sd_cat(pvb, pvo, clh) 2115 } 2116 pvo = sd_cat(pvb, pvo, "\n" as *u8) 2117 let pfd: i64 = sys_openat_wr(pvp, 0x1a4) 2118 if pfd >= 0 { sys_write(pfd, pvb, pvo); sys_close(pfd) } 2119 } 2120 // ENVELOPE: the SYNC build path only. The async worker (_async=1) does not write a sidecar yet, 2121 // so a consumer MUST treat an absent sidecar as "unknown, fall back to mtime" and never as stale. 2122 } 2123 // FAIL-LOUD, non-blocking: a SILENT bank is just a quieter clobber -- say so, and name where it went. 2124 if banked == 1 { 2125 b = sd_cat(rb, b, ",\"banked_prev\":\"" as *u8) 2126 b = sd_cat(rb, b, nm) 2127 b = sd_cat(rb, b, ".sov.elf.new.prev (a PRIOR staged artifact existed and was banked, not overwritten -- if you did not stage it, another seat did: check it before promoting)\"" as *u8) 2128 } 2129 // seq207 fail-loud, non-blocking: warn if a stale flat shadow of this source exists (clobber landmine). 2130 if ma_build_dup_shadow(nm) == 1 { 2131 b = sd_cat(rb, b, ",\"dup_shadow\":\"" as *u8) 2132 b = sd_cat(rb, b, nm) 2133 b = sd_cat(rb, b, ".nx exists in BOTH buildroot/runtime/_hdl_build (resolved first) AND buildroot/runtime (stale shadow); reconcile to ONE canonical dir (seq207)\"" as *u8) 2134 } 2135 b = sd_cat(rb, b, "}" as *u8) 2136 rb[b] = 0 as u8 2137 return ma_emit_200(out, rb) 2138 } 2139 // FAIL-LOUD (seq202, the organ-authoring multiplier): surface the captured nx_cc/nxasm diagnostic tail so an 2140 // API-first session sees the actual error+line, not a blind "no elf". The tail is the last of the build output. 2141 // COMPILE FAILED -> put the banked staged artifact BACK, or a stagedref tool that executes it breaks. 2142 var restored: i64 = 0 2143 if banked == 1 { restored = ma_restore_staged(nm) } 2144 // ---- RUNNER ADMISSION REFUSAL -> THE QUEUE BRANCH, NOT BUILD-FAILED (2026-09-02) ----------------- 2145 // See ma_runner_refused above. The restore has already run (the build did not happen, the banked stage 2146 // is back) and the lease is already released; what remains is to route this where an admission refusal 2147 // belongs: the same enqueue and the same REFUSED-BUILD-ADMIT body the pre-fork refusal answers with. 2148 if ma_runner_refused(pbuf, pn) == 1 { 2149 let rqout: *u8 = sys_mmap(MA_MAGIC_1024) 2150 let rqrc: i64 = ma_build_enqueue(nm, rqout) 2151 // admit_detail = the builder's OWN BUILD-ADMIT line, taken from the per-target capture (hostctl 2152 // echoes the builder's tail into it) or, failing that, from /tmp/buildrun.out -- never paraphrased 2153 // (the duplicate-ruler-made-of-prose law, 2026-08-20). Absent both, say so instead of inventing a cause. 2154 let rbao: *u8 = sys_mmap(MA_MAGIC_4096) 2155 var rban: i64 = 0 2156 var rsrc: *u8 = pbuf 2157 var rsn: i64 = pn 2158 var rap: i64 = ma_find(pbuf, pn, "BUILD-ADMIT" as *u8) 2159 if rap < 0 { 2160 let rfb: *u8 = sys_mmap(MA_MAGIC_65536) 2161 let rfn: i64 = ma_read_tail("/tmp/buildrun.out" as *u8, rfb, MA_MAGIC_65500) 2162 rap = ma_find(rfb, rfn, "BUILD-ADMIT" as *u8) 2163 rsrc = rfb 2164 rsn = rfn 2165 } 2166 if rap >= 0 { 2167 var rq: i64 = rap 2168 while rq < rsn { if rban < MA_MAGIC_4000 { rbao[rban] = rsrc[rq]; rban = rban + 1 } rq = rq + 1 } 2169 } else { 2170 rban = sd_cat(rbao, 0, "runner refused admission (hostctl echoed child exit=6 = SBR_ADMIT_REFUSED) but its BUILD-ADMIT line was in neither capture; the refusal is real, its printed figures were lost" as *u8) 2171 } 2172 var rbatr: i64 = 0 2173 if rban >= MA_MAGIC_4000 { rbatr = 1 } 2174 return ma_emit_503(out, ma_build_refusal_body(rbao, rban, rbatr, nm, rqrc, rqout)) 2175 } 2176 let fb: *u8 = sys_mmap(MA_MAGIC_32768) 2177 var fo: i64 = sd_cat(fb, 0, "{\"action\":\"BUILD-FAILED\",\"verdict\":\"nx_cc/nxasm produced no elf; is the target in buildroot/runtime?\",\"diag\":\"" as *u8) 2178 let db: *u8 = sys_mmap(MA_MAGIC_2048) 2179 let dl: i64 = ma_json_esc_tail(pbuf, pn, MA_MAGIC_1400, db, MA_MAGIC_2040) 2180 fo = sd_cat(fb, fo, db) 2181 fo = sd_cat(fb, fo, "\"" as *u8) 2182 // MULTI-ERROR DIAG (2026-08-05). The tail window above was right when the compiler died AT 2183 // its first error (the error WAS the tail). With multi-error recovery the compiler parses 2184 // PAST its errors, so on a big target the error lines sit mid-log and the tail shows only 2185 // progress dots + the N-error summary -- a diag that names the count but hides every error. 2186 // Surface a second window anchored at the FIRST nx_parse: line; errors cluster from there. 2187 // Voice v3 (2026-08-06): user-facing diagnostics open with "error at line"; the older 2188 // organ-prefixed sites still say "nx_parse:" until their rewrite -- anchor on EITHER, 2189 // preferring whichever appears FIRST in the log so no error line is ever above the window. 2190 // READ THE BUILDER'S FULL CAPTURE (2026-08-06): hostctl echoes only the LAST 600 bytes of 2191 // /tmp/buildrun.out (hc_tail) into the stream this handler captures -- and one 5W+H-voice 2192 // diagnostic is BIGGER than that window, so the head of the first error could never reach 2193 // the echo at all. Anchor-scan the full capture instead; the build lease serializes 2194 // /api/build, which bounds the shared-path race until hostctl (deploy-frozen) uniquifies. 2195 let fbuf: *u8 = sys_mmap(MA_MAGIC_65536) 2196 let fn2: i64 = ma_read_tail("/tmp/buildrun.out" as *u8, fbuf, MA_MAGIC_65500) 2197 // ANCHOR WIDENED 2026-08-06: diagnostics now carry a per-file location, so the 5W+H voice 2198 // emits "error at <file>:<line>:" and no longer contains the literal "error at line ". 2199 // Anchoring on the SHORTEST STABLE PREFIX matches BOTH the mapped and unmapped forms, so 2200 // this reader needs no flag day with the writer and cannot silently return zero errors 2201 // again. (It did exactly that for one build: the compiler was promoted before this edit, 2202 // and diag_errors vanished from every failing build until the anchor caught up.) 2203 var ep: i64 = ma_find(fbuf, fn2, "error at " as *u8) 2204 let ep2: i64 = ma_find(fbuf, fn2, "nx_parse:" as *u8) 2205 if ep < 0 { ep = ep2 } 2206 if ep2 >= 0 { if ep2 < ep { ep = ep2 } } 2207 if ep >= 0 { 2208 var ewin: i64 = fn2 - ep 2209 if ewin > MA_MAGIC_8000 { ewin = MA_MAGIC_8000 } 2210 let eb2: *u8 = sys_mmap(MA_MAGIC_32768) 2211 let el: i64 = ma_json_esc_tail(((fbuf as i64) + ep) as *u8, ewin, ewin, eb2, MA_MAGIC_16000) 2212 fo = sd_cat(fb, fo, ",\"diag_errors\":\"" as *u8) 2213 fo = sd_cat(fb, fo, eb2) 2214 fo = sd_cat(fb, fo, "\"" as *u8) 2215 } 2216 // ---- CAPABILITY-DEMAND SINK (2026-08-13, the growing-loop counting half) ------------------- 2217 // Capability-limit refusals stamp greppable `capability=<slug>` markers in the compiler 2218 // output, but /tmp/buildrun.out is TRANSIENT -- without a durable sink the loop (refusal -> 2219 // counted demand -> re-ranked roadmap) has nothing to count NAS-side. Append one row per 2220 // marker: "<epoch> <slug> <target>" to knowledge/status/lang_demand.jrnl. TELEMETRY 2221 // CONTRACT, declared: bounded at 8 rows per build; append-only; a failed open SKIPS -- demand 2222 // counting must never fail a build. Build-time slugs only (runtime crash slugs stay in the 2223 // transcript mine); the journal is a FLOOR, not a census. 2224 var dsp: i64 = 0 2225 var dsn: i64 = 0 2226 let dfd: i64 = sys_openat_append("knowledge/status/lang_demand.jrnl" as *u8, 0x1a4) 2227 if dfd >= 0 { 2228 while dsn < 8 { 2229 let dhit: i64 = ma_find(((fbuf as i64) + dsp) as *u8, fn2 - dsp, "capability=" as *u8) 2230 if dhit < 0 { break } 2231 let dst0: i64 = dsp + dhit + 11 2232 var dse: i64 = dst0 2233 while dse < fn2 { 2234 let dc: i64 = fbuf[dse] as i64 2235 var dok: i64 = 0 2236 if dc >= 0x61 { if dc <= 0x7A { dok = 1 } } 2237 if dc >= 0x30 { if dc <= 0x39 { dok = 1 } } 2238 if dc == 0x2D { dok = 1 } 2239 if dok == 0 { break } 2240 dse = dse + 1 2241 } 2242 if dse > dst0 { 2243 let drow: *u8 = sys_mmap(512) 2244 var dro: i64 = sd_catn(drow, 0, sys_now_realtime_sec()) 2245 dro = sd_cat(drow, dro, " " as *u8) 2246 var dci: i64 = dst0 2247 while dci < dse { drow[dro] = fbuf[dci]; dro = dro + 1; dci = dci + 1 } 2248 dro = sd_cat(drow, dro, " " as *u8) 2249 dro = sd_cat(drow, dro, nm) 2250 drow[dro] = 10 as u8 2251 sys_write(dfd, drow, dro + 1) 2252 } 2253 dsp = dse 2254 dsn = dsn + 1 2255 } 2256 sys_close(dfd) 2257 } 2258 if restored == 1 { fo = sd_cat(fb, fo, ",\"staged_restored\":\"the prior staged artifact was put BACK after this failed compile (a stagedref tool executes it directly)\"" as *u8) } 2259 fo = sd_cat(fb, fo, "}" as *u8) 2260 fb[fo] = 0 as u8 2261 return ma_emit_200(out, fb) 2262} 2263 2264// POST /api/unpack {dest=<key>}: unpack a STAGED source-tree blob (<key>.pack.new from /api/upload) into a 2265// fail-closed NAS dir via the on-NAS nx_treepack. The tree-sync half of build-over-API: the whole source tree 2266// arrives in ONE /api/upload + this one call, instead of ~15k per-file SSH pushes. Never-brick: dest is 2267// allowlisted (unknown -> 400); nx_treepack writes only under the resolved dir. 2268// CONTRACT CHANGE (seq1807, deliberate fail-closed break): `sha256=<hex of the pack you uploaded>` is now 2269// REQUIRED. The staging slot is global and a sibling can overwrite it between your upload and your unpack, so 2270// a call that does not name its own bytes CANNOT be served safely -- omitting it is 400, never a best-effort 2271// unpack. Callers: take the digest /api/upload returns (or sha256 your pack locally) and pass it through. 2272func ma_do_unpack(req: *u8, req_n: i64, out: *u8) -> i64 { 2273 let body_off: i64 = sd_body_off(req, req_n) 2274 let body: *u8 = ((req as i64) + body_off) as *u8 2275 let body_n: i64 = req_n - body_off 2276 let doff: *i64 = sys_mmap(8) as *i64 2277 let dn: *i64 = sys_mmap(8) as *i64 2278 if sd_form_field(body, body_n, "dest" as *u8, 4, doff, dn) != 1 { 2279 return ma_emit_400(out, "{\"error\":\"missing dest\"}" as *u8) 2280 } 2281 let packbuf: *u8 = sys_mmap(128) 2282 let destbuf: *u8 = sys_mmap(256) 2283 if md_unpack_resolve(body, doff[0], dn[0], packbuf, destbuf) != 1 { 2284 return ma_emit_400(out, "{\"error\":\"unknown unpack dest (not in allowlist)\"}" as *u8) 2285 } 2286 // seq1807 CAS -- A SHARED MUTABLE STAGING SLOT WITH NO OWNERSHIP IS A RACE THAT SILENTLY SHIPS THE WRONG 2287 // SOURCE. `<key>.pack.new` is ONE global slot, so a sibling's in-flight /api/upload can replace the blob 2288 // between MY upload and MY unpack -- and this route used to apply whatever happened to be sitting there. 2289 // MEASURED cross-session source contamination: a 14,334B pack was staged, 114,316B was on disk, and 11 2290 // files from a FOREIGN pack were written into buildroot/runtime. The caller must now NAME THE BYTES IT 2291 // STAGED; we hash the slot and refuse on mismatch. This is the SAME guard already proven live on 2292 // /api/compare/publish -- it existed on a STATIC PAGE and not on the SOURCE TREE (an adoption gap, not 2293 // missing code). It also subsumes a declared-file-count check: bytes that hash equal cannot contain a 2294 // different file count. Fail-closed: no sha256 -> 400, nothing unpacked. 2295 let hoff: *i64 = sys_mmap(8) as *i64 2296 let hn: *i64 = sys_mmap(8) as *i64 2297 if sd_form_field(body, body_n, "sha256" as *u8, 6, hoff, hn) != 1 { 2298 return ma_emit_400(out, "{\"error\":\"missing sha256 (hex of the pack bytes you uploaded -- pins the unpack to YOUR source; a shared staging slot without it can apply another session tree)\"}" as *u8) 2299 } 2300 let szp: *i64 = sys_mmap(16) as *i64 2301 let stg: *u8 = md_read_file(packbuf, szp) 2302 if (stg as i64) == 0 { 2303 return ma_emit_400(out, "{\"error\":\"nothing staged; chunk-upload to /api/upload?target=buildsrc.pack first\"}" as *u8) 2304 } 2305 let dig: *u8 = sys_mmap(32) 2306 sha256_digest(stg, szp[0], dig) 2307 let hexbuf: *u8 = sys_mmap(72) 2308 mau_hex32(dig, hexbuf) 2309 if mau_hex_eq(body, hoff[0], hn[0], hexbuf) != 1 { 2310 return ma_emit_400(out, "{\"error\":\"sha256 mismatch: the staging slot holds different bytes than you staged (another session re-staged it) -- REFUSING to unpack a tree you did not review; re-upload and retry\"}" as *u8) 2311 } 2312 md_exec_treepack(packbuf, destbuf, "/tmp/nx_ma_unpack.out" as *u8) 2313 let pbuf: *u8 = sys_mmap(MA_MAGIC_16384) 2314 let pn: i64 = dp_read("/tmp/nx_ma_unpack.out" as *u8, pbuf, MA_MAGIC_16380) 2315 let files: i64 = hh_after(pbuf, pn, "files=" as *u8) 2316 let failed: i64 = hh_after(pbuf, pn, "failed=" as *u8) 2317 // 2026-08-06 -- SURFACE THE SKIP (debt 1785523434, the 'add-only / reports the silent skip as success' 2318 // report). nx_treepack REFUSES TO BACKDATE: when the destination copy is NEWER than the packed one it 2319 // writes nothing and counts it as `skipped-newer=N` in its own envelope. That refusal is CORRECT -- 2320 // it is the guard that stops a stale pack from reverting a sibling's landed work. The DEFECT was here: 2321 // this handler parsed only files= and failed=, so a run that declined to apply the caller's edits still 2322 // returned a clean {"action":"UNPACKED","failed":0}. The caller then runs /api/build, the compiler reads 2323 // the OLD text, and every downstream symptom points anywhere except at the unpack that never happened. 2324 // => A PARTIAL APPLY MUST NOT WEAR THE SUCCESS WORD. Skips get their OWN action so no caller can branch 2325 // past them, and the count is reported either way. A guard that fires silently is indistinguishable 2326 // from a guard that never ran. 2327 let skipped: i64 = hh_after(pbuf, pn, "skipped-newer=" as *u8) 2328 if failed == 0 { if files > 0 { 2329 let rb: *u8 = sys_mmap(MA_MAGIC_1024) 2330 var b: i64 = 0 2331 if skipped > 0 { b = sd_cat(rb, 0, "{\"action\":\"UNPACKED-WITH-SKIPS\",\"files\":" as *u8) } 2332 if skipped <= 0 { b = sd_cat(rb, 0, "{\"action\":\"UNPACKED\",\"files\":" as *u8) } 2333 b = sd_catn(rb, b, files) 2334 b = sd_cat(rb, b, ",\"failed\":0,\"skipped_newer\":" as *u8) 2335 b = sd_catn(rb, b, skipped) 2336 if skipped > 0 { b = sd_cat(rb, b, ",\"verdict\":\"NOT FULLY APPLIED: nx_treepack refused to backdate these files because the destination copy is NEWER than the packed one, so YOUR BYTES WERE NOT WRITTEN. Building now compiles the OLD text. Re-read the destination, merge, then re-pack from current source.