code wiki / _hdl_build / nx_mgmt_promote_gate.nx
`nx_mgmt_promote_gate.nx` source

↩ module page · 455 lines · 26898 B
1// nx_mgmt_promote_gate.nx -- referee for POST /api/promote: fail-closed, never-brick, AND lease-clean.
2// In-process (no socket): crafts request BYTES and feeds the pure handler ma_do_promote, with the whole
3// filesystem rooted at /tmp/nx_promote_gt so nothing it does can touch the serving root. mau_build_path
4// builds BARE relative paths, which is what makes that isolation total rather than hopeful.
5//
6// MIGRATED ONTO nx_gate_verdict 2026-08-20 (was D001: a hand-rolled `fails` counter and a bare sys_exit,
7// so /api/gate_run could read a verdict but nx_gate_green could not, and the declared tooth count could
8// drift from the executed one). Every tooth is now a gv_check, so declared == executed by construction.
9//
10// WHAT IS NEW HERE, AND WHY. /api/promote took its 300s lease and then RETURNED THROUGH THREE EXITS THAT
11// NEVER RELEASED IT: the stage-rename failure, and both md_promote_staged_ex failure exits (one of which
12// answers 200 NOTHING-STAGED, so it reads as a harmless no-op while holding the lane shut for five
13// minutes). The release was written once, at the bottom of the success path. That defect was independently
14// rediscovered five times in three weeks because NOTHING WATCHED THE LEASE PLANE -- every existing tooth
15// read the RESPONSE TEXT, and the response of a leaking call is indistinguishable from a clean one.
16// So these teeth ask the PLANE, not the handler: they try to take the lease afterwards. Busy means leaked.
17//
18// The second defect on the same endpoint was a magic number pair: the lease is held for 300s and the
19// refusal advertised retry_after_s:30, so a caller obeying the advice hammered a lock that could not be
20// free for another 270. Both now render from MA_PROMOTE_LEASE_TTL_S, and a tooth below builds its
21// expected substring FROM THAT SAME CONST -- so the two cannot drift apart again without this going RED.
22//
23// license_tier: ORIGINAL   expect_exit: 0   No hw writes (Rule 26).
24import "nx_mgmt_api.nx"
25import "nx_syscalls.nx"
26import "nx_gate_verdict.nx"
27
28const PG_MODE_FILE: i64 = 0x1a4
29const PG_MODE_DIR: i64 = 0x1ed
30const PG_BUF: i64 = 262144
31const PG_SMALL: i64 = 256
32
33func glen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
34func gcat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o+i] = s[i]; i = i + 1 } return o + i }
35func gcatn(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o+i] = s[i]; i = i + 1 } return o + n }
36func gcontains(hay: *u8, n: i64, needle: *u8) -> i64 {
  let nn: i64 = glen(needle)
  var i: i64 = 0
  while i + nn <= n {
      var m: i64 = 1
      var j: i64 = 0
      while j < nn { if (hay[i+j] as i64) != (needle[j] as i64) { m = 0; j = nn } else { j = j + 1 } }
      if m == 1 { return 1 }
      i = i + 1
  }
  return 0
47}
48// build "POST <line> HTTP/1.1\r\n...\r\n\r\n<body>" into dst; returns total length.
49func mkreq(dst: *u8, line: *u8, body: *u8) -> i64 {
  let bn: i64 = glen(body)
  var o: i64 = gcat(dst, 0, line)
  o = gcat(dst, o, " HTTP/1.1\r\nHost: x\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: " as *u8)
  let t: *u8 = sys_mmap(24)
  var m: i64 = bn
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var z: i64 = 0
  while z < k { dst[o] = t[k-1-z]; o = o + 1; z = z + 1 }
  o = gcat(dst, o, "\r\n\r\n" as *u8)
  o = gcatn(dst, o, body, bn)
  return o
63}
64func wfile(path: *u8, buf: *u8, n: i64) -> i64 {
  let fd: i64 = sys_openat_wr(path, PG_MODE_FILE)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, buf, n)
  sys_close(fd)
  return 0
70}
71func bytes_eq(path: *u8, want: *u8, wn: i64) -> i64 {
  let szp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(path, szp)
  if (b as i64) == 0 { return 0 }
  if szp[0] != wn { return 0 }
  var i: i64 = 0
  while i < wn { if (b[i] as i64) != (want[i] as i64) { return 0 } i = i + 1 }
  return 1
79}
80func file_absent(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 1 }
  sys_close(fd)
  return 0
85}
86
87// ---- THE LEASE PROBE: ASK THE PLANE, NEVER THE RESPONSE ------------------------------------------
88// A handler that leaks its lease answers EXACTLY the same bytes as one that does not, so no assertion
89// over the response can see this class at all. The only witness is the lease plane itself, and the only
90// question it answers honestly is "can I take this now". Returns 0 FREE, 1 HELD, 2 UNOBSERVABLE --
91// three states, because a fork failure or an absent nx_lease.elf must not read as either verdict.