\"" as *u8) } 2337 if skipped < 0 { b = sd_cat(rb, b, ",\"verdict\":\"UNKNOWN-SKIPS: the running nx_treepack.elf does not emit skipped-newer= in its envelope, so this route CANNOT tell you whether files were silently declined. Rebuild and promote nx_treepack before trusting a clean result.\"" as *u8) } 2338 b = sd_cat(rb, b, "}" as *u8) 2339 rb[b] = 0 as u8 2340 return ma_emit_200(out, rb) 2341 } } 2342 return ma_emit_200(out, "{\"action\":\"UNPACK-FAILED\",\"verdict\":\"nx_treepack reported failures or zero files\"}" as *u8) 2343} 2344 2345// POST /api/put_source?name=<name> {body = raw .nx source text}: WRITE ONE source file to buildroot/runtime/<name>.nx 2346// over the pure API. NishiLang source is TEXT, so it rides the request body verbatim -- no pack, no binary upload, 2347// no WSL. Then /api/build compiles it -> a brand-new organ goes source->binary with ZERO shell. Fail-closed: name 2348// sanitized to [a-zA-Z0-9_] (no dot/slash/dot-dot -> no path escape); writes EXACTLY runtime/<name>.nx (O_TRUNC). 2349// Additive/never-brick: only overwrites that one SOURCE file (never a live artifact); the compiler is the next step. 2350func ma_gate_esc(d: *u8, o: i64, s: *u8, n: i64) -> i64 { 2351 var i: i64 = 0 2352 var b: i64 = o 2353 while i < n { 2354 let c: i64 = (s[i] as i64) & 0xff 2355 var hit: i64 = 0 2356 if c == 34 { d[b] = 92 as u8; b = b + 1; d[b] = 34 as u8; b = b + 1; hit = 1 } 2357 if c == 92 { d[b] = 92 as u8; b = b + 1; d[b] = 92 as u8; b = b + 1; hit = 1 } 2358 if c == 10 { d[b] = 92 as u8; b = b + 1; d[b] = 110 as u8; b = b + 1; hit = 1 } 2359 if c == 13 { d[b] = 92 as u8; b = b + 1; d[b] = 114 as u8; b = b + 1; hit = 1 } 2360 if c == 9 { d[b] = 92 as u8; b = b + 1; d[b] = 116 as u8; b = b + 1; hit = 1 } 2361 if hit == 0 { if c >= 32 { d[b] = s[i]; b = b + 1 } } 2362 i = i + 1 2363 } 2364 return b 2365} 2366 2367// ---- /api/organ_run: run an ALREADY-VETTED organ over the control plane (seq1426) ------------------ 2368// THE GAP IT CLOSES. The ship loop is API-pure end to end -- build, promote, register, mint, gate_run -- 2369// except for the last step: actually RUNNING what you just shipped. /api/gate_run deliberately executes 2370// VERIFIERS ONLY (name must end gate/test/kat) and that bound must stay, and a freshly registered tool 2371// has no mcp__nishi__ stub until a FULL client restart. So a brand-new organ was unreachable in-session 2372// and every session fell back to ssh -- measured at 33-44% of all tool calls, the single largest 2373// self-sufficiency leak in the ecosystem. 2374// 2375// AUTHORITY: this grants NOTHING NEW. tool_allowlist.conf is the set an operator has already vetted as 2376// callable-over-MCP (field 0 = name, field 1 = absolute elf, field 2 = GREEN). /mcp tools/call already 2377// executes exactly that set. This route is a SECOND PRESENTER of the SAME authority, the way 2378// Authorization: Bearer is a second presenter of the X-Nishi-Cap token -- it changes WHICH DOOR the 2379// request arrives at, never WHAT MAY BE RUN. An organ absent from the allowlist, or not GREEN, is 2380// refused here exactly as it is there. 2381// 2382// NEVER-BRICK: the elf path comes from the ALLOWLIST ROW, never from the caller, so no argument can 2383// redirect execution; the run is deadline-bounded and process-group reaped (dep_run_capture_bounded); 2384// and callers cannot reach a daemon or deployer unless an operator deliberately vetted it GREEN, which 2385// is the same decision that already exposes it over /mcp. 2386const MA_ORGAN_ALLOWLIST: *u8 = "tool_allowlist.conf" as *u8 2387const MA_ORGAN_CONFCAP: i64 = 262144 2388const MA_ORGAN_MAXARGS: i64 = 12 2389 2390// Resolve `nm` to its allowlisted absolute elf path. 1 = found + GREEN (path written to outp), 2391// 0 = absent or not GREEN. Fail-closed: an unreadable/truncated conf resolves NOTHING. 2392func ma_organ_resolve(nm: *u8, outp: *u8) -> i64 { 2393 let buf: *u8 = sys_mmap(MA_ORGAN_CONFCAP) 2394 let n: i64 = dp_read(MA_ORGAN_ALLOWLIST, buf, MA_ORGAN_CONFCAP - 1) 2395 if n <= 0 { return 0 } 2396 var nl: i64 = 0 2397 while nm[nl] != (0 as u8) { nl = nl + 1 } 2398 var ls: i64 = 0 2399 var i: i64 = 0 2400 while i <= n { 2401 var eol: i64 = 0 2402 if i == n { eol = 1 } else { if buf[i] == (10 as u8) { eol = 1 } } 2403 if eol == 1 { 2404 if i > ls { if buf[ls] != (35 as u8) { 2405 // field 0 = name, up to the first TAB 2406 var t0: i64 = ls 2407 while t0 < i { if buf[t0] == (9 as u8) { t0 = i + 1 } else { t0 = t0 + 1 } } 2408 var tab1: i64 = ls 2409 var found1: i64 = 0 - 1 2410 while tab1 < i { if buf[tab1] == (9 as u8) { found1 = tab1; tab1 = i } else { tab1 = tab1 + 1 } } 2411 if found1 > 0 { if found1 - ls == nl { 2412 var m: i64 = 1 2413 var c: i64 = 0 2414 while c < nl { if buf[ls+c] != nm[c] { m = 0; c = nl } else { c = c + 1 } } 2415 if m == 1 { 2416 // field 1 = elf path, field 2 = status 2417 var p2: i64 = found1 + 1 2418 var found2: i64 = 0 - 1 2419 var q: i64 = p2 2420 while q < i { if buf[q] == (9 as u8) { found2 = q; q = i } else { q = q + 1 } } 2421 if found2 > 0 { 2422 // status must begin GREEN 2423 var s3: i64 = found2 + 1 2424 var green: i64 = 0 2425 if s3 + 5 <= i { 2426 if buf[s3] == (71 as u8) { if buf[s3+1] == (82 as u8) { if buf[s3+2] == (69 as u8) { 2427 if buf[s3+3] == (69 as u8) { if buf[s3+4] == (78 as u8) { green = 1 } } } } } 2428 } 2429 if green == 1 { 2430 var o: i64 = 0 2431 var k: i64 = p2 2432 while k < found2 { outp[o] = buf[k]; o = o + 1; k = k + 1 } 2433 outp[o] = 0 as u8 2434 if o > 0 { return 1 } 2435 } 2436 return 0 2437 } 2438 } 2439 } } 2440 } } 2441 ls = i + 1 2442 } 2443 i = i + 1 2444 } 2445 return 0 2446} 2447 2448// Argument decoding is explicit. Legacy callers retain their documented token alphabet; 2449// percent-v1 splits raw spaces/pluses then decodes each token, preserving encoded delimiters. 2450// Errors stop execution: never truncate a token, discard an argument, or sanitize its meaning. 2451const MA_OA_INVALID: i64 = 0 - 1 2452const MA_OA_CAPACITY: i64 = 0 - 2 2453const MA_OA_ENCODING: i64 = 0 - 3 2454func ma_organ_arg_hex(c: i64) -> i64 { 2455 if c >= 48 { if c <= 57 { return c - 48 } } 2456 if c >= 65 { if c <= 70 { return c - 65 + 10 } } 2457 if c >= 97 { if c <= 102 { return c - 97 + 10 } } 2458 return 0 - 1 2459} 2460func ma_organ_arg_legacy(c: i64) -> i64 { 2461 if c >= 48 { if c <= 57 { return 1 } } 2462 if c >= 65 { if c <= 90 { return 1 } } 2463 if c >= 97 { if c <= 122 { return 1 } } 2464 if c == 95 { return 1 } 2465 if c == 46 { return 1 } 2466 if c == 47 { return 1 } 2467 if c == 45 { return 1 } 2468 return 0 2469} 2470func ma_organ_args_parse(raw: *u8, n: i64, encoded: i64, dst: *u8, cap: i64, av: *i64, maxargs: i64) -> i64 { 2471 av[0] = 0 2472 if n < 0 { return MA_OA_INVALID } 2473 if cap <= 0 { return MA_OA_CAPACITY } 2474 if maxargs < 0 { return MA_OA_CAPACITY } 2475 if encoded != 0 { if encoded != 1 { return MA_OA_ENCODING } } 2476 var k: i64 = 0 2477 var w: i64 = 0 2478 var count: i64 = 0 2479 while k < n { 2480 if raw[k] == (32 as u8) { k = k + 1 } else { 2481 if raw[k] == (43 as u8) { k = k + 1 } else { 2482 if count >= maxargs { return MA_OA_CAPACITY } 2483 av[count] = (dst as i64) + w 2484 var token: i64 = 1 2485 while token == 1 { 2486 if k >= n { token = 0 } else { 2487 var ch: i64 = raw[k] as i64 2488 if ch == 32 { token = 0 } else { 2489 if ch == 43 { token = 0 } else { 2490 if encoded == 1 { 2491 if ch == 37 { 2492 if k + 2 >= n { return MA_OA_ENCODING } 2493 let hi: i64 = ma_organ_arg_hex(raw[k+1] as i64) 2494 let lo: i64 = ma_organ_arg_hex(raw[k+2] as i64) 2495 if hi < 0 { return MA_OA_ENCODING } 2496 if lo < 0 { return MA_OA_ENCODING } 2497 ch = hi * 16 + lo 2498 k = k + 2 2499 } 2500 if ch < 32 { return MA_OA_INVALID } 2501 if ch == 127 { return MA_OA_INVALID } 2502 } else { 2503 if ma_organ_arg_legacy(ch) != 1 { return MA_OA_INVALID } 2504 } 2505 if w >= cap - 1 { return MA_OA_CAPACITY } 2506 dst[w] = ch as u8 2507 w = w + 1 2508 k = k + 1 2509 } } 2510 } 2511 } 2512 dst[w] = 0 as u8 2513 w = w + 1 2514 count = count + 1 2515 } } 2516 } 2517 av[count] = 0 2518 return count 2519} 2520func ma_organ_args_form(body: *u8, n: i64, dst: *u8, cap: i64, av: *i64, maxargs: i64) -> i64 { 2521 let off: *i64 = sys_mmap(8) as *i64 2522 let len: *i64 = sys_mmap(8) as *i64 2523 var encoded: i64 = 0 2524 if sd_form_field(body, n, "args_encoding" as *u8, 13, off, len) == 1 { 2525 let mode: *u8 = "percent-v1" as *u8 2526 if len[0] != 10 { return MA_OA_ENCODING } 2527 var j: i64 = 0 2528 while j < 10 { 2529 if body[off[0]+j] != mode[j] { return MA_OA_ENCODING } 2530 j = j + 1 2531 } 2532 encoded = 1 2533 } 2534 if sd_form_field(body, n, "args" as *u8, 4, off, len) != 1 { av[0] = 0; return 0 } 2535 return ma_organ_args_parse(body + off[0], len[0], encoded, dst, cap, av, maxargs) 2536} 2537 2538// Install request boundary. The transport authenticates the session and supplies 2539// its resolved access level plus server-admitted resource allowances. This adapter 2540// never accepts a registry path or a memory allowance from the network body. 2541struct NxInstallRequest { 2542 bytes: *u8, 2543 allocation: i64, 2544 target: *u8, 2545 intent: *u8, 2546 digest: *u8, 2547 stage: *u8, 2548 code: i64, 2549} 2550func ma_install_request_init(r: *NxInstallRequest) -> i64 { 2551 let p: *u8=r as *u8;var i: i64=0 2552 while i<__size_of(NxInstallRequest) { p[i]=0 as u8;i=i+1 } 2553 r.stage="request-input";r.code=400;return 0 2554} 2555func ma_install_request_close(r: *NxInstallRequest) -> i64 { 2556 var rc: i64=0 2557 if (r.digest as i64)!=0 { rc=sys_munmap(r.digest,FI_DIGEST_BYTES) } 2558 if (r.bytes as i64)!=0 { let freed: i64=sys_munmap(r.bytes,r.allocation);if rc==0 { rc=freed } } 2559 ma_install_request_init(r);return rc 2560} 2561// Decode one form component in-place. Encoded separators remain part of that 2562// component; NUL/control bytes are never allowed to change downstream meaning. 2563func ma_install_component(p: *u8,n: i64) -> i64 { 2564 var read: i64=0;var written: i64=0 2565 while read<n { 2566 var ch: i64=p[read] as i64 2567 if ch==37 { 2568 if n-read<3 { return 0-1 } 2569 let hi: i64=ma_organ_arg_hex(p[read+1] as i64) 2570 let lo: i64=ma_organ_arg_hex(p[read+2] as i64) 2571 if hi<0 || lo<0 { return 0-1 } 2572 ch=hi*16+lo;read=read+2 2573 } else { if ch==43 { ch=32 } } 2574 if ch<32 || ch==127 { return 0-1 } 2575 p[written]=ch as u8;written=written+1;read=read+1 2576 } 2577 p[written]=0 as u8;return written 2578} 2579// Exactly four named fields; duplicate/unknown fields fail instead of choosing 2580// whichever occurrence a later layer happens to read. 2581func ma_install_request_decode(body: *u8,n: i64,r: *NxInstallRequest) -> i64 { 2582 ma_install_request_init(r) 2583 if (body as i64)==0 || n<=0 || n==0x7fffffffffffffff { return r.code } 2584 r.bytes=sys_mmap(n+1) 2585 if (r.bytes as i64)<0 { r.bytes=0 as *u8;r.stage="request-allocation";r.code=503;return r.code } 2586 r.allocation=n+1;fi_copy(r.bytes,body,n);r.bytes[n]=0 as u8 2587 var cursor: i64=0;var fields: i64=0;var hex: *u8=0 as *u8 2588 r.stage="request-fields" 2589 while cursor<n { 2590 var end: i64=cursor 2591 while end<n && r.bytes[end]!=(38 as u8) { end=end+1 } 2592 var eq: i64=cursor 2593 while eq<end && r.bytes[eq]!=(61 as u8) { eq=eq+1 } 2594 if eq==cursor || eq==end || end==cursor { return r.code } 2595 r.bytes[eq]=0 as u8;r.bytes[end]=0 as u8 2596 let key: *u8=r.bytes+cursor;let value: *u8=r.bytes+eq+1 2597 if ma_install_component(key,eq-cursor)<0 || ma_install_component(value,end-eq-1)<0 { r.stage="request-encoding";return r.code } 2598 var bit: i64=0 2599 if fi_len(key)==6 && fi_same(key,"target",6)==1 { bit=1;r.target=value } 2600 if fi_len(key)==6 && fi_same(key,"intent",6)==1 { bit=2;r.intent=value } 2601 if fi_len(key)==20 && fi_same(key,"expect_intent_sha256",20)==1 { bit=4;hex=value } 2602 if fi_len(key)==7 && fi_same(key,"confirm",7)==1 { 2603 bit=8 2604 if fi_len(value)!=3 || fi_same(value,"yes",3)==0 { r.stage="request-confirmation";return r.code } 2605 } 2606 if bit==0 || (fields & bit)!=0 { return r.code } 2607 fields=fields | bit 2608 if end==n-1 { return r.code } 2609 cursor=end+1 2610 } 2611 if fields!=15 { return r.code } 2612 r.stage="request-target" 2613 let target_n: i64=fi_len(r.target) 2614 if target_n==0 { return r.code } 2615 var i: i64=0 2616 while i<target_n { 2617 let ch: i64=r.target[i] as i64 2618 if !((ch>=48 && ch<=57) || (ch>=65 && ch<=90) || (ch>=97 && ch<=122) || ch==95 || ch==45) { return r.code } 2619 i=i+1 2620 } 2621 r.stage="request-intent-path" 2622 if fi_path_valid(r.intent)==0 { return r.code } 2623 r.stage="request-intent-digest" 2624 if fi_len(hex)!=FI_DIGEST_BYTES*2 { return r.code } 2625 r.digest=sys_mmap(FI_DIGEST_BYTES) 2626 if (r.digest as i64)<0 { r.digest=0 as *u8;r.stage="digest-allocation";r.code=503;return r.code } 2627 i=0 2628 while i<FI_DIGEST_BYTES { 2629 let hi: i64=ma_organ_arg_hex(hex[i*2] as i64) 2630 let lo: i64=ma_organ_arg_hex(hex[i*2+1] as i64) 2631 if hi<0 || lo<0 { return r.code } 2632 r.digest[i]=(hi*16+lo) as u8;i=i+1 2633 } 2634 r.stage="request-decoded";r.code=0;return 0 2635} 2636// HTTP status result; nested evidence retains the exact failing layer. 2637// Call only with a session level resolved by ma_level_of, never from form input. 2638func ma_install_dispatch(req: *u8,n: i64,level: i64,registry: *u8,snapshot_allowance: i64,intent_allowance: i64,scratch: *u8,scratch_bytes: i64,parsed: *NxInstallRequest,result: *NxRegisteredInstallResult) -> i64 { 2639 ma_install_request_init(parsed);md_registered_install_init(result) 2640 if level<0 { parsed.stage="authentication";parsed.code=401;return parsed.code } 2641 if level<MA_LVL_ACT { parsed.stage="authorization";parsed.code=403;return parsed.code } 2642 if n<5 || fi_same(req,"POST ",5)==0 { parsed.stage="request-method";parsed.code=405;return parsed.code } 2643 let prefix: *u8="POST /api/install " 2644 if n<fi_len(prefix) || fi_same(req,prefix,fi_len(prefix))==0 { parsed.stage="request-route";parsed.code=404;return parsed.code } 2645 let off: i64=sd_body_off(req,n) 2646 if off<=0 || off>=n { parsed.stage="request-body";return parsed.code } 2647 let decoded: i64=ma_install_request_decode(req+off,n-off,parsed) 2648 if decoded!=0 { return decoded } 2649 let rc: i64=md_install_registered(registry,snapshot_allowance,parsed.target,fi_len(parsed.target),parsed.intent,intent_allowance,parsed.digest,scratch,scratch_bytes,result) 2650 if rc==0 { return 200 } 2651 if rc==FI_ENOENT { return 404 } 2652 if rc==FI_EACCES { return 403 } 2653 if rc==FIO_EBADMSG || rc==FIO_EEXIST { return 409 } 2654 if rc==FIO_EINVAL { return 400 } 2655 return 503 2656} 2657// Capacity-aware receipt emission. Counting and writing use the same schema; 2658// insufficient output space returns the required byte count without touching it. 2659struct NxInstallReceiptWriter { 2660 bytes: *u8, 2661 capacity: i64, 2662 count: i64, 2663 code: i64, 2664} 2665func ma_ir_byte(w: *NxInstallReceiptWriter,ch: u8) -> i64 { 2666 if w.code!=0 { return w.code } 2667 if w.count==0x7fffffffffffffff { w.code=FIO_EINVAL;return w.code } 2668 if (w.bytes as i64)!=0 { 2669 if w.count>=w.capacity { w.code=FIO_EINVAL;return w.code } 2670 w.bytes[w.count]=ch 2671 } 2672 w.count=w.count+1;return 0 2673} 2674func ma_ir_text(w: *NxInstallReceiptWriter,s: *u8) -> i64 { 2675 var i: i64=0 2676 while s[i]!=(0 as u8) { ma_ir_byte(w,s[i]);i=i+1 } 2677 return w.code 2678} 2679func ma_ir_string(w: *NxInstallReceiptWriter,s: *u8) -> i64 { 2680 ma_ir_byte(w,34 as u8);var i: i64=0 2681 if (s as i64)!=0 { 2682 while s[i]!=(0 as u8) { 2683 let ch: i64=s[i] as i64 2684 if ch==34 || ch==92 { ma_ir_byte(w,92 as u8);ma_ir_byte(w,s[i]) } 2685 else { 2686 if ch<32 { 2687 ma_ir_text(w,"\\u00") 2688 let hex: *u8="0123456789abcdef" 2689 ma_ir_byte(w,hex[ch>>4]);ma_ir_byte(w,hex[ch&15]) 2690 } else { ma_ir_byte(w,s[i]) } 2691 } 2692 i=i+1 2693 } 2694 } 2695 ma_ir_byte(w,34 as u8);return w.code 2696} 2697// Negative-domain conversion also represents the minimum signed value without 2698// negating it, which would overflow. Decimal digits derive from the numeric base. 2699func ma_ir_number(w: *NxInstallReceiptWriter,value: i64) -> i64 { 2700 var v: i64=value 2701 if v<0 { ma_ir_byte(w,45 as u8) } else { v=0-v } 2702 var place: i64=1 2703 while v/place<=0-10 { place=place*10 } 2704 while place>0 { 2705 let digit: i64=0-(v/place) 2706 ma_ir_byte(w,(48+digit) as u8) 2707 v=v+(digit*place);place=place/10 2708 } 2709 return w.code 2710} 2711func ma_ir_named_string(w: *NxInstallReceiptWriter,key: *u8,value: *u8) -> i64 { 2712 ma_ir_string(w,key);ma_ir_byte(w,58 as u8);return ma_ir_string(w,value) 2713} 2714func ma_ir_named_number(w: *NxInstallReceiptWriter,key: *u8,value: i64) -> i64 { 2715 ma_ir_string(w,key);ma_ir_byte(w,58 as u8);return ma_ir_number(w,value) 2716} 2717func ma_install_receipt_fields(w: *NxInstallReceiptWriter,status: i64,when: i64,request: *NxInstallRequest,result: *NxRegisteredInstallResult) -> i64 { 2718 ma_ir_text(w,"{");ma_ir_named_string(w,"schema","nishi.install-receipt.v1") 2719 ma_ir_text(w,",");ma_ir_named_string(w,"owner","nx_mgmt_api") 2720 ma_ir_text(w,",");ma_ir_named_number(w,"status",status) 2721 ma_ir_text(w,",");ma_ir_named_number(w,"observed_at_unix_s",when) 2722 ma_ir_text(w,",");ma_ir_named_string(w,"target",request.target) 2723 ma_ir_text(w,",");ma_ir_named_string(w,"intent",request.intent) 2724 ma_ir_text(w,",\"intent_sha256\":\"") 2725 if (request.digest as i64)!=0 { 2726 let digits: *u8="0123456789abcdef";var i: i64=0 2727 while i<FI_DIGEST_BYTES { 2728 let value: i64=request.digest[i] as i64 2729 ma_ir_byte(w,digits[value>>4]);ma_ir_byte(w,digits[value&15]);i=i+1 2730 } 2731 } 2732 ma_ir_byte(w,34 as u8) 2733 ma_ir_text(w,",");ma_ir_named_string(w,"live",result.target.live) 2734 ma_ir_text(w,",\"request\":{");ma_ir_named_string(w,"stage",request.stage) 2735 ma_ir_text(w,",");ma_ir_named_number(w,"code",request.code) 2736 ma_ir_text(w,"},\"resolution\":{");ma_ir_named_string(w,"stage",result.target.stage) 2737 ma_ir_text(w,",");ma_ir_named_number(w,"code",result.target.code) 2738 ma_ir_text(w,",");ma_ir_named_number(w,"line",result.target.line) 2739 ma_ir_text(w,",");ma_ir_named_number(w,"conflicting_line",result.target.conflicting_line) 2740 ma_ir_text(w,"},\"installation\":{");ma_ir_named_string(w,"stage",result.install.stage) 2741 ma_ir_text(w,",");ma_ir_named_number(w,"code",result.install.code) 2742 ma_ir_text(w,",");ma_ir_named_number(w,"visible",result.install.replacement.publication.visible) 2743 ma_ir_text(w,",");ma_ir_named_number(w,"durable",result.install.replacement.publication.durable) 2744 ma_ir_text(w,",");ma_ir_named_number(w,"already_published",result.install.already_published) 2745 ma_ir_text(w,",");ma_ir_named_string(w,"candidate_stage",result.install.replacement.candidate.stage) 2746 ma_ir_text(w,",");ma_ir_named_number(w,"candidate_code",result.install.replacement.candidate.code) 2747 ma_ir_text(w,",");ma_ir_named_number(w,"candidate_bytes",result.install.replacement.candidate.copied) 2748 ma_ir_text(w,",");ma_ir_named_string(w,"backup_stage",result.install.replacement.backup.stage) 2749 ma_ir_text(w,",");ma_ir_named_number(w,"backup_code",result.install.replacement.backup.code) 2750 ma_ir_text(w,",");ma_ir_named_number(w,"backup_bytes",result.install.replacement.backup.copied) 2751 ma_ir_text(w,",");ma_ir_named_string(w,"io_stage",result.install.io.stage) 2752 ma_ir_text(w,",");ma_ir_named_number(w,"io_code",result.install.io.code) 2753 ma_ir_text(w,",");ma_ir_named_number(w,"io_close_code",result.install.io.close_code) 2754 ma_ir_text(w,",");ma_ir_named_string(w,"lock_stage",result.install.replacement.lock.stage) 2755 ma_ir_text(w,",");ma_ir_named_number(w,"lock_code",result.install.replacement.lock.code) 2756 ma_ir_text(w,",");ma_ir_named_number(w,"unlock_code",result.install.replacement.lock.unlock_code) 2757 ma_ir_text(w,",");ma_ir_named_number(w,"lock_close_code",result.install.replacement.lock.close_code) 2758 ma_ir_text(w,"},");ma_ir_named_string(w,"serving","not-verified") 2759 ma_ir_text(w,",");ma_ir_named_string(w,"restart","not-requested") 2760 ma_ir_text(w,",");ma_ir_named_string(w,"operation_stage",result.stage) 2761 ma_ir_text(w,",");ma_ir_named_number(w,"operation_code",result.code) 2762 var next: *u8="reconcile-approved-install-intent" 2763 if status==200 { next="verify-running-artifact-and-service" } 2764 else { if request.code!=0 { next="correct-request-or-session" } 2765 else { if result.target.code!=0 { next="repair-target-registry" } } } 2766 ma_ir_text(w,",");ma_ir_named_string(w,"next_action",next) 2767 ma_ir_text(w,"}");return w.code 2768} 2769// Return required/written bytes. A null destination measures only; otherwise 2770// count>capacity means no write occurred. Caller may then provide exact storage. 2771func ma_install_receipt_emit(w: *NxInstallReceiptWriter,status: i64,when: i64,request: *NxInstallRequest,result: *NxRegisteredInstallResult,destination: *u8,capacity: i64) -> i64 { 2772 w.bytes=0 as *u8;w.capacity=0;w.count=0;w.code=0 2773 ma_install_receipt_fields(w,status,when,request,result) 2774 if w.code!=0 { return w.code } 2775 let required: i64=w.count 2776 if (destination as i64)==0 || capacity<required { return required } 2777 w.bytes=destination;w.capacity=capacity;w.count=0 2778 ma_install_receipt_fields(w,status,when,request,result) 2779 if w.code!=0 { return w.code };return w.count 2780} 2781func ma_do_organ_run(req: *u8, req_n: i64, out: *u8) -> i64 { 2782 // Guard before any pointer walk or addition. This is representable address 2783 // arithmetic, not a policy limit on argument count or source length. 2784 if (req as i64)==0 || req_n<0 || req_n>(NX_RA_SIZE_MAX/8)-3 { 2785 return ma_emit_400(out,"{\"code\":\"ORGAN_REQUEST_BOUNDS\",\"executed\":false}") 2786 } 2787 let body_off: i64 = sd_body_off(req, req_n) 2788 if body_off<0 || body_off>req_n { return ma_emit_400(out,"{\"code\":\"ORGAN_REQUEST_BOUNDS\",\"executed\":false}") } 2789 let body: *u8 = ((req as i64) + body_off) as *u8 2790 let body_n: i64 = req_n - body_off 2791 let toff: *i64 = sys_mmap(8) as *i64 2792 let tn: *i64 = sys_mmap(8) as *i64 2793 if sd_form_field(body, body_n, "target" as *u8, 6, toff, tn) != 1 { 2794 return ma_emit_400(out, "{\"error\":\"missing target\"}" as *u8) 2795 } 2796 let nm: *u8 = sys_mmap(128) 2797 if ma_sanitize_name(body, toff[0], tn[0], nm, 120) != 1 { 2798 return ma_emit_400(out, "{\"error\":\"invalid target name (only [a-zA-Z0-9_])\"}" as *u8) 2799 } 2800 if ma_confirmed(req, req_n) == 0 { 2801 return ma_emit_400(out, "{\"error\":\"organ_run requires confirm=yes\"}" as *u8) 2802 } 2803 let ep: *u8 = sys_mmap(512) 2804 let pin: *u8 = sys_mmap(MA_MAGIC_4096) 2805 let haspin: *i64 = sys_mmap(16) as *i64 2806 if tea_resolve_pinned_from(MA_ORGAN_ALLOWLIST,nm,sd_len(nm),ep,512,pin,MA_MAGIC_4096,haspin) != TEA_OK { 2807 return ma_emit_400(out, "{\"error\":\"target refused: not a GREEN row in tool_allowlist.conf. This route runs only what an operator has ALREADY vetted as callable over /mcp -- it is a second door onto that same set, never a wider one. Register the organ first (POST /api/tools/register).\"}" as *u8) 2808 } 2809 var dl: i64 = MA_MAGIC_12000 2810 let doff: *i64 = sys_mmap(8) as *i64 2811 let dn: *i64 = sys_mmap(8) as *i64 2812 if sd_form_field(body, body_n, "deadline_ms" as *u8, 11, doff, dn) == 1 { 2813 let v: i64 = mau_qint(body, doff[0], dn[0]) 2814 if v > 0 { dl = v } 2815 } 2816 if dl < 1000 { dl = 1000 } 2817 if dl > MA_MAGIC_300000 { dl = MA_MAGIC_300000 } 2818 // Decoding cannot grow the admitted form body: each separator becomes a 2819 // terminator and percent escapes shrink. One extra byte terminates the last token. 2820 // Derive both buffers from that bound rather than rejecting a valid thirteenth argument. 2821 var argcap: i64 = body_n + 1 2822 if haspin[0] == 1 { argcap = sd_len(pin) + 1 } 2823 if argcap<=0 || argcap>(NX_RA_SIZE_MAX/8)-2 { return ma_emit_400(out,"{\"code\":\"ORGAN_REQUEST_BOUNDS\",\"executed\":false}") } 2824 let argv_bytes:i64=8*(argcap+2) 2825 let argbuf: *u8 = sys_mmap_try(argcap) 2826 let argv: *i64 = sys_mmap_try(argv_bytes) as *i64 2827 if (argbuf as i64) <= 0 || (argv as i64) <= 0 { 2828 if (argbuf as i64)>0 { sys_munmap(argbuf,argcap) } 2829 if (argv as i64)>0 { sys_munmap(argv as *u8,argv_bytes) } 2830 return ma_emit_503(out, "{\"code\":\"ORGAN_ARGUMENT_ALLOCATION_FAILED\",\"executed\":false}" as *u8) 2831 } 2832 var nargs: i64 = 0 2833 if haspin[0] == 1 { 2834 nargs = tea_tokenize_checked(pin,argv,0,argcap+1,argbuf,argcap) 2835 } else { 2836 nargs = ma_organ_args_form(body, body_n, argbuf, argcap, argv, argcap) 2837 } 2838 if nargs < 0 { 2839 sys_munmap(argbuf,argcap);sys_munmap(argv as *u8,argv_bytes) 2840 return ma_emit_400(out, "{\"code\":\"ORGAN_ARGS_INVALID\",\"executed\":false,\"error\":\"Arguments rejected without execution: invalid encoding, unsupported legacy byte, or argument capacity exceeded. Use args_encoding=percent-v1; separate tokens with + and percent-encode bytes inside tokens.\"}" as *u8) 2841 } 2842 2843 // seq1443 ADOPTION COMPLETED 2026-08-07. The definition of dep_run_capture_bounded was removed when 2844 // md_exec_gate_capture adopted tr_run_capture_to, but THIS live call site was left behind, so the 2845 // whole mgmt binary stopped compiling and the deploy path went down for every seat. 2846 // tr_run_capture_to captures to a BUFFER rather than a temp path -- which is the point of the 2847 // adoption, per its own header -- so the /tmp/nx_ma_organrun.out round trip disappears with it. 2848 // ⚠ARGV[0] IS NOT SUPPLIED FOR YOU. dep_run_capture_bounded prepended the elf path itself (the old 2849 // comment in the parse loop above says so); tr_run_capture_to does not -- md_exec_gate_capture sets 2850 // argv[0] = elfpath explicitly before calling. So the parsed args are copied up by one rather than 2851 // reindexed in the parser, which leaves that loop untouched. 2852 let argv2_bytes:i64=8*(nargs+2) 2853 let argv2: *i64 = sys_mmap_try(argv2_bytes) as *i64 2854 if (argv2 as i64) <= 0 { 2855 sys_munmap(argbuf,argcap);sys_munmap(argv as *u8,argv_bytes) 2856 return ma_emit_503(out,"{\"code\":\"ORGAN_ARGUMENT_ALLOCATION_FAILED\",\"executed\":false}") 2857 } 2858 argv2[0] = ep as i64 2859 var zc: i64 = 0 2860 while zc < nargs { argv2[zc + 1] = argv[zc]; zc = zc + 1 } 2861 argv2[nargs + 1] = 0 2862 let cbuf: *u8 = sys_mmap(MA_MAGIC_65536) 2863 let cnp: *i64 = sys_mmap(16) as *i64 2864 cnp[0] = 0 2865 let rc: i64 = tr_run_capture_to(ep, argv2, cbuf, MA_MAGIC_16384, cnp, dl) 2866 sys_munmap(argbuf,argcap);sys_munmap(argv as *u8,argv_bytes);sys_munmap(argv2 as *u8,argv2_bytes) 2867 let cn: i64 = cnp[0] 2868 let rb: *u8 = sys_mmap(MA_MAGIC_65536) 2869 var b: i64 = sd_cat(rb, 0, "{\"action\":\"ORGAN-RUN\",\"target\":\"" as *u8) 2870 b = sd_cat(rb, b, nm) 2871 b = sd_cat(rb, b, "\",\"elf\":\"" as *u8) 2872 b = sd_cat(rb, b, ep) 2873 b = sd_cat(rb, b, "\",\"argc\":" as *u8) 2874 b = sd_catn(rb, b, nargs) 2875 b = sd_cat(rb, b, ",\"exit_code\":" as *u8) 2876 if rc < 0 { b = sd_cat(rb, b, "-1" as *u8) } 2877 if rc >= 0 { b = sd_catn(rb, b, rc) } 2878 b = sd_cat(rb, b, ",\"deadline_ms\":" as *u8) 2879 b = sd_catn(rb, b, dl) 2880 b = sd_cat(rb, b, ",\"verdict\":\"" as *u8) 2881 if rc == 0 { b = sd_cat(rb, b, "OK" as *u8) } 2882 if rc == 127 { b = sd_cat(rb, b, "NOT-FOUND" as *u8) } 2883 if rc < 0 { b = sd_cat(rb, b, "TIMEOUT-OR-SIGNAL" as *u8) } 2884 if rc > 0 { if rc != 127 { b = sd_cat(rb, b, "NONZERO" as *u8) } } 2885 b = sd_cat(rb, b, "\",\"bytes\":" as *u8) 2886 b = sd_catn(rb, b, cn) 2887 b = sd_cat(rb, b, ",\"output\":\"" as *u8) 2888 b = ma_gate_esc(rb, b, cbuf, cn) 2889 b = sd_cat(rb, b, "\"}" as *u8) 2890 rb[b] = 0 as u8 2891 return ma_emit_200(out, rb) 2892} 2893 2894// POST /api/gate_run {target=<name>[&deadline_ms=<n>]} (seq1349): run a promoted gate/test ELF, return its 2895// transcript + exit code + verdict, so a session can PROVE what it just built with zero ssh. Verdict comes ONLY 2896// from the exit code -- a second, weaker judge is how a false GREEN gets manufactured (seq585). Wait is BOUNDED 2897// (seq1383): an unbounded wait in a request handler is a DoS on the whole daemon by construction; it took mgmt 2898// down once. Timeout returns NAME which half failed (seq1425) instead of one opaque code. 2899// Resolve a gate SOURCE path: /api/gate_run executes <t>.elf and the source is <t>.nx in one of the two dirs 2900// the build tree uses. Fills `sp` and returns 1 when found; returns 0 with sp empty when not. 2901// A NOT-FOUND MUST NEVER BE EMITTED AS FRESH. sf_src_stale answers 0 for an absent source ("nothing to be 2902// stale against"), correct for its own contract and exactly wrong as an answer to "is this verdict 2903// trustworthy" -- so the two cases are separated HERE rather than folded by the caller. 