92// The probe TTL is 1 second, so even a crashed probe cannot hold the name it just tested.
93func lease_state(lname: *u8) -> i64 {
  let rc: i64 = md_lease_run("acquire" as *u8, lname, "nx-promote-gate-probe" as *u8, "1" as *u8, 4, "/tmp/nx_promote_gt/probe.out" as *u8)
  if rc == 3 { return 1 }
  if rc != 0 { return 2 }
  md_lease_run("release" as *u8, lname, "nx-promote-gate-probe" as *u8, "0" as *u8, 3, "/tmp/nx_promote_gt/probe.out" as *u8)
  return 0
99}
100// 1 iff the promote lease for <target> is demonstrably NOT held.
101func lease_free_for(target: *u8) -> i64 {
  let lb: *u8 = sys_mmap(PG_SMALL)
  md_lease_name_pfx("promote-" as *u8, target, lb)
  if lease_state(lb) == 0 { return 1 }
  return 0
106}
107
108// ---- CLEAR THE FIXTURE LEASES AT SETUP, NEVER ONLY AT TEARDOWN -------------------------------
109// A teardown does not run when a run crashes -- and worse here than usual, because THE VERY DEFECT
110// THIS GATE EXISTS TO CATCH LEAKS A 300 SECOND LEASE. So a RED run poisons the next five minutes of
111// runs with a lease-busy refusal that is indistinguishable from a second, unrelated failure.
112// MEASURED 2026-08-20 during this gate's own bite proof: the mutant run leaked promote-nxpromoteleak,
113// and the NEXT run reported four failures where its mutation could only cause two. A GATE THAT IS NOT
114// IDEMPOTENT REPORTS ON ITS FIRST RUN AND LIES ABOUT EVERY RUN AFTER, and a gate whose subject can
115// leak state must clear that state BEFORE it measures, not after. Owner is required by nx_lease, so
116// all three owners this file can produce are cleared; a release that does not apply is a no-op.
117func lease_clear(target: *u8) -> i64 {
  let lb: *u8 = sys_mmap(PG_SMALL)
  md_lease_name_pfx("promote-" as *u8, target, lb)
  md_lease_run("release" as *u8, lb, "mgmt-api-promote" as *u8, "0" as *u8, 3, "/tmp/nx_promote_gt/probe.out" as *u8)
  md_lease_run("release" as *u8, lb, "neg-control-holder" as *u8, "0" as *u8, 3, "/tmp/nx_promote_gt/probe.out" as *u8)
  md_lease_run("release" as *u8, lb, "nx-promote-gate-probe" as *u8, "0" as *u8, 3, "/tmp/nx_promote_gt/probe.out" as *u8)
  return 0
124}
125
126
127func tc_refusal_gate() -> i64 {
  sys_mkdir("/tmp/nx_toolchain_refusal_gate" as *u8, 0x1ed)
  if sys_chdir("/tmp/nx_toolchain_refusal_gate" as *u8) != 0 { return 2 }
  sys_mkdir("buildroot" as *u8, 0x1ed)
  sys_mkdir("buildroot/_offc" as *u8, 0x1ed)
  sys_mkdir("knowledge" as *u8, 0x1ed)
  let nm: *u8 = "nx_sov_build_run.elf" as *u8
  let live: *u8 = "buildroot/_offc/nx_sov_build_run.elf" as *u8
  let prev: *u8 = "buildroot/_offc/nx_sov_build_run.elf.prev" as *u8