2904func ma_gate_src(nm: *u8, sp: *u8) -> i64 { 2905 // ORDER FIX 2026-08-07, and it was MY bug: this probed runtime/ first. nx_sov_build_run probes 2906 // runtime/_hdl_build/ FIRST, so a basename present in BOTH dirs compiles from _hdl_build and the 2907 // runtime copy is a SHADOW that never compiles (nx_janitor_dupname.nx:3 -- it found TWO 2908 // nx_sovereignty_audit.nx). Probing runtime/ first therefore reported freshness for a file the build 2909 // never reads: the same instrument-subject mismatch this field exists to expose, inside the field. 2910 // MATCH THE RESOLVER YOU ARE REPORTING ON, OR YOU ARE REPORTING ON A DIFFERENT FILE. 2911 var o: i64 = sd_cat(sp, 0, "/volume1/homes/elderwesto/nishihost/buildroot/runtime/_hdl_build/" as *u8) 2912 o = sd_cat(sp, o, nm) 2913 o = sd_cat(sp, o, ".nx" as *u8) 2914 sp[o] = 0 as u8 2915 if sf_mtime_ns(sp) >= 0 { return 1 } 2916 o = sd_cat(sp, 0, "/volume1/homes/elderwesto/nishihost/buildroot/runtime/" as *u8) 2917 o = sd_cat(sp, o, nm) 2918 o = sd_cat(sp, o, ".nx" as *u8) 2919 sp[o] = 0 as u8 2920 if sf_mtime_ns(sp) >= 0 { return 1 } 2921 sp[0] = 0 as u8 2922 return 0 2923} 2924 2925// ---- /api/gate_run: FAST verdict or PROMOTED job (lane J, 2026-08-23) ------------------------------ 2926// THE DEFECT. This route used to KILL the gate at its deadline and answer {"verdict":"TIMEOUT", 2927// "exit_code":-1} -- the ABSENCE of a verdict dressed as one. MEASURED 2026-08-23: nx_chkarith_gate and 2928// nx_boundscheck_gate both read TIMEOUT through this route under load 13/8, while nx_job_run of the SAME 2929// binaries returned 17/17 and 11/11 GREEN minutes later. That is the exact class the tools-API sync lane 2930// closed on 2026-08-22 (tr_run_capture_deadline + TR_PROMOTE: at the deadline the worker is handed back 2931// ALIVE instead of SIGKILLed), and this route now COMPOSES that same primitive: 2932// * finishes inside the window -> FAST: the verdict inline, byte-compatible with the old payload plus 2933// the additive fields path=FAST, deadline_src, capture_cap, capture_truncated; 2934// * still running at the deadline -> PROMOTED: the caller gets a JOB-STARTED handle (job id, .claim, 2935// .out) inside the reply window, the gate keeps running under its own pid, and ma_gate_run_finish -- 2936// called by main's HANDLER CHILD right after the response is on the wire -- drains the pipe to EOF, 2937// wait4()s the worker and publishes _jobs/job_<id>.out + the .claim (state=DONE rc= verdict=) by 2938// atomic rename. The handler child IS the worker's parent, so the exit code is REAL: a verifier's 2939// verdict is its exit code (seq585) and promoting must not trade it for PROMOTED-UNREAPED, which is 2940// why the drain lives in the handler child and not in a detached sibling that could never wait4(). 2941// The child holds a handler slot for the gate's duration -- exactly what a synchronous /api/build 2942// already does, bounded by MA_MAX_HANDLERS. 2943// THE DEADLINE IS DERIVED, NOT TYPED: knowledge/edge_window.conf (window - reply reserve) through the 2944// one-owner reader the tools API uses, so the two doors promote at the same instant and a retyped 2945// 12000 cannot drift from the edge again. An explicit deadline_ms still overrides it (a LAN caller on 2946// :18098 has no edge window), clamped exactly as before, and the payload names which source won. 2947// FIXTURE SEAMS (null = production): a gate importing this module points the elf root, the jobs dir and 2948// the window conf at its own scratch, so no gate shares a production plane (fixture-ratchet law). They 2949// are written ONLY by ma_gr_set_fixture, so one grep finds every writer. 2950const MA_GR_ROOT: *u8 = "/volume1/homes/elderwesto/nishihost/" as *u8 2951const MA_GR_JOBS: *u8 = "_jobs" as *u8 2952const MA_GR_CLAIM_PROBES: i64 = 100 // the tools-API job lane's anti-collision walk: epoch-second ids, +1 per O_EXCL collision 2953const MA_GR_O_EXCL_CREATE: i64 = 193 // O_CREAT(0x40)|O_EXCL(0x80)|O_WRONLY(0x1): the reservation IS the open 2954const MA_GR_CAPTURE_CAP: i64 = MA_MAGIC_16384 // FAST-path transcript cap (rb is MA_MAGIC_65536 and ma_gate_esc can double a byte); ANNOUNCED in the payload, no longer silent 2955const MA_GR_DEADLINE_MIN_MS: i64 = 1000 2956const MA_GR_DEADLINE_MAX_MS: i64 = MA_MAGIC_300000 2957const MA_GR_SRC_CALLER: i64 = 2 // deadline_src: 0 = compiled default, 1 = conf row (TEA_SRC_*), 2 = caller's deadline_ms 2958static ma_gr_root_ov: *u8 2959static ma_gr_jobs_ov: *u8 2960static ma_gr_conf_ov: *u8 2961static ma_gr_pend_pid: i64 2962static ma_gr_pend_rfd: i64 2963static ma_gr_pend_jid: i64 2964static ma_gr_pend_buf: *u8 2965static ma_gr_pend_n: i64 2966static ma_gr_pend_nm: *u8 2967func ma_gr_set_fixture(root: *u8, jobs: *u8, conf: *u8) -> i64 { ma_gr_root_ov = root; ma_gr_jobs_ov = jobs; ma_gr_conf_ov = conf; return 0 } 2968func ma_gr_root() -> *u8 { if (ma_gr_root_ov as i64) != 0 { return ma_gr_root_ov } return MA_GR_ROOT } 2969func ma_gr_jobs() -> *u8 { if (ma_gr_jobs_ov as i64) != 0 { return ma_gr_jobs_ov } return MA_GR_JOBS } 2970func ma_gr_conf() -> *u8 { if (ma_gr_conf_ov as i64) != 0 { return ma_gr_conf_ov } return TEA_WINDOW_CONF } 2971// ONE exit-code -> verdict mapping for BOTH paths. A second mapping is how a false GREEN gets manufactured. 2972func ma_gr_verdict(rc: i64) -> *u8 { 2973 if rc == 0 { return "GREEN" as *u8 } 2974 if rc == 127 { return "NOT-FOUND" as *u8 } 2975 if rc == 3 { return "SKIP" as *u8 } // gv_verdict precondition-missing: PROVED NOTHING, not a failure 2976 if rc == (0 - 1) { return "SIGNALLED" as *u8 } 2977 if rc == (0 - 5) { return "TIMEOUT" as *u8 } // TR_ERR_TIMEOUT: unreachable on the promotable path, kept total 2978 if rc == (0 - 2) { return "HARNESS-PIPE-FAIL" as *u8 } 2979 if rc == (0 - 3) { return "HARNESS-FORK-FAIL" as *u8 } 2980 if rc == (0 - 4) { return "HARNESS-WAIT-FAIL" as *u8 } 2981 if rc < 0 { return "HARNESS-FAIL" as *u8 } 2982 return "RED" as *u8 2983} 2984func ma_gr_src_txt(src: i64) -> *u8 { 2985 if src == MA_GR_SRC_CALLER { return "caller" as *u8 } 2986 if src == TEA_SRC_CONF { return "conf" as *u8 } 2987 return "default" as *u8 2988} 2989// <jobs>/job_<jid><sfx>, NUL-terminated into dst; returns the length. 2990func ma_gr_jobpath(dst: *u8, jid: i64, sfx: *u8) -> i64 { 2991 var o: i64 = sd_cat(dst, 0, ma_gr_jobs()) 2992 o = sd_cat(dst, o, "/job_" as *u8) 2993 o = sd_catn(dst, o, jid) 2994 o = sd_cat(dst, o, sfx) 2995 dst[o] = 0 as u8 2996 return o 2997} 2998// Reserve a job id by O_EXCL-creating its .claim (state=CLAIMED). The same epoch-second id space and 2999// the same reservation file the tools-API job lane uses, so the two doors cannot hand out one id twice. 3000// Returns the id, or -1 when every probe collided (pathbuf then holds the last path tried). 3001func ma_gr_claim(nm: *u8, pathbuf: *u8) -> i64 { 3002 sys_mkdir(ma_gr_jobs(), MODE_0755) 3003 var jid: i64 = sys_now_realtime_sec() 3004 var probe: i64 = 0 3005 var got: i64 = 0 - 1 3006 let cb: *u8 = sys_mmap(512) 3007 while probe < MA_GR_CLAIM_PROBES { 3008 ma_gr_jobpath(pathbuf, jid, ".claim" as *u8) 3009 let cfd: i64 = __syscall(SYS_OPENAT, AT_FDCWD, pathbuf, MA_GR_O_EXCL_CREATE, MODE_0644, 0, 0) 3010 if cfd >= 0 { 3011 var o: i64 = sd_cat(cb, 0, "state=CLAIMED ts=" as *u8) 3012 o = sd_catn(cb, o, jid) 3013 o = sd_cat(cb, o, " route=gate_run target=" as *u8) 3014 o = sd_cat(cb, o, nm) 3015 cb[o] = 10 as u8 3016 o = o + 1 3017 sys_write(cfd, cb, o) 3018 sys_close(cfd) 3019 got = jid 3020 probe = MA_GR_CLAIM_PROBES 3021 } else { jid = jid + 1; probe = probe + 1 } 3022 } 3023 return got 3024} 3025// THE PROMOTED TAIL. Called by main's handler child AFTER the JOB-STARTED reply is on the wire (and by the 3026// gate directly). Streams the pre-promotion capture plus everything the still-running gate writes into 3027// <jobs>/job_<jid>.tmp (no cap: a transcript is whatever the gate printed), wait4()s the worker for its 3028// REAL exit code, renames .tmp -> .out, then rewrites the .claim to state=DONE by rename. Returns the exit 3029// code, or -1 with nothing pending. Idempotent: the pending record is cleared before returning. 3030func ma_gate_run_finish() -> i64 { 3031 if ma_gr_pend_pid == 0 { return 0 - 1 } 3032 let pid: i64 = ma_gr_pend_pid 3033 let rfd: i64 = ma_gr_pend_rfd 3034 let jid: i64 = ma_gr_pend_jid 3035 let pre: *u8 = ma_gr_pend_buf 3036 let pren: i64 = ma_gr_pend_n 3037 let nm: *u8 = ma_gr_pend_nm 3038 ma_gr_pend_pid = 0 3039 let ptmp: *u8 = sys_mmap(512) 3040 let pout: *u8 = sys_mmap(512) 3041 let pclaim: *u8 = sys_mmap(512) 3042 let pctmp: *u8 = sys_mmap(512) 3043 ma_gr_jobpath(ptmp, jid, ".tmp" as *u8) 3044 ma_gr_jobpath(pout, jid, ".out" as *u8) 3045 ma_gr_jobpath(pclaim, jid, ".claim" as *u8) 3046 ma_gr_jobpath(pctmp, jid, ".ctmp" as *u8) 3047 let tfd: i64 = sys_openat_wr(ptmp, MODE_0644) 3048 var total: i64 = 0 3049 if tfd >= 0 { if pren > 0 { sys_write(tfd, pre, pren); total = pren } } 3050 let chunk: *u8 = sys_mmap(MA_MAGIC_65536) 3051 var run: i64 = 1 3052 var eintr: i64 = 0 3053 while run == 1 { 3054 let r: i64 = sys_read(rfd, chunk, MA_MAGIC_65536) 3055 if r > 0 { if tfd >= 0 { sys_write(tfd, chunk, r) } total = total + r } else { 3056 if r == 0 { run = 0 } else { 3057 if r == TR_EINTR { if eintr > TR_EINTR_MAX { run = 0 } else { eintr = eintr + 1 } } else { run = 0 } 3058 } 3059 } 3060 } 3061 sys_close(rfd) 3062 if tfd >= 0 { sys_close(tfd); sys_renameat(ptmp, pout) } 3063 let stp: *i64 = sys_mmap(16) as *i64 3064 let w: i64 = sys_wait4(pid, stp, 0) 3065 var rc: i64 = 0 - 4 3066 if w >= 0 { 3067 let termsig: i64 = stp[0] & 0x7F 3068 if termsig != 0 { rc = 0 - 1 } else { rc = wait_exit_code(stp[0]) } 3069 } 3070 let cb: *u8 = sys_mmap(512) 3071 var o: i64 = sd_cat(cb, 0, "state=DONE rc=" as *u8) 3072 if rc < 0 { o = sd_cat(cb, o, "-1" as *u8) } else { o = sd_catn(cb, o, rc) } 3073 o = sd_cat(cb, o, " verdict=" as *u8) 3074 o = sd_cat(cb, o, ma_gr_verdict(rc)) 3075 o = sd_cat(cb, o, " exit=REAPED bytes=" as *u8) 3076 o = sd_catn(cb, o, total) 3077 o = sd_cat(cb, o, " target=" as *u8) 3078 o = sd_cat(cb, o, nm) 3079 cb[o] = 10 as u8 3080 o = o + 1 3081 let cfd: i64 = sys_openat_wr(pctmp, MODE_0644) 3082 if cfd >= 0 { sys_write(cfd, cb, o); sys_close(cfd); sys_renameat(pctmp, pclaim) } 3083 return rc 3084} 3085// gate_src freshness block, ONE emitter for both payload shapes (it used to be inline in the FAST path). 3086func ma_gr_emit_freshness(rb: *u8, b0: i64, nm: *u8, ep: *u8) -> i64 { 3087 var b: i64 = b0 3088 let sp: *u8 = sys_mmap(512) 3089 b = sd_cat(rb, b, ",\"gate_src\":\"" as *u8) 3090 if ma_gate_src(nm, sp) == 1 { 3091 let sn: i64 = sf_src_stale(ep, sp) 3092 let lg: i64 = sf_lag_sec(ep, sp) 3093 b = sd_cat(rb, b, sp) 3094 b = sd_cat(rb, b, "\",\"source_newer\":" as *u8) 3095 b = sd_catn(rb, b, sn) 3096 b = sd_cat(rb, b, ",\"src_lag_sec\":" as *u8) 3097 if lg < 0 { b = sd_cat(rb, b, "-1" as *u8) } 3098 else { b = sd_catn(rb, b, lg) } 3099 } 3100 else { 3101 // sd_catn cannot render a negative -- the verdict block writes "-1" as a literal for the same 3102 // reason -- and -1 here means UNRESOLVED SOURCE, a different fact from 0 (fresh). 3103 b = sd_cat(rb, b, "\",\"source_newer\":-1,\"src_lag_sec\":-1" as *u8) 3104 } 3105 b = sd_cat(rb, b, ",\"freshness_scope\":\"own-source mtime only; shared-dep staleness is nx_rebuild_plan (it names the trigger file); nx_stale_check <target> rebuilds and byte-compares to confirm\"" as *u8) 3106 return b 3107} 3108 3109func ma_do_gate_run(req: *u8, req_n: i64, out: *u8) -> i64 { 3110 let body_off: i64 = sd_body_off(req, req_n) 3111 let body: *u8 = ((req as i64) + body_off) as *u8 3112 let body_n: i64 = req_n - body_off 3113 let toff: *i64 = sys_mmap(8) as *i64 3114 let tn: *i64 = sys_mmap(8) as *i64 3115 if sd_form_field(body, body_n, "target" as *u8, 6, toff, tn) != 1 { 3116 return ma_emit_400(out, "{\"error\":\"missing target\"}" as *u8) 3117 } 3118 let nm: *u8 = sys_mmap(128) 3119 if ma_sanitize_name(body, toff[0], tn[0], nm, 120) != 1 { 3120 return ma_emit_400(out, "{\"error\":\"invalid target name (only [a-zA-Z0-9_])\"}" as *u8) 3121 } 3122 if md_gate_name_ok(nm) != 1 { 3123 return ma_emit_400(out, "{\"error\":\"target refused: /api/gate_run executes VERIFIERS ONLY -- the name must end in gate, test or kat. That bound is what makes this route never-brick: it cannot reach a daemon, promoter or deployer.\"}" as *u8) 3124 } 3125 // DEADLINE = the one-owner edge pair (window - reply reserve), or the caller's explicit deadline_ms. 3126 let promsrc: *i64 = sys_mmap(16) as *i64 3127 var dl: i64 = tea_sync_promote_ms_from(ma_gr_conf(), promsrc) 3128 var dlsrc: i64 = promsrc[0] 3129 let doff: *i64 = sys_mmap(8) as *i64 3130 let dn: *i64 = sys_mmap(8) as *i64 3131 if sd_form_field(body, body_n, "deadline_ms" as *u8, 11, doff, dn) == 1 { 3132 let v: i64 = mau_qint(body, doff[0], dn[0]) 3133 if v > 0 { dl = v; dlsrc = MA_GR_SRC_CALLER } 3134 } 3135 if dl < MA_GR_DEADLINE_MIN_MS { dl = MA_GR_DEADLINE_MIN_MS } 3136 if dl > MA_GR_DEADLINE_MAX_MS { dl = MA_GR_DEADLINE_MAX_MS } 3137 let ep: *u8 = sys_mmap(256) 3138 var eo: i64 = sd_cat(ep, 0, ma_gr_root()) 3139 eo = sd_cat(ep, eo, nm) 3140 eo = sd_cat(ep, eo, ".elf" as *u8) 3141 ep[eo] = 0 as u8 3142 let cbuf: *u8 = sys_mmap(MA_MAGIC_65536) 3143 let clen: *i64 = sys_mmap(16) as *i64 3144 clen[0] = 0 3145 let gargv: *i64 = sys_mmap(32) as *i64 3146 gargv[0] = ep as i64 3147 gargv[1] = 0 3148 let wpid: *i64 = sys_mmap(16) as *i64 3149 let wrfd: *i64 = sys_mmap(16) as *i64 3150 let rc: i64 = tr_run_capture_deadline(ep, gargv, cbuf, MA_GR_CAPTURE_CAP, clen, dl, wpid, wrfd) 3151 let cn: i64 = clen[0] 3152 let rb: *u8 = sys_mmap(MA_MAGIC_65536) 3153 var b: i64 = sd_cat(rb, 0, "{\"action\":\"GATE-RUN\",\"target\":\"" as *u8) 3154 b = sd_cat(rb, b, nm) 3155 if rc == TR_PROMOTE { 3156 // The gate outran the window: hand the caller a job, keep the worker ALIVE, finish after replying. 3157 let cpath: *u8 = sys_mmap(512) 3158 let jid: i64 = ma_gr_claim(nm, cpath) 3159 if jid < 0 { 3160 // could not reserve an id: the only honest answer is the old one -- drain inline past the window 3161 // rather than orphan a running gate with no artifact. Named in the payload, never silent. 