  let staged: *u8 = "nx_sov_build_run.elf.new" as *u8
  let older: *u8 = sys_mmap(MD_TC_MIN_ELF)
  let newer: *u8 = sys_mmap(MD_TC_MIN_ELF)
  older[0]=127 as u8; older[1]=69 as u8; older[2]=76 as u8; older[3]=70 as u8
  newer[0]=127 as u8; newer[1]=69 as u8; newer[2]=76 as u8; newer[3]=70 as u8
  older[4]=1 as u8; newer[4]=2 as u8
  if wfile(live, newer, MD_TC_MIN_ELF) != 0 { return 2 }
  if wfile(prev, newer, MD_TC_MIN_ELF) != 0 { return 2 }
  if wfile(staged, older, MD_TC_MIN_ELF) != 0 { return 2 }
  if wfile(MD_PROV_HIST, older, 0) != 0 { return 2 }
  let oldhash: i64 = md_prov_hash(staged)
  let newhash: i64 = md_prov_hash(live)
  if oldhash == 0 { return 2 }
  if newhash == 0 { return 2 }
  if oldhash == newhash { return 2 }
  if md_prov_record(live, oldhash) != 0 { return 2 }
  if md_prov_record(live, newhash) != 0 { return 2 }
  let history: i64 = md_prov_hash(MD_PROV_HIST)
  let out: *u8 = sys_mmap(262144)
  let installed: *i64 = sys_mmap(8) as *i64
  let ctr: *i64 = gv_ctr()
  var attempt: i64 = 0
  while attempt < 2 {
      let n: i64 = ma_tc_install_checked(nm, out, installed)
      gv_check("toolchain-refusal-1" as *u8, 1 - (n <= 0), ctr)
      gv_check("toolchain-refusal-2" as *u8, 1 - (installed[0] != (0 - 2)), ctr)
      gv_check("toolchain-refusal-3" as *u8, 1 - (gcontains(out,n,"HTTP/1.1 400" as *u8) != 1), ctr)
      gv_check("toolchain-refusal-4" as *u8, 1 - (gcontains(out,n,"TOOLCHAIN_PROVENANCE_REFUSED" as *u8) != 1), ctr)
      gv_check("toolchain-refusal-5" as *u8, 1 - (gcontains(out,n,"TOOLCHAIN-PROMOTED" as *u8) != 0), ctr)
      gv_check("toolchain-refusal-6" as *u8, 1 - (bytes_eq(live,newer,MD_TC_MIN_ELF) != 1), ctr)
      gv_check("toolchain-refusal-7" as *u8, 1 - (bytes_eq(prev,newer,MD_TC_MIN_ELF) != 1), ctr)
      gv_check("toolchain-refusal-8" as *u8, 1 - (bytes_eq(staged,older,MD_TC_MIN_ELF) != 1), ctr)
      gv_check("toolchain-refusal-9" as *u8, 1 - (md_prov_hash(MD_PROV_HIST) != history), ctr)
      attempt = attempt + 1
  }
  if wfile(staged,older,4) != 0 { return 2 }
  let bad: i64 = ma_tc_install_checked(nm,out,installed)
  gv_check("toolchain-refusal-10" as *u8, 1 - (bad <= 0), ctr)
  gv_check("toolchain-refusal-11" as *u8, 1 - (installed[0] != 0), ctr)
  gv_check("toolchain-refusal-12" as *u8, 1 - (gcontains(out,bad,"no valid staged" as *u8) != 1), ctr)
  gv_check("toolchain-refusal-13" as *u8, 1 - (bytes_eq(live,newer,MD_TC_MIN_ELF) != 1), ctr)
  gv_check("toolchain-refusal-14" as *u8, 1 - (bytes_eq(prev,newer,MD_TC_MIN_ELF) != 1), ctr)
  gv_check("toolchain-refusal-15" as *u8, 1 - (bytes_eq(staged,older,4) != 1), ctr)