3162 ma_gr_pend_pid = wpid[0]; ma_gr_pend_rfd = wrfd[0]; ma_gr_pend_jid = 0; ma_gr_pend_buf = cbuf; ma_gr_pend_n = cn; ma_gr_pend_nm = nm 3163 let irc: i64 = ma_gate_run_finish() 3164 b = sd_cat(rb, b, "\",\"path\":\"INLINE-NO-CLAIM\",\"exit_code\":" as *u8) 3165 if irc < 0 { b = sd_cat(rb, b, "-1" as *u8) } else { b = sd_catn(rb, b, irc) } 3166 b = sd_cat(rb, b, ",\"deadline_ms\":" as *u8) 3167 b = sd_catn(rb, b, dl) 3168 b = sd_cat(rb, b, ",\"deadline_src\":\"" as *u8) 3169 b = sd_cat(rb, b, ma_gr_src_txt(dlsrc)) 3170 b = sd_cat(rb, b, "\",\"verdict\":\"" as *u8) 3171 b = sd_cat(rb, b, ma_gr_verdict(irc)) 3172 b = sd_cat(rb, b, "\",\"note\":\"the gate outran the reply window but every claim probe collided, so it was drained INLINE instead of promoted -- the verdict is real, the reply may have missed the edge window; check " as *u8) 3173 b = sd_cat(rb, b, cpath) 3174 b = sd_cat(rb, b, "\"}" as *u8) 3175 rb[b] = 0 as u8 3176 return ma_emit_200(out, rb) 3177 } 3178 ma_gr_pend_pid = wpid[0] 3179 ma_gr_pend_rfd = wrfd[0] 3180 ma_gr_pend_jid = jid 3181 ma_gr_pend_buf = cbuf 3182 ma_gr_pend_n = cn 3183 ma_gr_pend_nm = nm 3184 let opath: *u8 = sys_mmap(512) 3185 ma_gr_jobpath(opath, jid, ".out" as *u8) 3186 b = sd_cat(rb, b, "\",\"path\":\"PROMOTED\",\"job\":" as *u8) 3187 b = sd_catn(rb, b, jid) 3188 b = sd_cat(rb, b, ",\"claim\":\"" as *u8) 3189 b = sd_cat(rb, b, cpath) 3190 b = sd_cat(rb, b, "\",\"out\":\"" as *u8) 3191 b = sd_cat(rb, b, opath) 3192 b = sd_cat(rb, b, "\",\"exit_code\":-7,\"verdict\":\"PROMOTED\",\"deadline_ms\":" as *u8) 3193 b = sd_catn(rb, b, dl) 3194 b = sd_cat(rb, b, ",\"deadline_src\":\"" as *u8) 3195 b = sd_cat(rb, b, ma_gr_src_txt(dlsrc)) 3196 b = sd_cat(rb, b, "\",\"bytes\":" as *u8) 3197 b = sd_catn(rb, b, cn) 3198 b = sd_cat(rb, b, ",\"note\":\"JOB-STARTED: the gate outran the reply window and was PROMOTED to the job lane, NOT killed -- it is still running under its own pid and its verdict is NOT in this reply. Poll the claim: state=CLAIMED -> state=DONE rc=<exit> verdict=<GREEN|RED|SKIP|...> (the exit code is the gate's own, reaped by this handler); the transcript is the out artifact. A previous build of this daemon would have SIGKILLed the gate here and answered verdict=TIMEOUT.\"" as *u8) 3199 b = ma_gr_emit_freshness(rb, b, nm, ep) 3200 b = sd_cat(rb, b, ",\"output\":\"" as *u8) 3201 b = ma_gate_esc(rb, b, cbuf, cn) 3202 b = sd_cat(rb, b, "\"}" as *u8) 3203 rb[b] = 0 as u8 3204 return ma_emit_200(out, rb) 3205 } 3206 b = sd_cat(rb, b, "\",\"path\":\"FAST\",\"exit_code\":" as *u8) 3207 if rc < 0 { b = sd_cat(rb, b, "-1" as *u8) } 3208 if rc >= 0 { b = sd_catn(rb, b, rc) } 3209 b = sd_cat(rb, b, ",\"deadline_ms\":" as *u8) 3210 b = sd_catn(rb, b, dl) 3211 b = sd_cat(rb, b, ",\"deadline_src\":\"" as *u8) 3212 b = sd_cat(rb, b, ma_gr_src_txt(dlsrc)) 3213 b = sd_cat(rb, b, "\",\"verdict\":\"" as *u8) 3214 b = sd_cat(rb, b, ma_gr_verdict(rc)) 3215 b = sd_cat(rb, b, "\",\"bytes\":" as *u8) 3216 b = sd_catn(rb, b, cn) 3217 b = sd_cat(rb, b, ",\"capture_cap\":" as *u8) 3218 b = sd_catn(rb, b, MA_GR_CAPTURE_CAP) 3219 b = sd_cat(rb, b, ",\"capture_truncated\":" as *u8) 3220 if cn >= MA_GR_CAPTURE_CAP { b = sd_cat(rb, b, "1" as *u8) } else { b = sd_cat(rb, b, "0" as *u8) } 3221 // FRESHNESS TRAVELS WITH THE VERDICT (2026-08-07, debt 1786111257). A gate ELF STATICALLY LINKS its libs, 3222 // so verdict=GREEN is a claim about the tree AS OF THE BUILD -- never the tree on disk. This route is where 3223 // a gate verdict BECOMES the evidence a caller acts on, so the fact has to ride in THIS response. 3224 // MEASURED: nx_fsops_gate served GREEN pass=23/23 from a 2026-07-29 binary whose source declared 28 checks, 3225 // and the mtime that would have exposed it was ALREADY available to this same process (/api/promote prints 3226 // live_mtime in its refusal). The number was there; nothing put it next to the verdict. 3227 // IT DOES NOT DOWNGRADE THE VERDICT: a gate can be legitimately stale-by-comment -- a comment-only edit 3228 // moves the source mtime and leaves codegen byte-identical (proven the same day, same sha across a header 3229 // edit) -- so report the fact and let the caller judge. Own-source only: ONE stat, no import-closure walk, 3230 // therefore source_newer=0 is NOT a claim of full freshness and the scope says so in the payload. 3231 b = ma_gr_emit_freshness(rb, b, nm, ep) 3232 b = sd_cat(rb, b, ",\"output\":\"" as *u8) 3233 b = ma_gate_esc(rb, b, cbuf, cn) 3234 b = sd_cat(rb, b, "\"" as *u8) 3235 b = sd_cat(rb, b, "}" as *u8) 3236 rb[b] = 0 as u8 3237 return ma_emit_200(out, rb) 3238} 3239 3240// POST /api/proc_kill {match=<needle>&confirm=yes} (seq1383): the verb whose absence forced ssh. Bound in 3241// md_proc_kill_needle_ok, enforced in code. killed:0 is reported honestly as a MISS, never as success. 3242func ma_do_proc_kill(req: *u8, req_n: i64, out: *u8) -> i64 { 3243 let body_off: i64 = sd_body_off(req, req_n) 3244 let body: *u8 = ((req as i64) + body_off) as *u8 3245 let body_n: i64 = req_n - body_off 3246 let moff: *i64 = sys_mmap(8) as *i64 3247 let mn: *i64 = sys_mmap(8) as *i64 3248 if sd_form_field(body, body_n, "match" as *u8, 5, moff, mn) != 1 { 3249 return ma_emit_400(out, "{\"error\":\"missing match (the cmdline needle, e.g. nx_tools_api_serve.elf.new)\"}" as *u8) 3250 } 3251 if ma_confirmed(req, req_n) == 0 { 3252 return ma_emit_400(out, "{\"error\":\"proc_kill requires confirm=yes\"}" as *u8) 3253 } 3254 if mn[0] <= 0 { return ma_emit_400(out, "{\"error\":\"empty match\"}" as *u8) } 3255 if mn[0] > 120 { return ma_emit_400(out, "{\"error\":\"match too long\"}" as *u8) } 3256 let nd: *u8 = sys_mmap(256) 3257 var i: i64 = 0 3258 while i < mn[0] { nd[i] = body[moff[0] + i]; i = i + 1 } 3259 nd[mn[0]] = 0 as u8 3260 if md_proc_kill_needle_ok(nd) != 1 { 3261 return ma_emit_400(out, "{\"error\":\"match refused: proc_kill targets OUR OWN organs only -- the needle must be >=6 chars, must contain .elf, and must not reach the supervisor (nx_hostctl/supervise). Killing the guard would stop every respawn in the ecosystem.\"}" as *u8) 3262 } 3263 let killed: i64 = md_kill_by_name(nd) 3264 let rb: *u8 = sys_mmap(MA_MAGIC_1024) 3265 var b: i64 = sd_cat(rb, 0, "{\"action\":\"PROC-KILL\",\"match\":\"" as *u8) 3266 b = ma_gate_esc(rb, b, nd, mn[0]) 3267 b = sd_cat(rb, b, "\",\"killed\":" as *u8) 3268 b = sd_catn(rb, b, killed) 3269 b = sd_cat(rb, b, ",\"note\":\"guard-supervised daemons respawn from the on-disk binary; killed:0 means NOTHING matched, not success\"}" as *u8) 3270 rb[b] = 0 as u8 3271 return ma_emit_200(out, rb) 3272} 3273 3274func ma_do_put_source(req: *u8, req_n: i64, out: *u8) -> i64 { 3275 let poff: *i64 = sys_mmap(8) as *i64 3276 let plen: *i64 = sys_mmap(8) as *i64 3277 poff[0] = 0 3278 plen[0] = 0 3279 sd_find_path(req, req_n, poff, plen) 3280 let path: *u8 = ((req as i64) + poff[0]) as *u8 3281 let pn: i64 = plen[0] 3282 let qoff: i64 = mau_query_off(path, pn) 3283 if qoff < 0 { return ma_emit_400(out, "{\"error\":\"missing query param name\"}" as *u8) } 3284 let noff: *i64 = sys_mmap(8) as *i64 3285 let nlen: *i64 = sys_mmap(8) as *i64 3286 if mau_qparam(path, pn, qoff, "name" as *u8, 4, noff, nlen) != 1 { 3287 return ma_emit_400(out, "{\"error\":\"missing name\"}" as *u8) 3288 } 3289 let nm: *u8 = sys_mmap(128) 3290 if ma_sanitize_name(path, noff[0], nlen[0], nm, 120) != 1 { 3291 return ma_emit_400(out, "{\"error\":\"invalid name (only [a-zA-Z0-9_])\"}" as *u8) 3292 } 3293 let fp: *u8 = sys_mmap(256) 3294 var fo: i64 = sd_cat(fp, 0, "runtime/" as *u8) 3295 fo = sd_cat(fp, fo, nm) 3296 fo = sd_cat(fp, fo, ".nx" as *u8) 3297 fp[fo] = 0 as u8 3298 let body_off: i64 = sd_body_off(req, req_n) 3299 let body: *u8 = ((req as i64) + body_off) as *u8 3300 let body_n: i64 = req_n - body_off 3301 if body_n <= 0 { return ma_emit_400(out, "{\"error\":\"empty body (POST the raw .nx source)\"}" as *u8) } 3302 let fd: i64 = sys_openat_wr(fp, 0x1a4) 3303 if fd < 0 { return ma_emit_400(out, "{\"error\":\"cannot open source file for write\"}" as *u8) } 3304 var off: i64 = 0 3305 while off < body_n { 3306 let w: i64 = sys_write(fd, ((body as i64) + off) as *u8, body_n - off) 3307 if w <= 0 { sys_close(fd); return ma_emit_400(out, "{\"error\":\"write failed\"}" as *u8) } 3308 off = off + w 3309 } 3310 sys_close(fd) 3311 let rb: *u8 = sys_mmap(256) 3312 var b: i64 = sd_cat(rb, 0, "{\"action\":\"WROTE\",\"file\":\"runtime/" as *u8) 3313 b = sd_cat(rb, b, nm) 3314 b = sd_cat(rb, b, ".nx\",\"bytes\":" as *u8) 3315 b = sd_catn(rb, b, body_n) 3316 b = sd_cat(rb, b, "}" as *u8) 3317 rb[b] = 0 as u8 3318 return ma_emit_200(out, rb) 3319} 3320 3321func ma_do_deploy(req: *u8, req_n: i64, out: *u8) -> i64 { 3322 let body_off: i64 = sd_body_off(req, req_n) 3323 let body: *u8 = ((req as i64) + body_off) as *u8 3324 let body_n: i64 = req_n - body_off 3325 let toff: *i64 = sys_mmap(8) as *i64 3326 let tn: *i64 = sys_mmap(8) as *i64 3327 if sd_form_field(body, body_n, "target" as *u8, 6, toff, tn) != 1 { 3328 return ma_emit_400(out, "{\"error\":\"missing target\"}" as *u8) 3329 } 3330 let kindb: *i64 = sys_mmap(8) as *i64 3331 let srcbuf: *u8 = sys_mmap(512) 3332 let subbuf: *u8 = sys_mmap(64) 3333 let urlbuf: *u8 = sys_mmap(256) 3334 let rbbuf: *u8 = sys_mmap(64) // per-target rollback sub (generalized deploy; legacy rows default to "rollback") 3335 let target_rc:i64=md_resolve_target("knowledge/hosting/deploy_targets.conf" as *u8, body, toff[0], tn[0], kindb, srcbuf, subbuf, urlbuf, rbbuf) 3336 if target_rc==2 { let problem:*u8="{\"error\":\"VERSIONED_OPERATION_REQUIRED\",\"operation\":\"/api/v2/promote_toolchain\",\"published\":false}";return ma_emit_json(out,"HTTP/1.1 409 Conflict\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: ",problem,sd_len(problem)) } 3337 if target_rc!=1 { 3338 return ma_emit_400(out, "{\"error\":\"unknown target (not in deploy_targets.conf allowlist)\"}" as *u8) 3339 } 3340 // Derive the build-path name when the row's artifact is absent. ⚠THE SUFFIX IS NOT ALWAYS ".new": rows 3341 // name EITHER "<t>.new" (hostctl) OR "<t>.elf.new" (mgmtapi, relate, opaquelogin...). Stripping a fixed 4 3342 // chars turned "nx_mgmt_api.elf.new" into "nx_mgmt_api.elf.sov.elf.new" -- a name that exists nowhere, so 3343 // the fallback silently did nothing for every .elf.new row. It LOOKED correct only because a stale 3344 // .elf.new was still on disk; consuming that leftover exposed the flaw immediately. Strip ".elf.new" 3345 // when present, else ".new". 3346 var valid: i64 = md_validate_artifact(srcbuf, kindb[0]); if valid == 0 { let sl: i64 = md_len(srcbuf); var cut: i64 = 4; if sl > 8 { if (srcbuf[sl-8] as i64) == 46 { if (srcbuf[sl-7] as i64) == 101 { if (srcbuf[sl-6] as i64) == 108 { if (srcbuf[sl-5] as i64) == 102 { cut = 8 } } } } } if sl > cut { let altp: *u8 = sys_mmap(512); md_copy_slice_z(altp, srcbuf, 0, sl - cut, 512); let ao: i64 = sd_cat(altp, sl - cut, ".sov.elf.new" as *u8); altp[ao] = 0 as u8; if md_validate_artifact(altp, kindb[0]) == 1 { md_copy_slice_z(srcbuf, altp, 0, ao, 512); valid = 1 } } } 3347 if valid == 0 { 3348 // honest ops: "no staged artifact" and "staged artifact failed validation" are different failures 3349 let pfd: i64 = sys_openat_rd(srcbuf) 3350 if pfd < 0 { return ma_emit_200(out, "{\"action\":\"ABORT\",\"verdict\":\"nothing staged for this target (chunk-upload to /api/upload first); NOTHING promoted, site untouched\"}" as *u8) } 3351 sys_close(pfd) 3352 return ma_emit_200(out, "{\"action\":\"ABORT\",\"verdict\":\"staged artifact failed validation (bad ELF/too small); NOTHING promoted, site untouched\"}" as *u8) 3353 } 3354 // ---- ROUTE-SUPERSET GUARD (id=1785447778, the 5th mgmt route regression -- one of them mine) ------- 3355 // A deploy that DELETES live API surface is always wrong, whatever the host load. I removed 3356 // /api/gate_run + /api/proc_kill by promoting a 528323-byte artifact over a 575195-byte one; the 3357 // byte DECREASE was visible and nothing checked it. nx_route_diff already printed the right words 3358 // ('route(s) vanished = deploy contract regression') and was never wired into this path. 3359 // FAIL-OPEN BY CONSTRUCTION, and that is the whole safety argument: only a POSITIVE detection of a 3360 // vanished route refuses. Unreadable live artifact, unreadable candidate, zero routes extracted -- 3361 // every one of those PROCEEDS. A buggy guard here could otherwise refuse every future deploy 3362 // INCLUDING ITS OWN FIX, which is exactly the deadlock that made load-gating deploys the wrong 3363 // idea (id=1785450386). Deliberate surface removal stays possible via confirm_route_loss=yes. 3364 let rg_live: *u8 = sys_mmap(512) 3365 let rg_sl: i64 = md_len(srcbuf) 3366 if rg_sl > 4 { 3367 md_copy_slice_z(rg_live, srcbuf, 0, rg_sl - 4, 512) // strip the trailing ".new" 3368 let rg_lb: *u8 = sys_mmap(RG_BUF) 3369 let rg_ln: i64 = rg_read(rg_live, rg_lb, RG_BUF) 3370 if rg_ln > 0 { 3371 let rg_cb: *u8 = sys_mmap(RG_BUF) 3372 let rg_cn: i64 = rg_read(srcbuf, rg_cb, RG_BUF) 3373 if rg_cn > 0 { 3374 let rg_nm: *u8 = sys_mmap(RG_MAXR * RG_NAMEMAX) 3375 let rg_ls: *i64 = sys_mmap(RG_MAXR * 8) as *i64 3376 let rg_tr: *i64 = sys_mmap(16) as *i64 3377 let rg_ms: *i64 = sys_mmap(RG_MAXR * 8) as *i64 3378 let rg_rc: i64 = rg_extract(rg_lb, rg_ln, rg_nm, rg_ls, rg_tr) 3379 if rg_rc > 0 { 3380 let rg_miss: i64 = rg_missing(rg_nm, rg_ls, rg_rc, rg_cb, rg_cn, rg_ms, RG_MAXR) 3381 if rg_miss > 0 { 3382 let rg_co: *i64 = sys_mmap(8) as *i64 3383 let rg_cl: *i64 = sys_mmap(8) as *i64 3384 var rg_ok: i64 = 0 3385 if sd_form_field(body, body_n, "confirm_route_loss" as *u8, 18, rg_co, rg_cl) == 1 { 3386 if md_slice_eq(body, rg_co[0], rg_cl[0], "yes" as *u8, 0, 3) == 1 { rg_ok = 1 } 3387 } 3388 if rg_ok == 0 { 3389 let rgb: *u8 = sys_mmap(MA_MAGIC_4096) 3390 var rgo: i64 = sd_cat(rgb, 0, "{\"action\":\"ABORT\",\"verdict\":\"DEPLOY CONTRACT REGRESSION -- the staged artifact DROPS " as *u8) 3391 rgo = sd_catn(rgb, rgo, rg_miss) 3392 rgo = sd_cat(rgb, rgo, " of " as *u8) 3393 rgo = sd_catn(rgb, rgo, rg_rc) 3394 rgo = sd_cat(rgb, rgo, " /api routes the LIVE binary serves. Promoting it would DELETE working API surface -- this is how /api/gate_run and /api/proc_kill vanished five times. NOTHING promoted, live untouched. Rebuild the candidate from a source tree that still carries those routes (a byte-count DECREASE after an addition is a revert), or pass confirm_route_loss=yes if the removal is DELIBERATE.\",\"routes_live\":" as *u8) 3395 rgo = sd_catn(rgb, rgo, rg_rc) 3396 rgo = sd_cat(rgb, rgo, ",\"routes_missing\":" as *u8) 3397 rgo = sd_catn(rgb, rgo, rg_miss) 3398 rgo = sd_cat(rgb, rgo, ",\"detector\":\"nx_routeguard\"}" as *u8) 3399 rgb[rgo] = 0 as u8 3400 return ma_emit_200(out, rgb) 3401 } 3402 } 3403 } 3404 } 3405 } 3406 } 3407 3408 // ---- STAGING HYGIENE ON THE DAEMON LANE (2026-08-06, debt 1785531571) --------------------------- 3409 // /api/promote carries this guard, but DAEMONS cannot use /api/promote -- they come through here and 3410 // then through nx_hostctl's hc_promote_to, a SECOND promote primitive in a different binary. Guarding 3411 // only the organ lane would be the same lesson learned in one binary and not the other. The paths are 3412 // already resolved above, so this reuses rg_live (live) and srcbuf (staged) rather than re-deriving. 3413 // 3414 // FAIL-OPEN, for exactly the reason the routeguard above states: this verb deploys nx_mgmt_api ITSELF, 3415 // so a guard that refused on a read error could refuse its own fix and wedge every seat. ONLY a 3416 // POSITIVE classification with real numbers refuses; NONE, unreadable, and ORPHAN all PROCEED. 3417 // NOTE THE RESIDUAL, stated rather than hidden: when the .sov.elf.new fallback above rewrote srcbuf, 3418 // rg_live names a path that never exists, the classification is ORPHAN, and this guard is inert for 3419 // that row -- the same blind spot the routeguard has, and it fails in the safe direction. 3420 // ⚠hc_promote_to itself stays UNGUARDED ON PURPOSE: it is also the primitive behind all 12 rollback 3421 // verbs, and a rollback is a DELIBERATE backwards move. Guarding it there would remove the reverse 3422 // gear, which Rule 26 forbids outright. 3423 if rg_sl > 4 { 3424 let dhcfg: *i64 = sys_mmap(8 * SG_C_SLOTS) as *i64 3425 sg_conf_load(dhcfg) 3426 let dhout: *i64 = sys_mmap(8 * SG_OUT_SLOTS) as *i64 3427 let dhc: i64 = sg_classify(rg_live, srcbuf, sys_now_realtime_sec(), dhcfg, dhout) 3428 var dhdeny: i64 = 0 3429 if dhc == SG_BACKDATE { dhdeny = 1 } 3430 if dhc == SG_EXPIRED { dhdeny = 1 } 3431 if dhc == SG_SHRINK { dhdeny = 1 } 3432 if dhc == SG_CAPLOSS { dhdeny = 1 } 3433 if dhdeny == 1 { 3434 let dho: *i64 = sys_mmap(8) as *i64 3435 let dhl: *i64 = sys_mmap(8) as *i64 3436 var dhok: i64 = 0 3437 if sd_form_field(body, body_n, "allow_capability_loss" as *u8, 21, dho, dhl) == 1 { 3438 if md_slice_eq(body, dho[0], dhl[0], "yes" as *u8, 0, 3) == 1 { dhok = 1 } 3439 } 3440 if dhok == 0 { 3441 let dhb: *u8 = sys_mmap(MA_MAGIC_2048) 3442 var dhq: i64 = sd_cat(dhb, 0, "{\"action\":\"ABORT\",\"verdict\":\"STAGING HYGIENE -- the staged artifact would walk this daemon BACKWARDS. NOTHING promoted, live untouched. A .new older than the binary it replaces is a rollback wearing an upgrade filename; one that drops the live binary's printable capability runs is a silent feature regression, and neither size nor mtime alone catches that case. Rebuild the candidate so it is genuinely newer, or pass allow_capability_loss=yes if the regression is DELIBERATE.\",\"class\":\"" as *u8) 3443 dhq = sd_cat(dhb, dhq, sg_class_name(dhc)) 3444 dhq = sd_cat(dhb, dhq, "\",\"live_bytes\":" as *u8) 3445 dhq = sd_catn(dhb, dhq, dhout[SG_O_LIVESZ]) 3446 dhq = sd_cat(dhb, dhq, ",\"staged_bytes\":" as *u8) 3447 dhq = sd_catn(dhb, dhq, dhout[SG_O_NEWSZ]) 3448 dhq = sd_cat(dhb, dhq, ",\"live_mtime\":" as *u8) 3449 dhq = sd_catn(dhb, dhq, dhout[SG_O_LIVEMT]) 3450 dhq = sd_cat(dhb, dhq, ",\"staged_mtime\":" as *u8) 3451 dhq = sd_catn(dhb, dhq, dhout[SG_O_NEWMT]) 3452 dhq = sd_cat(dhb, dhq, ",\"staged_age_days\":" as *u8) 3453 dhq = sd_catn(dhb, dhq, dhout[SG_O_AGEDAYS]) 3454 dhq = sd_cat(dhb, dhq, ",\"shrink_permil\":" as *u8) 3455 dhq = sd_catn(dhb, dhq, dhout[SG_O_SHRINKPERMIL]) 3456 dhq = sd_cat(dhb, dhq, ",\"capability_loss_permil\":" as *u8) 3457 dhq = sd_catn(dhb, dhq, dhout[SG_O_LOSTPERMIL]) 3458 dhq = sd_cat(dhb, dhq, ",\"live_runs_absent\":" as *u8) 3459 dhq = sd_catn(dhb, dhq, dhout[SG_O_MISSING]) 3460 dhq = sd_cat(dhb, dhq, ",\"live_runs_checked\":" as *u8) 3461 dhq = sd_catn(dhb, dhq, dhout[SG_O_CHECKED]) 3462 dhq = sd_cat(dhb, dhq, ",\"override\":\"allow_capability_loss=yes\",\"detector\":\"nx_staging_guard\"}" as *u8) 3463 dhb[dhq] = 0 as u8 3464 return ma_emit_200(out, dhb) 3465 } 3466 } 3467 } 3468 3469 // ---- PRE-DEPLOY GATE, NOW ACTUALLY PRE-DEPLOY AND ACTUALLY A GATE (seq1798) ---------------------------- 3470 // WHAT WAS WRONG, AND IT WAS WORSE THAN 'ADVISORY': this check used to run AFTER md_exec_hostctl had 3471 // ALREADY PROMOTED the artifact, so it was a POST-DEPLOY REPORT WEARING A PRE-DEPLOY LABEL. The old 3472 // comment there claimed flipping it to a hard refusal was 'a ONE-LINE change here' -- it was not, because 3473 // by that point the irreversible act had happened and a refusal could only ever describe something that 3474 // was already live. Evaluating it HERE is what makes refusal mean anything at all. 3475 // PLACED BEFORE THE LEASE ON PURPOSE: a refusal returns early, and acquiring the lease first would STRAND 3476 // the lane until its TTL expired -- the same reasoning the lease block below already states for itself. 3477 // POLICY (operator decision, 2026-07-31): a BLOCK-severity blocker REFUSES. The escape hatch is 3478 // confirm_gate_override=yes -- deliberate, named, and echoed in the response, exactly the shape the 3479 // routeguard above uses for confirm_route_loss. An advisory BLOCK is a disabled gate arrived at SILENTLY; 3480 // an override is a disabled gate arrived at DELIBERATELY, and only the second one is honest. 3481 // UNAVAILABLE STAYS FAIL-OPEN BY DESIGN: if nx_deploy_ready cannot be read we do NOT wedge every seat on 3482 // a broken instrument. A gate that cannot be satisfied produces a bypass, not safety. 3483 var pdg: i64 = 0 - 1 3484 // LOOSE COUPLING (2026-09-02): hand the gate the deploy TARGET (this deploy_targets.conf row name) so its 3485 // evidence-honesty block is scoped to THIS target's blast radius, never to an unrelated domain's RED. 3486 let pdt: *u8 = sys_mmap(128) 3487 var pdti: i64 = 0 3488 while pdti < tn[0] { if pdti < 127 { pdt[pdti] = body[toff[0] + pdti] } pdti = pdti + 1 } 3489 if pdti > 127 { pdti = 127 } 3490 pdt[pdti] = 0 as u8 3491 let pdrc: i64 = md_exec_deploy_ready(pdt) 3492 if pdrc >= 0 { 3493 let pdsz: *i64 = sys_mmap(16) as *i64 3494 let pdbuf: *u8 = md_read_file("/tmp/nx_ma_deploy_ready.out" as *u8, pdsz) 3495 if (pdbuf as i64) != 0 { pdg = hh_after(pdbuf, pdsz[0], "\"blockers\":" as *u8) } 3496 } 3497 var pdg_ovr: i64 = 0 3498 let pgo: *i64 = sys_mmap(8) as *i64 3499 let pgl: *i64 = sys_mmap(8) as *i64 3500 if sd_form_field(body, body_n, "confirm_gate_override" as *u8, 21, pgo, pgl) == 1 { 3501 if md_slice_eq(body, pgo[0], pgl[0], "yes" as *u8, 0, 3) == 1 { pdg_ovr = 1 } 3502 } 3503 if pdg > 0 { if pdg_ovr == 0 { 3504 let pgb: *u8 = sys_mmap(MA_MAGIC_4096) 3505 var pgq: i64 = sd_cat(pgb, 0, "{\"action\":\"REFUSED\",\"verdict\":\"PRE-DEPLOY GATE BLOCKED -- an INDEPENDENT METHOD IS REPORTING FAILURE, so nothing ships. NOTHING promoted, live untouched. Run nx_deploy_ready check to see the blocker and its remediation (today: evidence-honesty -- nx_sota_status names the domain, then nx_swcompare_evidence <domain> re-measures it). If you must ship before that is green, pass confirm_gate_override=yes: it proceeds AND is reported as an AUDITED override, never a silent bypass.\",\"pre_deploy_gate\":\"DEPLOY-BLOCKED\",\"gate_blockers\":" as *u8) 3506 pgq = sd_catn(pgb, pgq, pdg) 3507 pgq = sd_cat(pgb, pgq, ",\"gate_exit\":" as *u8) 3508 pgq = sd_catn(pgb, pgq, pdrc) 3509 pgq = sd_cat(pgb, pgq, ",\"override\":\"confirm_gate_override=yes\",\"detector\":\"nx_deploy_ready\"}" as *u8) 3510 pgb[pgq] = 0 as u8 3511 return ma_emit_400(out, pgb) 3512 } } 3513 3514 // ---- R1b (seq1531 residual): LEASE-GATE THE DEPLOY ----------------------------------------------------- 3515 // A deploy race is STRICTLY WORSE than a build race: two sessions promoting the same target can interleave 3516 // a half-swapped artifact on the LIVE plane. Same nx_lease, same exit-code contract (0=acquired, 3=BUSY), 3517 // same TTL anti-deadlock property as R1. 3518 // ACQUIRED HERE, NOT EARLIER, ON PURPOSE: every failure path above (unknown target, nothing staged, failed 3519 // validation) returns early, so acquiring before them would STRAND the lane until the TTL expired. Taking 3520 // it immediately before the promote and releasing immediately after makes the guarded region atomic and 3521 // leaves no exit that can strand it. 3522 let dnmb: *u8 = sys_mmap(192) 3523 let dlease: *u8 = sys_mmap(224) 3524 dlease[0] = 0 as u8 3525 if ma_sanitize_name(body, toff[0], tn[0], dnmb, 120) == 1 { 3526 var dlo: i64 = sd_cat(dlease, 0, "deploy-" as *u8) 3527 dlo = sd_cat(dlease, dlo, dnmb) 3528 dlease[dlo] = 0 as u8 3529 if md_lease_run("acquire" as *u8, dlease, "mgmt-api-deploy" as *u8, ma_lease_ttl_txt(MA_DEPLOY_LEASE_TTL_S), 4, "/tmp/nx_ma_lease.out" as *u8) == 3 { 3530 let dlb: *u8 = sys_mmap(MA_MAGIC_2048) 3531 let dln: i64 = dp_read("/tmp/nx_ma_lease.out" as *u8, dlb, 900) 3532 let dcb: *u8 = sys_mmap(MA_MAGIC_4096) 3533 var dco: i64 = sd_cat(dcb, 0, "{\"conflict\":\"lease-busy\",\"error\":\"another session is ALREADY DEPLOYING this target -- refusing to race the LIVE plane (seq1531 R1b). Concurrent promotes can interleave a half-swapped artifact. The holder is named below; the lease is TTL-bounded so a dead session can never hold the lane closed.\",\"holder\":\"" as *u8) 3534 dco = ma_gate_esc(dcb, dco, dlb, dln) 3535 dco = ts_retry_after_derived(dcb, dco, MA_DEPLOY_LEASE_TTL_S) 3536 dcb[dco] = 0 as u8 3537 return ma_emit_400(out, dcb) 3538 } 3539 } 3540 let promote_rc: i64 = md_exec_hostctl(subbuf) 3541 if dlease[0] != (0 as u8) { md_lease_run("release" as *u8, dlease, "mgmt-api-deploy" as *u8, "0" as *u8, 3, "/tmp/nx_ma_lease.out" as *u8) } 3542 if promote_rc != 0 { 3543 ma_write_status("PROMOTE-FAILED" as *u8) 3544 return ma_emit_200(out, "{\"action\":\"PROMOTE-FAILED\",\"verdict\":\"hostctl promote returned nonzero; nothing further\"}" as *u8) 3545 } 3546 // DETACHED health+rollback watchdog: waits out a slow guard-respawn (~up to 30s) WITHOUT racing the edge- 3547 // proxy read window (the sync path made restart-targets time out / conservatively roll back). Writes the 3548 // final verdict to a status file -> poll GET /api/deploy_status. NEVER-BRICK preserved: a failed health 3549 // check still auto-rolls-back to .prev inside the watchdog. 3550 ma_write_status("RUNNING" as *u8) 3551 let dpid: i64 = sys_fork() 3552 if dpid == 0 { 3553 let dpid2: i64 = sys_fork() 3554 if dpid2 == 0 { 3555 var fdc: i64 = 3; while fdc < 256 { sys_close(fdc); fdc = fdc + 1 } // release the inherited client socket + ALL fds -> the response returns cleanly (no status=0) AND the health fetch runs on clean fds 3556 // NAMED-OUTCOME LISTENER VERIFICATION (debt 1786068492). The three states are distinct ON PURPOSE: 3557 // NEVER_UP is the ONLY one that rolls back, so this change cannot make a deploy that passes today 3558 // begin failing. UNVERIFIED is a GREEN THAT ADMITS IT COULD NOT WITNESS THE HANDOFF -- which is the 3559 // state the old level-triggered probe silently reported as a full green while it was, in the measured 3560 // incident, looking at the OUTGOING process. The first status token is unchanged for every existing 3561 // reader of /api/deploy_status; the reason rides as an additive suffix (rule 19). 3562 let hpc: i64 = md_deploy_health(urlbuf) 3563 let stb: *u8 = sys_mmap(256) 3564 var sto: i64 = 0 3565 if hpc == MD_HP_NEVER_UP { md_exec_hostctl(rbbuf); sto = sd_cat(stb, 0, "ROLLED-BACK" as *u8) } else { sto = sd_cat(stb, 0, "DEPLOYED-GREEN" as *u8) } 3566 sto = sd_cat(stb, sto, md_hp_suffix(hpc)) 3567 stb[sto] = 0 as u8 3568 ma_write_status(stb) 3569 sys_exit(0) 3570 } 3571 sys_exit(0) 3572 } 3573 let dst: *i64 = sys_mmap(16) as *i64; sys_wait4(dpid, dst, 0) 3574 // PRE-DEPLOY GATE, now ATTACHED to every deploy verdict (2026-07-30). ADVISORY ON PURPOSE, and that is 3575 // a deliberate engineering call, not a half-measure: the live blocker (evidence-honesty) is unrelated to 3576 // any particular target, and nx_deploy_ready's own manifest says a gate that halts every deploy gets 3577 // disabled, and a disabled gate protects nothing. So step one is to make it IMPOSSIBLE TO DEPLOY BLIND -- 3578 // the verdict now rides on the response every caller already reads. Flipping it to a hard refusal is the 3579 // right end state and is a ONE-LINE change here, gated on blockers reaching 0 first. 3580 var drx: i64 = 0 - 1 3581 // seq1798: REUSE the PRE-PROMOTE evaluation. Re-forking the checker here would (a) waste a fork and 3582 // (b) risk REPORTING A DIFFERENT VERDICT than the one the gate decision was actually made on -- the 3583 // report must describe the decision that was taken, not a fresh roll of the same dice. 3584 let drc: i64 = pdrc 3585 if drc >= 0 { 3586 let dsz: *i64 = sys_mmap(16) as *i64 3587 let dbuf: *u8 = md_read_file("/tmp/nx_ma_deploy_ready.out" as *u8, dsz) 3588 if (dbuf as i64) != 0 { drx = hh_after(dbuf, dsz[0], "\"blockers\":" as *u8) } 3589 } 3590 // seq1798: 512 was sized for the old short verdicts; the OVERRIDDEN string alone is ~230B and would 3591 // have overrun it. A response buffer that silently overruns is how a truthful verdict becomes garbage. 3592 let gb: *u8 = sys_mmap(MA_MAGIC_2048) 3593 var gq: i64 = sd_cat(gb, 0, "{\"action\":\"PROMOTED\",\"verdict\":\"promoted; health+auto-rollback watchdog running\",\"status\":\"GET /api/deploy_status\",\"pre_deploy_gate\":\"" as *u8) 3594 if drx < 0 { gq = sd_cat(gb, gq, "UNAVAILABLE-fail-open (nx_deploy_ready unreadable; deploy proceeded rather than wedge every seat)" as *u8) } else { if drx > 0 { gq = sd_cat(gb, gq, "DEPLOY-BLOCKED-OVERRIDDEN (blockers were present and confirm_gate_override=yes was passed -- this deploy was DELIBERATELY and AUDITABLY allowed, not silently permitted; without that flag it would have been REFUSED before the promote)" as *u8) } else { gq = sd_cat(gb, gq, "DEPLOY-SAFE" as *u8) } } 3595 gq = sd_cat(gb, gq, "\",\"gate_blockers\":" as *u8) 3596 gq = sd_catn(gb, gq, drx) 3597 // gate_exit is the gate's OWN exit status. It was hardcoded 0 for every verdict until 2026-07-30, so 3598 // seeing a 3 here is the live proof that a gate which could not signal refusal now can. 3599 gq = sd_cat(gb, gq, ",\"gate_override\":" as *u8) 3600 if pdg_ovr == 1 { gq = sd_cat(gb, gq, "\"AUDITED\"" as *u8) } else { gq = sd_cat(gb, gq, "\"none\"" as *u8) } 3601 gq = sd_cat(gb, gq, ",\"gate_exit\":" as *u8) 3602 gq = sd_catn(gb, gq, drc) 3603 // NAME THE ARTIFACT THIS DEPLOY CONSUMED. A DEPLOY THAT CANNOT SAY WHAT IT DEPLOYED IS THE SILENT CLASS. 