  gv_check("toolchain-refusal-16" as *u8, 1 - (md_prov_hash(MD_PROV_HIST) != history), ctr)
  older[4] = 3 as u8
  if wfile(staged,older,MD_TC_MIN_ELF) != 0 { return 2 }
  let accepted: i64 = ma_tc_install_checked(nm,out,installed)
  gv_check("accepted-install-continues-to-canary-boundary" as *u8,accepted == 0,ctr)
  gv_check("accepted-install-reports-real-size" as *u8,installed[0] == MD_TC_MIN_ELF,ctr)
  gv_check("accepted-install-live-is-candidate" as *u8,bytes_eq(live,older,MD_TC_MIN_ELF),ctr)
  gv_check("accepted-install-banks-previous-live" as *u8,bytes_eq(prev,newer,MD_TC_MIN_ELF),ctr)
  gv_check("accepted-install-consumes-stage" as *u8,file_absent(staged),ctr)
  gv_check("rollback-reports-restoration" as *u8,md_tc_rollback(nm),ctr)
  gv_check("rollback-restores-exact-previous-bytes" as *u8,bytes_eq(live,newer,MD_TC_MIN_ELF),ctr)
  return gv_verdict("TOOLCHAIN-REFUSAL" as *u8,ctr,"refusal preserves artifacts; accepted install and rollback restore exact bytes" as *u8)
191}
192func main(argc: i64, argv: *i64) -> i64 {
  if argc == 1 { return legacy_promote_gate() }
  if argc == 2 {
      if glen(argv[1] as *u8) == 17 {
          if gcontains(argv[1] as *u8,17,"toolchain-refusal" as *u8) == 1 { return tc_refusal_gate() }
      }
  }
  return 2
200}
201
202func legacy_promote_gate() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_mgmt_promote_gate -- POST /api/promote: fail-closed, never-brick, and LEASE-CLEAN on every exit" as *u8)
  sys_mkdir("/tmp/nx_promote_gt" as *u8, PG_MODE_DIR)
  sys_chdir("/tmp/nx_promote_gt" as *u8)
  let out: *u8 = sys_mmap(PG_BUF)
  let req: *u8 = sys_mmap(PG_BUF)
209
  // fixture bytes: a valid ELF header, a distinct "old live", and a non-ELF blob.
  let elfnew: *u8 = sys_mmap(16)
  elfnew[0] = 0x7f as u8
  elfnew[1] = 69 as u8
  elfnew[2] = 76 as u8
  elfnew[3] = 70 as u8
  elfnew[4] = 78 as u8
  elfnew[5] = 69 as u8
  elfnew[6] = 87 as u8
  let oldlive: *u8 = sys_mmap(16)
  oldlive[0] = 79 as u8
  oldlive[1] = 76 as u8
  oldlive[2] = 68 as u8
  let garbage: *u8 = sys_mmap(16)
  garbage[0] = 71 as u8
  garbage[1] = 65 as u8
  garbage[2] = 82 as u8
227
  // ---- FIXTURE: A DECLARED-KIND CONF THE HANDLER CAN ACTUALLY READ ----------------------------
  // ok_kind_of_path opens knowledge/status/organ_kind.conf RELATIVE TO CWD. Under /tmp that file did
  // not exist, so every "daemon target" tooth here was silently testing the UNDECLARED fall-through
  // instead of the daemon refusal it was named for -- a tooth measuring a different subject than its
  // name claims. Assembling the conf at runtime restores the tooth's meaning and keeps it hermetic.