3604 // Escaped: a conf-read path is untrusted input to a JSON serializer. 3605 gq = sd_cat(gb, gq, ",\"staged_artifact\":\"" as *u8) 3606 gq = ma_gate_esc(gb, gq, srcbuf, md_len(srcbuf)) 3607 gq = sd_cat(gb, gq, "\",\"listen_check\":\"edge-verified; see deploy_status. PROVES THE PORT ANSWERS, NEVER THAT THE RIGHT BINARY ANSWERS.\"" as *u8) 3608 gq = sd_cat(gb, gq, "}" as *u8) 3609 gb[gq] = 0 as u8 3610 return ma_emit_200(out, gb) 3611} 3612 3613// ---- /api/hostctl (P2 off-LAN parity): run ONE allowlisted hostctl action + return its captured output ---- 3614// so the operator can drive the FULL control surface (torstat/routerctl/status/kick*/trackerrefresh) from a 3615// phone. Auth = MA_LVL_ACT (checked by ma_handle). Allowlist fail-closed (md_hostctl_action_ok); single argv 3616// element to execve (no shell). Output returned as text/plain (raw hostctl dump, capped to the response buffer). 3617func ma_do_hostctl(req: *u8, req_n: i64, out: *u8) -> i64 { 3618 let body_off: i64 = sd_body_off(req, req_n) 3619 let body: *u8 = ((req as i64) + body_off) as *u8 3620 let body_n: i64 = req_n - body_off 3621 let toff: *i64 = sys_mmap(8) as *i64 3622 let tn: *i64 = sys_mmap(8) as *i64 3623 if sd_form_field(body, body_n, "sub" as *u8, 3, toff, tn) != 1 { 3624 return ma_emit_400(out, "{\"error\":\"missing sub\"}" as *u8) 3625 } 3626 let subbuf: *u8 = sys_mmap(64); md_copy_slice_z(subbuf, body, toff[0], tn[0], 64) 3627 if md_hostctl_action_ok(subbuf) != 1 { 3628 return ma_emit_400(out, "{\"error\":\"sub not in hostctl action allowlist (status|torstat|routerctl|receipts|kick*|trackerrefresh)\"}" as *u8) 3629 } 3630 md_exec_hostctl_capture(subbuf, "/tmp/nx_ma_hostctl.out" as *u8) 3631 let szp: *i64 = sys_mmap(16) as *i64 3632 let outbuf: *u8 = md_read_file("/tmp/nx_ma_hostctl.out" as *u8, szp) 3633 if (outbuf as i64) == 0 { return ma_emit_200(out, "{\"action\":\"HOSTCTL\",\"out\":\"(no output)\"}" as *u8) } 3634 var on: i64 = szp[0] 3635 if on > MA_MAGIC_60000 { on = MA_MAGIC_60000 } // cap to fit the response buffer (raw dumps stay well under) 3636 return ma_emit_json(out, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nConnection: close\r\nContent-Length: " as *u8, outbuf, on) 3637} 3638 3639// ---- /api/promote_content: promote a STAGED static file <t>.new -> live <t> (atomic, .prev-backed) ---------- 3640// STATIC CONTENT ONLY (md_content_target_ok namespace). Never touches a service binary; a bad promote reverts 3641// itself (if live->prev succeeded but new->live failed, prev is restored) so the live file is never lost. 3642// target rides in the form body (like /api/deploy); requires confirm=yes (a promote changes the public site). 3643func ma_do_promote_content(req: *u8, req_n: i64, out: *u8) -> i64 { 3644 let body_off: i64 = sd_body_off(req, req_n) 3645 let body: *u8 = ((req as i64) + body_off) as *u8 3646 let body_n: i64 = req_n - body_off 3647 let toff: *i64 = sys_mmap(8) as *i64 3648 let tn: *i64 = sys_mmap(8) as *i64 3649 if sd_form_field(body, body_n, "target" as *u8, 6, toff, tn) != 1 { 3650 return ma_emit_400(out, "{\"error\":\"missing target\"}" as *u8) 3651 } 3652 if md_content_target_ok(body, toff[0], tn[0]) != 1 { 3653 return ma_emit_400(out, "{\"error\":\"target not in the content namespace\"}" as *u8) 3654 } 3655 if ma_confirmed(req, req_n) == 0 { 3656 return ma_emit_400(out, "{\"error\":\"promote_content requires confirm=yes\"}" as *u8) 3657 } 3658 let livep: *u8 = sys_mmap(256) 3659 let newp: *u8 = sys_mmap(256) 3660 let prevp: *u8 = sys_mmap(256) 3661 // bare live path = just the target slice, NUL-terminated (no empty-literal suffix; that aliases the pool) 3662 var lo: i64 = 0 3663 while lo < tn[0] { livep[lo] = body[toff[0] + lo]; lo = lo + 1 } 3664 livep[lo] = 0 as u8 3665 mau_build_path(body, toff[0], tn[0], ".new" as *u8, newp) 3666 mau_build_path(body, toff[0], tn[0], ".prev" as *u8, prevp) 3667 // staged file must exist 3668 let nfd: i64 = sys_openat_rd(newp) 3669 if nfd < 0 { return ma_emit_400(out, "{\"error\":\"no staged .new for target (upload first)\"}" as *u8) } 3670 sys_close(nfd) 3671 // back up the live file if present (rename live -> .prev) 3672 var had_live: i64 = 0 3673 let lfd: i64 = sys_openat_rd(livep) 3674 if lfd >= 0 { sys_close(lfd); had_live = 1 } 3675 // DURABLE ROLLBACK CHAIN (2026-08-21). The comment above USED to end "atomically replacing any older 3676 // .prev" -- which is precisely the loss, written as though it were a feature. MEASURED THIS SESSION: 3677 // two promotes of ONE target left live and .prev BOTH holding new builds and the pre-change binary 3678 // GONE, and an older-generation binary CANNOT be rebuilt. This slot holds "the PREVIOUS PROMOTE", 3679 // never "the last known good", so the SECOND promote is the one that leaves you with no way back. 3680 // The only defence was the operator remembering to copy the artifact aside first, and 3681 // *A SAFETY PROPERTY THAT DEPENDS ON SOMEONE REMEMBERING IS AN ADOPTION GAP WITH EXTRA STEPS. 3682 // Rotate one generation deeper and REPORT it, so a third promote's loss is visible, not silent. 3683 // Bounded on purpose: exactly one extra file per target, no directory, no new import. 3684 // *THE TWIN IS NAMED, NOT HIDDEN: hc_promote_to (nx_hostctl) is a SECOND, INDEPENDENT promote 3685 // implementation and carries this same rotation -- one fix had to land TWICE, which is the cost of 3686 // the duplication and the reason it is recorded here instead of quietly patched in one place. 3687 // COMPOSED, NOT COPIED: md_rotate_prev (nx_mgmt_data) is the ONE rotation this daemon uses -- all 3688 // four of its live->.prev sites call it, so the chain cannot be right in one promote verb and wrong 3689 // in another. An inline twin stood here for exactly one edit and was collapsed into the shared 3690 // function before it could become the sixth copy. 3691 if had_live == 1 { md_rotate_prev(prevp) } 3692 if had_live == 1 { 3693 if sys_renameat(livep, prevp) != 0 { return ma_emit_400(out, "{\"error\":\"backup rename failed; live untouched\"}" as *u8) } 3694 } 3695 // promote 3696 if sys_renameat(newp, livep) != 0 { 3697 if had_live == 1 { sys_renameat(prevp, livep) } // restore -- the live file is never lost 3698 return ma_emit_400(out, "{\"error\":\"promote rename failed; previous file restored\"}" as *u8) 3699 } 3700 let rb: *u8 = sys_mmap(320) 3701 var b: i64 = sd_cat(rb, 0, "{\"action\":\"PROMOTE_CONTENT\",\"target\":\"" as *u8) 3702 b = md_cat_slice(rb, b, body, toff[0], tn[0]) 3703 b = sd_cat(rb, b, "\",\"live\":1,\"prev\":" as *u8) 3704 b = sd_catn(rb, b, had_live) 3705 b = sd_cat(rb, b, "}" as *u8) 3706 return ma_emit_200(out, rb) 3707} 3708 3709// NEVER-BRICK guard: is `path` a real ELF (magic 0x7f 'E' 'L' 'F')? A missing, empty, or truncated build 3710// output must NEVER be promoted onto a live organ path -- that would replace a working organ with garbage. 3711func mau_is_elf(path: *u8) -> i64 { 3712 let fd: i64 = sys_openat_rd(path) 3713 if fd < 0 { return 0 } 3714 let hb: *u8 = sys_mmap(8) 3715 let n: i64 = sys_read(fd, hb, 4) 3716 sys_close(fd) 3717 if n < 4 { return 0 } 3718 if hb[0] != (0x7f as u8) { return 0 } 3719 if hb[1] != (69 as u8) { return 0 } // 'E' 3720 if hb[2] != (76 as u8) { return 0 } // 'L' 3721 if hb[3] != (70 as u8) { return 0 } // 'F' 3722 return 1 3723} 3724 3725// Fold an ASCII hex digit to lowercase so a caller may send either case. 3726func ma_hexlc(c: i64) -> i64 { 3727 if c >= 65 { if c <= 70 { return c + 32 } } 3728 return c 3729} 3730// Compare a NUL-terminated 64-char hex digest against a form-field slice, case-insensitively. 3731// Length is checked FIRST: a short or long field is a MISMATCH, never a prefix match. 3732func ma_hex_eq(hex: *u8, buf: *u8, off: i64, n: i64) -> i64 { 3733 if n != 64 { return 0 } 3734 var i: i64 = 0 3735 while i < 64 { 3736 let a: i64 = ma_hexlc(hex[i] as i64) 3737 let b: i64 = ma_hexlc(buf[off+i] as i64) 3738 if a != b { return 0 } 3739 i = i + 1 3740 } 3741 return 1 3742} 3743 3744// POST /api/promote {target=<organ>&confirm=yes}: promote a built ONE-SHOT organ ELF (<target>.sov.elf.new from 3745// /api/build) to its live <target>.elf -- the API-pure replacement for the SSH `cp X.sov.elf.new X.elf` step, so 3746// the whole edit -> /api/build -> /api/promote loop needs zero shell. NEVER-BRICK, fail-closed at every step: 3747// (1) name sanitized to [a-zA-Z0-9_] (no dot/slash/dot-dot -> no path escape), 3748// (2) md_promote_organ_ok allowlist (daemons REFUSED -> they use the health-checked /api/deploy), 3749// (3) confirm=yes required, 3750// (4) the staged file must exist AND be a valid ELF (mau_is_elf) -- garbage is never promoted, 3751// (5) md_promote_staged keeps the old live as <target>.elf.prev (one-command rollback). 3752// Auth = MA_LVL_ACT, enforced by the dispatcher (ma_handle) before this is reached. 3753// ---- D001 STRUCTURAL GUARD: a gate that rolls its own verdict is NOT PROMOTABLE ---------------- 3754// WHY HERE AND NOT IN 2800 LEAVES: D001 (gates hand-rolling verdict emission instead of inheriting 3755// nx_gate_verdict) sat at 2 permil for nine days and was then moved to 172 permil by migrating leaves 3756// one at a time. That is O(LEAVES) FOREVER -- it remediates what exists and does nothing about the next 3757// gate someone hand-writes tomorrow. The corpus is a LINEAGE, and a constraint belongs at the ONE place 3758// every gate must pass through to become real. Promote is that place: a gate may be built and run and 3759// iterated on freely, but it cannot become a promoted organ of this ecosystem while it emits a verdict 3760// nothing else can read. A rule nothing must remember beats a list. 3761// NAME-BASED, matching /api/gate_run's own bound (_gate/_test/_kat) -- a rule nothing must remember 3762// beats a registry that must be maintained. 3763// ESCAPE HATCH, deliberate: allow_own_verdict=yes. A guard that CANNOT BE SATISFIED produces a bypass, 3764// not safety. Legitimate exceptions (a gate proving the base class itself, a fixture) say so explicitly 3765// and land in the audit trail instead of quietly routing around the check. 3766// FAIL-OPEN ON MISSING SOURCE, deliberate and narrow: if the .nx cannot be found we do NOT refuse -- 3767// mgmt promotes organs whose source may legitimately not be in this tree, and turning "I could not 3768// check" into "denied" would break unrelated promotes. Absent source is UNKNOWN, not GUILTY. 3769const MA_D001_BUF: i64 = 262144 3770 3771func ma_name_is_oracle(nm: *u8, n: i64) -> i64 { 3772 if n >= 5 { 3773 if nm[n-5] == (95 as u8) { if nm[n-4] == (103 as u8) { if nm[n-3] == (97 as u8) { if nm[n-2] == (116 as u8) { if nm[n-1] == (101 as u8) { return 1 } } } } } 3774 } 3775 if n >= 5 { 3776 if nm[n-5] == (95 as u8) { if nm[n-4] == (116 as u8) { if nm[n-3] == (101 as u8) { if nm[n-2] == (115 as u8) { if nm[n-1] == (116 as u8) { return 1 } } } } } 3777 } 3778 if n >= 4 { 3779 if nm[n-4] == (95 as u8) { if nm[n-3] == (107 as u8) { if nm[n-2] == (97 as u8) { if nm[n-1] == (116 as u8) { return 1 } } } } 3780 } 3781 return 0 3782} 3783 3784// ⚠ A TRUNCATED DUPLICATE OF THIS FUNCTION WAS REMOVED HERE (2026-07-31). A botched edit had left a 3785// half-written `ma_d001_scan` header followed by an ORPHANED TAIL of the previous function, then this 3786// complete definition -- so the file carried TWO definitions of one name and DID NOT COMPILE AT ALL. 3787// That is why this lane's edits sat SOURCE-ONLY-NOT-BUILT: not caution, a syntax error nobody had run 3788// into because nothing rebuilt the file. The compiler's dup-def guard (shipped today) named it exactly. 3789// ★★★★★ A FILE THAT DOES NOT COMPILE BLOCKS EVERY LANE THAT TOUCHES IT, SILENTLY, UNTIL SOMEONE BUILDS IT. 3790func ma_d001_scan(path: *u8, buf: *u8) -> i64 { 3791 let fd: i64 = sys_openat_rd(path) 3792 if fd < 0 { return 0 - 1 } 3793 var total: i64 = 0 3794 var run: i64 = 1 3795 while run == 1 { 3796 if total >= MA_D001_BUF { run = 0 } else { 3797 let r: i64 = sys_read(fd, ((buf as i64) + total) as *u8, MA_D001_BUF - total) 3798 if r <= 0 { run = 0 } else { total = total + r } 3799 } 3800 } 3801 sys_close(fd) 3802 let needle: *u8 = "nx_gate_verdict" as *u8 3803 var nl: i64 = 0 3804 while needle[nl] != (0 as u8) { nl = nl + 1 } 3805 var i: i64 = 0 3806 while i + nl <= total { 3807 var m: i64 = 1 3808 var k: i64 = 0 3809 while k < nl { if buf[i+k] != needle[k] { m = 0; k = nl } else { k = k + 1 } } 3810 if m == 1 { return 1 } 3811 i = i + 1 3812 } 3813 return 0 3814} 3815 3816// 1 inherits · 0 rolls its own · -1 source not found (treated as UNKNOWN, never as a refusal) 3817func ma_inherits_verdict(nm: *u8, nmlen: i64) -> i64 { 3818 let buf: *u8 = sys_mmap(MA_D001_BUF) 3819 let p: *u8 = sys_mmap(256) 3820 var o: i64 = sd_cat(p, 0, "buildroot/runtime/_hdl_build/" as *u8) 3821 o = sd_cat(p, o, nm) 3822 o = sd_cat(p, o, ".nx" as *u8) 3823 p[o] = 0 as u8 3824 let r1: i64 = ma_d001_scan(p, buf) 3825 if r1 >= 0 { return r1 } 3826 o = sd_cat(p, 0, "buildroot/runtime/" as *u8) 3827 o = sd_cat(p, o, nm) 3828 o = sd_cat(p, o, ".nx" as *u8) 3829 p[o] = 0 as u8 3830 let r2: i64 = ma_d001_scan(p, buf) 3831 if r2 >= 0 { return r2 } 3832 // BOTH ROOTS. The first version probed only buildroot/... because that is where the TOOLS daemon 3833 // sees the tree -- and mgmt does not necessarily share that cwd. The guard therefore found no source, 3834 // returned UNKNOWN, failed open, and a non-inheriting gate promoted cleanly while the guard was live. 3835 // THIS IS THE EXACT DEFECT THAT MADE nx_gate_migrate INERT -- cwd-relative paths with an assumed cwd -- 3836 // reproduced by me in the fix for it, hours later, in the same session. gm_resolve solved it by 3837 // probing every plausible root instead of asserting one; do the same rather than assume again. 3838 o = sd_cat(p, 0, "runtime/_hdl_build/" as *u8) 3839 o = sd_cat(p, o, nm) 3840 o = sd_cat(p, o, ".nx" as *u8) 3841 p[o] = 0 as u8 3842 let r3: i64 = ma_d001_scan(p, buf) 3843 if r3 >= 0 { return r3 } 3844 o = sd_cat(p, 0, "runtime/" as *u8) 3845 o = sd_cat(p, o, nm) 3846 o = sd_cat(p, o, ".nx" as *u8) 3847 p[o] = 0 as u8 3848 return ma_d001_scan(p, buf) 3849} 3850 3851 3852// RENDER A LEASE TTL AS THE TEXT nx_lease expects. ONE renderer for every lane, so a lane cannot 3853// acquire for one duration while advertising another -- which is exactly how the pair drifted. 