  sys_mkdir("knowledge" as *u8, PG_MODE_DIR)
  sys_mkdir("knowledge/status" as *u8, PG_MODE_DIR)
  let kconf: *u8 = sys_mmap(PG_SMALL)
  var kn: i64 = gcat(kconf, 0, "sites daemon\n" as *u8)
  kn = gcat(kconf, kn, "nx_tools_api_serve daemon\n" as *u8)
  wfile("knowledge/status/organ_kind.conf" as *u8, kconf, kn)
239
  // clean slate (idempotent: a previous run's artefacts must not decide this one's verdict)
  fio_unlink("sites.sov.elf.new" as *u8)
  fio_unlink("sites.elf" as *u8)
  fio_unlink("nxpromotepos.sov.elf.new" as *u8)
  fio_unlink("nxpromotepos.elf" as *u8)
  fio_unlink("nxpromotepos.elf.prev" as *u8)
  fio_unlink("nxpromotepos.elf.new" as *u8)
  fio_unlink("nxpromoteleak.sov.elf.new" as *u8)
  fio_unlink("nxpromoteleak.elf" as *u8)
  fio_unlink("nx_ecomat_seed.elf" as *u8)
  fio_unlink("nx_ecomat_seed.sov.elf.new" as *u8)
  fio_unlink("nx_ecomat_beat.sov.elf.new" as *u8)
  fio_unlink("nx_ecomat_beat.elf" as *u8)
  fio_unlink("nx_ecomat_beat.elf.prev" as *u8)
  fio_unlink("nxpromotebusy.sov.elf.new" as *u8)
  fio_unlink("nxpromotebusy.elf" as *u8)
  fio_unlink("nxpromotedig.sov.elf.new" as *u8)
  fio_unlink("nxpromotedig.elf" as *u8)
  fio_unlink("nxpromotenoconf.sov.elf.new" as *u8)
  fio_unlink("nxpromotenoconf.elf" as *u8)
260
  lease_clear("nxpromotepos" as *u8)
  lease_clear("nxpromoteleak" as *u8)
  lease_clear("nxpromotebusy" as *u8)
  lease_clear("nxpromotedig" as *u8)
  lease_clear("nxpromotenoconf" as *u8)
  lease_clear("nx_ecomat_seed" as *u8)
  lease_clear("nx_ecomat_beat" as *u8)
  lease_clear("sites" as *u8)
269
  // ---- PRECONDITION: the lease plane must answer, or every lease tooth below is unobservable ----
  // A round trip on a name nothing else uses. If this cannot be done the gate SKIPs rather than
  // reporting the subject broken -- "I could not look" is not "I looked and it is broken".
  var planeok: i64 = 0
  if lease_state("promote-nxpromoteplaneprobe" as *u8) == 0 { planeok = 1 }
  gv_need("lease plane answers an acquire/release round trip" as *u8, planeok, ctr)
276
  // ---- T1 ANTI-VACUITY, FIRST: A GENUINE PROMOTE STILL WORKS -----------------------------------
  // This tooth is what a lazy "fix" cannot pass. Never acquiring the lease at all, or refusing every
  // request, would satisfy every lease-is-free assertion below and silently break promotion. The
  // positive control has to come first for exactly that reason.
  wfile("nxpromotepos.sov.elf.new" as *u8, elfnew, 7)
  wfile("nxpromotepos.elf" as *u8, oldlive, 3)
  let n1: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nxpromotepos&confirm=yes&allow_unverified_bytes=yes&allow_capability_loss=yes" as *u8)
  let r1: i64 = ma_do_promote(req, n1, out)
  var t1: i64 = 1
  if gcontains(out, r1, "200 OK" as *u8) == 0 { t1 = 0 }
  if gcontains(out, r1, "PROMOTED" as *u8) == 0 { t1 = 0 }
  if bytes_eq("nxpromotepos.elf" as *u8, elfnew, 7) == 0 { t1 = 0 }
  if bytes_eq("nxpromotepos.elf.prev" as *u8, oldlive, 3) == 0 { t1 = 0 }
  if file_absent("nxpromotepos.sov.elf.new" as *u8) == 0 { t1 = 0 }
  gv_check("anti-vacuity-a-genuine-promote-still-installs-and-banks-prev" as *u8, t1, ctr)
292
  // ---- T2 the success path releases what it took ------------------------------------------------
  gv_check("lease-released-after-a-successful-promote" as *u8, lease_free_for("nxpromotepos" as *u8), ctr)
295
  // ---- T3 THE PRE-LEASE NO-OP MUST NOT TOUCH THE PLANE ------------------------------------------
  // Corrects the record: the FIRST NOTHING-STAGED sits BEFORE the acquire, so a bare probe never
  // leaked. Pinning that here stops the next reader re-deriving it from the same wrong hypothesis.
  // THE TARGET NAME IS PART OF THE FIXTURE. An UNDECLARED name with nothing staged is refused by the
  // promotable check LONG before the branch this tooth is named for, so the first draft of it passed
  // judgement on name policy instead. A legacy-allowlisted name reaches the staged-artefact check.
  wfile("nx_ecomat_seed.elf" as *u8, oldlive, 3)
  let n3: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nx_ecomat_seed&confirm=yes" as *u8)
  let r3: i64 = ma_do_promote(req, n3, out)
  var t3: i64 = 1
  if gcontains(out, r3, "NOTHING-STAGED" as *u8) == 0 { t3 = 0 }
  if lease_free_for("nx_ecomat_seed" as *u8) == 0 { t3 = 0 }
  gv_check("neg-control-the-pre-lease-nothing-staged-no-op-never-takes-the-lease" as *u8, t3, ctr)
309
  // ---- T4 THE DECISIVE ONE: A POST-ACQUIRE FAILURE EXIT MUST RELEASE ----------------------------
  // The lever is deterministic and needs no timing: make <t>.elf.new a DIRECTORY, so the very first
  // mutating step after the acquire -- renaming the staged file onto it -- fails with EISDIR. That is
  // one of the three exits that used to return while still holding the lease.
  wfile("nxpromoteleak.sov.elf.new" as *u8, elfnew, 7)
  wfile("nxpromoteleak.elf" as *u8, oldlive, 3)
  sys_mkdir("nxpromoteleak.elf.new" as *u8, PG_MODE_DIR)
  let n4: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nxpromoteleak&confirm=yes&allow_unverified_bytes=yes&allow_capability_loss=yes" as *u8)
  let r4: i64 = ma_do_promote(req, n4, out)
  gv_check("lease-released-after-a-post-acquire-failure-exit" as *u8, lease_free_for("nxpromoteleak" as *u8), ctr)
320
  // ---- T5 ...AND THAT EXIT STILL REFUSES, so T4 cannot be passed by promoting anyway -------------
  var t5: i64 = 1
  if gcontains(out, r4, "stage-rename failed" as *u8) == 0 { t5 = 0 }
  if bytes_eq("nxpromoteleak.elf" as *u8, oldlive, 3) == 0 { t5 = 0 }
  gv_check("neg-control-that-same-failure-exit-still-refuses-and-leaves-live-untouched" as *u8, t5, ctr)
326
  // ---- T6 THE ADVERTISED BACKOFF IS THE CONFIGURED TTL ------------------------------------------
  // The expected substring is BUILT FROM MA_PROMOTE_LEASE_TTL_S, not typed here. That is the whole
  // point: a reader who changes the lock duration moves this tooth with it, and a reader who hardcodes
  // a different number into the message moves the message away from this tooth. One source or RED.
  wfile("nxpromotebusy.sov.elf.new" as *u8, elfnew, 7)
  wfile("nxpromotebusy.elf" as *u8, oldlive, 3)
  let hb: *u8 = sys_mmap(PG_SMALL)
  md_lease_name_pfx("promote-" as *u8, "nxpromotebusy" as *u8, hb)
  let heldrc: i64 = md_lease_run("acquire" as *u8, hb, "neg-control-holder" as *u8, "60" as *u8, 4, "/tmp/nx_promote_gt/probe.out" as *u8)
  var heldok: i64 = 0
  if heldrc == 0 { heldok = 1 }
  gv_need("a foreign holder can be planted on the promote lease" as *u8, heldok, ctr)
  let n6: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nxpromotebusy&confirm=yes&allow_unverified_bytes=yes&allow_capability_loss=yes" as *u8)
  let r6: i64 = ma_do_promote(req, n6, out)
  // TS9 (2026-08-30): a 300 s exclusive lock is NOT a retry situation -- the refusal advertises the
  // DISTINCT CLASS instead of a wait scalar (ts_retry_after_derived; RFC 9110 puts no accuracy
  // obligation on Retry-After, so any scalar synchronises the herd -- measured on this very lease).