3854func ma_lease_ttl_txt(secs: i64) -> *u8 { 3855 let b: *u8 = sys_mmap(32) 3856 let o: i64 = sd_catn(b, 0, secs) 3857 b[o] = 0 as u8 3858 return b 3859} 3860 3861// TS9: render the wait-advice TAIL of a lease-busy refusal (closes the holder string and the JSON). 3862// ONE renderer for all five lease lanes -- a fix that lives in one lane and not its siblings is the 3863// exact recorded history of this file's retry story, so the siblings share the body by construction. 3864// See the TS_NONRETRY_TTL_S block up top for the derivation. 3865func ts_retry_after_derived(b: *u8, o: i64, ttl_s: i64) -> i64 { 3866 if ttl_s >= TS_NONRETRY_TTL_S { 3867 return sd_cat(b, o, "\",\"advice\":\"LEASE-HELD-DO-NOT-RETRY\",\"why\":\"an exclusive lease this long is not a retry situation -- polling it in step is the measured herd defect. Queue the work instead: a deployq row (status=queued, with your planid) fires via nx_orchestrate on the first pass with headroom.\"}" as *u8) 3868 } 3869 var jit: i64 = 0 3870 let span_s: i64 = ttl_s / TS_JITTER_DIV 3871 if span_s > 0 { jit = (sys_now_us() / 1000) % (span_s + 1) } 3872 var o2: i64 = sd_cat(b, o, "\",\"retry_after_s\":" as *u8) 3873 o2 = sd_catn(b, o2, ttl_s + jit) 3874 return sd_cat(b, o2, "}" as *u8) 3875} 3876 3877// RELEASE THE PROMOTE LEASE. Extracted (2026-08-20) so the release has ONE callable home. The leak this 3878// closes existed precisely because the release was WRITTEN ONCE, at the bottom of the success path, and 3879// the three later returns above it simply did not repeat it -- a lease with a 300s TTL then sat held 3880// until it expired, and every promote of that organ in the window was refused lease-busy. A correction 3881// with no callable home fixes exactly one site; this one is called from all four exits. 3882func ma_promote_lease_release(please: *u8) -> i64 { 3883 return md_lease_run("release" as *u8, please, "mgmt-api-promote" as *u8, "0" as *u8, 3, "/tmp/nx_ma_lease.out" as *u8) 3884} 3885 3886// ---- /api/promote REFUSALS, ONE PER CONJUNCT (lane J, 2026-08-23) --------------------------------- 3887// THE DEFECT: one 400 text served FOUR different refusals (declared daemon / declared lib / credential- 3888// class name / undeclared kind) AND, for an undeclared gate/test/kat name, "nothing staged" too -- 3889// measured 2026-08-23 by lane F: a 503'd promote had already consumed the stage, and the retry read as an 3890// undeclared-kind refusal. A refusal that will not name which conjunct fired sends every reader at the 3891// wrong fix. Each branch names ITS conjunct, the value it resolved, and the ONE action that clears it. 3892// The stage check no longer lives in the kind decision at all: it is the NOTHING-STAGED answer further 3893// down ma_do_promote, which also reports the live sha so a lost response can be reconciled. 3894func ma_promote_refuse(out: *u8, nm: *u8, kind: i64, sfx_kind: i64) -> i64 { 3895 let rb: *u8 = sys_mmap(MA_MAGIC_2048) 3896 var b: i64 = sd_cat(rb, 0, "{\"refusal\":\"" as *u8) 3897 if kind == OK_DAEMON { 3898 b = sd_cat(rb, b, "DECLARED-DAEMON\",\"kind\":\"daemon\",\"kind_src\":\"knowledge/status/organ_kind.conf\",\"error\":\"target refused: this name is DECLARED a daemon. /api/promote swaps a binary under nothing and probes nothing; a daemon ships through the health-checked /api/deploy (validate -> promote -> http-health -> auto-rollback). That is the correct path, not a workaround.\",\"fix\":\"POST /api/deploy target=" as *u8) 3899 b = sd_cat(rb, b, nm) 3900 b = sd_cat(rb, b, "&confirm=yes\"}" as *u8) 3901 } else { if kind == OK_LIB { 3902 b = sd_cat(rb, b, "DECLARED-LIB\",\"kind\":\"lib\",\"kind_src\":\"knowledge/status/organ_kind.conf\",\"error\":\"target refused: this name is DECLARED a lib. A lib is compiled INTO its consumers, so there is no binary of its own to promote; shipping it means rebuilding and promoting each consumer.\",\"fix\":\"/api/build + /api/promote each consumer of " as *u8) 3903 b = sd_cat(rb, b, nm) 3904 b = sd_cat(rb, b, "\"}" as *u8) 3905 } else { if md_promote_deny_hard(nm) == 1 { 3906 b = sd_cat(rb, b, "CREDENTIAL-CLASS\",\"kind\":\"undeclared\",\"error\":\"target refused NON-OVERRIDABLY: the name carries a credential-class word (mint/vault/secret/keygen/login/router/hostctl/signaling/gateway/torrent/mgmt/_gw/sites) and such organs never ship through /api/promote, declared or not.\",\"fix\":\"a credential organ ships only through its own reviewed lane; there is no promote override by design\"}" as *u8) 3907 } else { 3908 b = sd_cat(rb, b, "UNDECLARED-KIND\",\"kind\":\"undeclared\",\"kind_src\":\"knowledge/status/organ_kind.conf\",\"error\":\"target refused: no organ_kind.conf row names this organ, the name carries no gate/test/kat suffix, and it is not in the legacy allow -- so nothing says whether promoting it would swap a binary under a live process (rule 26). Nothing was inspected on disk; the stage was NOT the reason.\",\"fix\":\"add one row to knowledge/status/organ_kind.conf (values unhyphenated): `" as *u8) 3909 b = sd_cat(rb, b, nm) 3910 b = sd_cat(rb, b, " oneshot` (or oracle), then retry; the older plural knowledge/organ_kinds.conf is RETIRED and is NOT read\"}" as *u8) 3911 } } } 3912 rb[b] = 0 as u8 3913 return ma_emit_400(out, rb) 3914} 3915 3916func ma_do_promote(req: *u8, req_n: i64, out: *u8) -> i64 { 3917 let body_off: i64 = sd_body_off(req, req_n) 3918 let body: *u8 = ((req as i64) + body_off) as *u8 3919 let body_n: i64 = req_n - body_off 3920 let toff: *i64 = sys_mmap(8) as *i64 3921 let tn: *i64 = sys_mmap(8) as *i64 3922 if sd_form_field(body, body_n, "target" as *u8, 6, toff, tn) != 1 { 3923 return ma_emit_400(out, "{\"error\":\"missing target\"}" as *u8) 3924 } 3925 let nm: *u8 = sys_mmap(128) 3926 if ma_sanitize_name(body, toff[0], tn[0], nm, 120) != 1 { 3927 return ma_emit_400(out, "{\"error\":\"invalid target name (only [a-zA-Z0-9_])\"}" as *u8) 3928 } 3929 // seq1492: ROLE BEATS NAME. Both ship verbs used to guess from the NAME and DISAGREED -- promote 3930 // called nx_torrent_get a daemon while deploy had never heard of it, so a gate-proven binary was 3931 // unshippable by any sanctioned route. A DECLARED kind now decides: one-shot/oracle promote by right, 3932 // a declared daemon is refused here (it needs the health-probed /api/deploy), and an UNDECLARED name 3933 // falls through to the legacy allowlist -- so this is ADDITIVE and inert for every organ not yet in 3934 // organ_kind.conf. Asymmetry is deliberate: misfiling a daemon as a one-shot would let promote swap a 3935 // binary under a live process with no probe and no rollback (rule 26); the reverse merely blocks it. 3936 let ma_kind: i64 = ok_kind_of_path("knowledge/status/organ_kind.conf" as *u8, nm) 3937 var ma_shipok: i64 = 0 3938 if ma_kind == OK_UNKNOWN { if md_promote_organ_ok(nm) == 1 { ma_shipok = 1 } } 3939 if ma_kind != OK_UNKNOWN { if ok_may_promote(ma_kind) == 1 { ma_shipok = 1 } } 3940 // seq1789: THE SUFFIX IS A DECLARATION; THE SUBSTRING WAS A GUESS. The legacy fall-through 3941 // md_promote_organ_ok -> md_promote_deny asks `does the name CONTAIN "serve"`, so 3942 // nx_survey_serve_gate -- an oracle that runs to completion -- was refused as a daemon and could not 3943 // ship by any sanctioned route. Its gate read exit=127 and was the ONLY red holding the surveys 3944 // domain (35/35 grounded, 3/4 gates green) off MEASURED-HONEST. 3945 // SAFE BY CONSTRUCTION, not by promise: ok_kind_or_suffix can only ever yield OK_ORACLE for an 3946 // UNDECLARED name, which is the safe side of the asymmetry this policy protects -- a DECLARED daemon 3947 // still loses here because ok_may_promote(OK_DAEMON) is 0 and the declared kind takes precedence. 3948 // The two existing guards still bind: md_promote_deny_hard (credential oracles -- mint/vault/secret/ 3949 // keygen/login) refuses NON-OVERRIDABLY, and a staged ELF built HERE is still required, so this can 3950 // never promote a binary that did not come from /api/build on this host. 3951 var ma_sfx_kind: i64 = ma_kind 3952 if ma_shipok != 1 { 3953 ma_sfx_kind = ok_kind_or_suffix(ma_kind, nm) 3954 if ok_may_promote(ma_sfx_kind) == 1 { 3955 // The staged ELF is STILL required -- but it is checked BELOW, where an absent stage answers 3956 // NOTHING-STAGED by name (and reports the live sha for the lost-response case) instead of 3957 // being folded into the kind refusal. Lane J 2026-08-23: a 503'd promote had consumed the 3958 // stage and the retry of an oracle-suffixed name read as "undeclared kind" -- the wrong fix. 3959 if md_promote_deny_hard(nm) == 0 { ma_shipok = 1 } 3960 } 3961 } 3962 if ma_shipok != 1 { 3963 return ma_promote_refuse(out, nm, ma_kind, ma_sfx_kind) 3964 } 3965 if ma_confirmed(req, req_n) == 0 { 3966 return ma_emit_400(out, "{\"error\":\"promote requires confirm=yes\"}" as *u8) 3967 } 3968 let nmlen: i64 = sd_len(nm) 3969 // D001 STRUCTURAL GUARD. The helpers above were shipped without this call site once, so the guard 3970 // existed and nothing invoked it -- built-but-not-wired, the exact class this guard exists to end. 3971 if ma_name_is_oracle(nm, nmlen) == 1 { 3972 if ma_inherits_verdict(nm, nmlen) == 0 { 3973 let d1off: *i64 = sys_mmap(8) as *i64 3974 let d1n: *i64 = sys_mmap(8) as *i64 3975 if sd_form_field(body, body_n, "allow_own_verdict" as *u8, 17, d1off, d1n) != 1 { 3976 return ma_emit_400(out, "{\"error\":\"D001: this gate rolls its own verdict instead of inheriting nx_gate_verdict, so nothing can read its outcome -- nx_gate_green cannot judge it and it records no harness.jrnl frame, so flake and erosion stay invisible for it. Migrate it (nx_gate_dry_apply <gate> <out>, then nx_gate_migrate verify <gate> <out>) and promote again. Deliberate exception: resend with allow_own_verdict=yes.\"}" as *u8) 3977 } 3978 } 3979 } 3980 let stagedp: *u8 = sys_mmap(160) 3981 mau_build_path(nm, 0, nmlen, ".sov.elf.new" as *u8, stagedp) 3982 if mau_is_elf(stagedp) != 1 { 3983 // u2605RECOVERABLE AFTER A LOST RESPONSE (seq1780, the other half of the 3984 // self-verifying receipt). Transport loses RESPONSES, not requests 3985 // (seq290), so a caller who saw nothing must be able to ASK rather than 3986 // guess -- and "nothing staged" is EXACTLY what a promote that already 3987 // succeeded looks like on a retry. Answer with the LIVE bytes + sha256: 3988 // equal to the artefact you built means it landed, different means it 3989 // did not. A bare error here forced every caller to hash out-of-band, 3990 // which is the workaround this whole arc exists to delete. 3991 let livechk: *u8 = sys_mmap(160) 3992 mau_build_path(nm, 0, nmlen, ".elf" as *u8, livechk) 3993 let rszp: *i64 = sys_mmap(16) as *i64 3994 let rbytes: *u8 = md_read_file(livechk, rszp) 3995 if (rbytes as i64) != 0 { 3996 let rdig2: *u8 = sys_mmap(32) 3997 sha256_digest(rbytes, rszp[0], rdig2) 3998 let rhex2: *u8 = sys_mmap(72) 3999 mau_hex32(rdig2, rhex2) 4000 let rrb: *u8 = sys_mmap(640) 4001 var ro: i64 = sd_cat(rrb, 0, "{\"action\":\"NOTHING-STAGED\",\"target\":\"" as *u8) 4002 ro = sd_cat(rrb, ro, nm) 4003 ro = sd_cat(rrb, ro, "\",\"live_bytes\":" as *u8) 4004 ro = sd_catn(rrb, ro, rszp[0]) 4005 ro = sd_cat(rrb, ro, ",\"live_sha256\":\"" as *u8) 4006 ro = sd_cat(rrb, ro, rhex2) 4007 ro = sd_cat(rrb, ro, "\",\"note\":\"nothing staged. If you just promoted and lost the response, compare live_sha256 with the artefact you built: equal means it IS live. Otherwise run /api/build first.\"}" as *u8) 4008 rrb[ro] = 0 as u8 4009 return ma_emit_200(out, rrb) 4010 } 4011 let nsb: *u8 = sys_mmap(MA_MAGIC_1024) 4012 var nso: i64 = sd_cat(nsb, 0, "{\"refusal\":\"NOTHING-STAGED\",\"staged_path\":\"" as *u8) 4013 nso = sd_cat(nsb, nso, stagedp) 4014 nso = sd_cat(nsb, nso, "\",\"live_path\":\"" as *u8) 4015 nso = sd_cat(nsb, nso, livechk) 4016 nso = sd_cat(nsb, nso, "\",\"error\":\"nothing staged: no valid ELF at the staged path and no live artefact to report. The kind was accepted; the STAGE is the only missing conjunct.\",\"fix\":\"POST /api/build target=" as *u8) 4017 nso = sd_cat(nsb, nso, nm) 4018 nso = sd_cat(nsb, nso, " first (the stage must be an ELF built on this host), then promote with expect_sha256\"}" as *u8) 4019 nsb[nso] = 0 as u8 4020 return ma_emit_400(out, nsb) 4021 } 4022 // ---- EXPECTED-DIGEST GATE (2026-07-30): DEPLOY A DIGEST, NOT A TAG -------------------------------- 4023 // THE RACE THIS CLOSES, MEASURED: /api/build writes _build/<t>.sov.elf and a LATER promote copies that 4024 // PATH. Any sibling rebuilding the same target in between OVERWRITES it. I built nx_mgmt_api at 578865, 4025 // verified it, and a SIBLING'S 579263 WENT LIVE -- I verified one artifact and shipped another, and 4026 // nothing anywhere detected it. mgmt then walked 578789 -> 578865 -> 579263 -> 580657 inside ONE HOUR, 4027 // so this is the NORMAL condition on a shared tree, not a freak event. 4028 // A PATH IS A PROMISE ABOUT A LOCATION, NOT ABOUT CONTENT. The build lease does not cover it: that lease 4029 // is released when the COMPILE ends, so it locks the WRONG INTERVAL -- the hazard lives after it. 4030 // The response already returns a sha256 RECEIPT of what was installed, but a POST-HOC receipt can only 4031 // say what shipped; it cannot PREVENT shipping the wrong thing. This is the missing half: hash the 4032 // STAGED bytes BEFORE any mutation and refuse if they are not the ones the caller says it built. 4033 // OPTIONAL BY DESIGN -- omit expect_sha256 and behaviour is byte-for-byte what it was, so this is purely 4034 // additive. Placed AFTER the ELF/lost-response block (so it cannot preempt the NOTHING-STAGED recovery) 4035 // and BEFORE the lease acquire (so a refusal can never strand the lane -- the R1d law: lock the smallest 4036 // region that actually races). 4037 let xoff: *i64 = sys_mmap(8) as *i64 4038 let xn: *i64 = sys_mmap(8) as *i64 4039 if sd_form_field(body, body_n, "expect_sha256" as *u8, 13, xoff, xn) == 1 { 4040 let sszp: *i64 = sys_mmap(16) as *i64 4041 let sbytes: *u8 = md_read_file(stagedp, sszp) 4042 if (sbytes as i64) == 0 { 4043 return ma_emit_400(out, "{\"error\":\"expect_sha256 was supplied