  var t6: i64 = 1
  if gcontains(out, r6, "lease-busy" as *u8) == 0 { t6 = 0 }
  if gcontains(out, r6, "neg-control-holder" as *u8) == 0 { t6 = 0 }
  if gcontains(out, r6, "LEASE-HELD-DO-NOT-RETRY" as *u8) == 0 { t6 = 0 }
  gv_check("lease-busy-refusal-advertises-the-do-not-retry-class-not-a-wait-scalar" as *u8, t6, ctr)
349
  // ---- T7 and the stale 10x-short advice is gone ------------------------------------------------
  var t7: i64 = 1
  if gcontains(out, r6, "\"retry_after_s\":" as *u8) == 1 { t7 = 0 }
  if bytes_eq("nxpromotebusy.sov.elf.new" as *u8, elfnew, 7) == 0 { t7 = 0 }
  gv_check("neg-control-no-wait-scalar-of-ANY-value-rides-the-lease-refusal-and-a-busy-refusal-stages-nothing" as *u8, t7, ctr)
  md_lease_run("release" as *u8, hb, "neg-control-holder" as *u8, "0" as *u8, 3, "/tmp/nx_promote_gt/probe.out" as *u8)
356
  // ---- T8 a DECLARED daemon must be sent to the health-checked /api/deploy ----------------------
  wfile("sites.sov.elf.new" as *u8, elfnew, 7)
  let n8: i64 = mkreq(req, "POST /api/promote" as *u8, "target=sites&confirm=yes" as *u8)
  let r8: i64 = ma_do_promote(req, n8, out)
  var t8: i64 = 1
  if gcontains(out, r8, "400" as *u8) == 0 { t8 = 0 }
  if gcontains(out, r8, "/api/deploy" as *u8) == 0 { t8 = 0 }
  if bytes_eq("sites.sov.elf.new" as *u8, elfnew, 7) == 0 { t8 = 0 }
  if file_absent("sites.elf" as *u8) == 0 { t8 = 0 }
  gv_check("neg-control-declared-daemon-refused-to-api-deploy-staged-untouched" as *u8, t8, ctr)
367
  // ---- T9 path escape ---------------------------------------------------------------------------
  let n9: i64 = mkreq(req, "POST /api/promote" as *u8, "target=../etc/x&confirm=yes" as *u8)
  let r9: i64 = ma_do_promote(req, n9, out)
  var t9: i64 = 1
  if gcontains(out, r9, "400" as *u8) == 0 { t9 = 0 }
  if gcontains(out, r9, "invalid target name" as *u8) == 0 { t9 = 0 }
  gv_check("neg-control-path-escape-refused-by-sanitize" as *u8, t9, ctr)
375
  // ---- T10 nothing staged and nothing live ------------------------------------------------------
  let n10: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nx_ecomat_beat&confirm=yes" as *u8)
  let r10: i64 = ma_do_promote(req, n10, out)
  var t10: i64 = 1
  if gcontains(out, r10, "400" as *u8) == 0 { t10 = 0 }
  // PHRASE MOVED 2026-08-20 (lane J per-conjunct refusals): the organ path's no-staged-no-live answer
  // is its own named text now; "no valid staged" survives only on the toolchain-upload path.
  if gcontains(out, r10, "no staged .elf.new and no live artefact" as *u8) == 0 { t10 = 0 }
  gv_check("neg-control-no-staged-and-no-live-artefact-refused" as *u8, t10, ctr)
385
  // ---- T11 a non-ELF staged blob is never installed ---------------------------------------------
  // NOTE the ordering dependency with the tooth above: it needs nx_ecomat_beat to have NO artefacts,
  // this one stages them. Sequential, not incidental.
  wfile("nx_ecomat_beat.sov.elf.new" as *u8, garbage, 3)
  wfile("nx_ecomat_beat.elf" as *u8, oldlive, 3)
  let n11: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nx_ecomat_beat&confirm=yes&allow_unverified_bytes=yes" as *u8)
  let r11: i64 = ma_do_promote(req, n11, out)
  var t11: i64 = 1
  if gcontains(out, r11, "PROMOTED" as *u8) == 1 { t11 = 0 }
  if bytes_eq("nx_ecomat_beat.elf" as *u8, oldlive, 3) == 0 { t11 = 0 }
  if lease_free_for("nx_ecomat_beat" as *u8) == 0 { t11 = 0 }
  gv_check("neg-control-non-elf-staged-never-installed-live-untouched-lease-untouched" as *u8, t11, ctr)
398
  // ---- T12 confirm=yes is mandatory -------------------------------------------------------------
  wfile("nxpromotenoconf.sov.elf.new" as *u8, elfnew, 7)
  wfile("nxpromotenoconf.elf" as *u8, oldlive, 3)
  let n12: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nxpromotenoconf" as *u8)
  let r12: i64 = ma_do_promote(req, n12, out)
  var t12: i64 = 1
  if gcontains(out, r12, "400" as *u8) == 0 { t12 = 0 }
  if gcontains(out, r12, "confirm=yes" as *u8) == 0 { t12 = 0 }
  if bytes_eq("nxpromotenoconf.sov.elf.new" as *u8, elfnew, 7) == 0 { t12 = 0 }
  if bytes_eq("nxpromotenoconf.elf" as *u8, oldlive, 3) == 0 { t12 = 0 }
  gv_check("neg-control-missing-confirm-refused-staged-and-live-untouched" as *u8, t12, ctr)
410
  // ---- T13 the digest is required, and refusing for it must not take the lease ------------------
  wfile("nxpromotedig.sov.elf.new" as *u8, elfnew, 7)
  wfile("nxpromotedig.elf" as *u8, oldlive, 3)
  let n13: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nxpromotedig&confirm=yes" as *u8)
  let r13: i64 = ma_do_promote(req, n13, out)
  var t13: i64 = 1
  if gcontains(out, r13, "digest-required" as *u8) == 0 { t13 = 0 }
  if bytes_eq("nxpromotedig.elf" as *u8, oldlive, 3) == 0 { t13 = 0 }
  if lease_free_for("nxpromotedig" as *u8) == 0 { t13 = 0 }
  gv_check("neg-control-expect-sha256-required-live-untouched-lease-untouched" as *u8, t13, ctr)
421
  // ---- T14 a declared daemon in the TOOLS family is refused the same way ------------------------
  let n14: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nx_tools_api_serve&confirm=yes" as *u8)
  let r14: i64 = ma_do_promote(req, n14, out)
  var t14: i64 = 1
  if gcontains(out, r14, "/api/deploy" as *u8) == 0 { t14 = 0 }
  let n14b: i64 = mkreq(req, "POST /api/promote" as *u8, "target=nx_shelltool&confirm=yes" as *u8)
  let r14b: i64 = ma_do_promote(req, n14b, out)
  // PHRASE MOVED 2026-08-20: a tool with a LIVE artefact and nothing staged now gets the recoverable
  // NOTHING-STAGED receipt (live_sha reported so a lost promote response can be reconciled).
  if gcontains(out, r14b, "NOTHING-STAGED" as *u8) == 0 { t14 = 0 }
  gv_check("neg-control-declared-tools-daemon-refused-while-a-tool-organ-reaches-the-staging-check" as *u8, t14, ctr)
433
  // cleanup -- leaves the fixture dir reusable; the .elf.new DIRECTORY is deliberately left in place
  // because sys_rmdir is not composed here and re-creating it is idempotent anyway.
  fio_unlink("sites.sov.elf.new" as *u8)
  fio_unlink("sites.elf" as *u8)
  fio_unlink("nxpromotepos.elf" as *u8)
  fio_unlink("nxpromotepos.elf.prev" as *u8)
  fio_unlink("nxpromoteleak.sov.elf.new" as *u8)
  fio_unlink("nxpromoteleak.elf" as *u8)
  fio_unlink("nx_ecomat_seed.elf" as *u8)
  fio_unlink("nx_ecomat_beat.sov.elf.new" as *u8)
  fio_unlink("nx_ecomat_beat.elf" as *u8)
  fio_unlink("nxpromotebusy.sov.elf.new" as *u8)
  fio_unlink("nxpromotebusy.elf" as *u8)
  fio_unlink("nxpromotedig.sov.elf.new" as *u8)
  fio_unlink("nxpromotedig.elf" as *u8)
  fio_unlink("nxpromotenoconf.sov.elf.new" as *u8)
  fio_unlink("nxpromotenoconf.elf" as *u8)
451
  let rc: i64 = gv_verdict("MGMT-PROMOTE-GATE" as *u8, ctr, "the promote lease is released on every exit that takes it, and the backoff the endpoint advertises is rendered from the same constant that sets the lock duration" as *u8)
  sys_exit(rc)
  return rc
455}
nx_mgmt_promote_gate.nx source

`nx_mgmt_promote_gate.nx` source
