nx_mirror_orchestrator.nx source

1// nx_mirror_orchestrator.nx -- LIB: the UNIFYING "mirror a published open artifact (e.g. Apertus) onto the NAS" 2// flow (the #1 GAP nx_mirror_census surfaced). It COMPOSES shipped sovereign primitives -- it does NOT re-implement 3// them: sha256_digest (nx_sha256, byte-exact integrity), nx_https_fetch_follow (own-TLS HTTP), the BitTorrent+DHT 4// swarm (nx_torrent_get/nx_dht_get_peers/nx_peer_download), nx_aw_send (NAS transport), rcpt_emit (nx_pub_receipt, 5// Ed25519-signed provenance). This file is the pure, deterministic, NEVER-BRICK ORCHESTRATION LOGIC: parse a 6// data-driven manifest row -> resolve the fetch method by scheme (fail-closed on unknown) -> VERIFY the artifact's 7// SHA-256 against the manifest's expected digest (fail-closed = never store a corrupt artifact) -> derive the 8// idempotent content-address key (re-mirror = no-op) -> assemble the provenance-receipt binding in the exact 9// nx_pub_receipt shape. The LIVE dispatch (fetch + NAS push + SIGNED rcpt_emit) is rung-2, gated behind operator 10// confirm (heavy/outward). Additive-only + idempotent by construction (Cardinal 10/13). No main -> built via its 11// _gate. license_tier: ORIGINAL 12import "nx_sha256.nx" // sha256_digest -- the canonical substrate SHA-256 (FIPS 180-4, byte-exact, no-float) 13import "nx_syscalls.nx" 14 15// scheme codes: 1 = HTTP(S) over own TLS, 2 = TORRENT/MAGNET swarm, 0 = REJECT (fail-closed on unknown scheme). 16const MO_HTTP: i64 = 1 17const MO_TORRENT: i64 = 2 18const MO_REJECT: i64 = 0 19 20func mo_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 21func mo_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while 1==1 { let ca: i64=a[i] as i64; let cb: i64=b[i] as i64; if ca!=cb {return 0} if ca==0 {return 1} i=i+1 } return 1 } 22func mo_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var i: i64=0; while s[i]!=(0 as u8){dst[o]=s[i]; o=o+1; i=i+1} return o } 23 24// hex-encode n bytes -> out (2n hex chars + NUL). content-addressing / receipt display are lowercase hex. 25func mo_hexenc(inp: *u8, n: i64, out: *u8) -> i64 { 26 let hx: *u8 = "0123456789abcdef" as *u8 27 var i: i64 = 0 28 while i < n { out[i*2] = hx[((inp[i] as i64)>>4)&15]; out[i*2+1] = hx[(inp[i] as i64)&15]; i=i+1 } 29 out[n*2] = 0 as u8 30 return n*2 31} 32 33// resolve the fetch METHOD from the manifest scheme. Unknown -> MO_REJECT (fail-closed: we never guess a transport). 34func mo_scheme_code(scheme: *u8) -> i64 { 35 if mo_streq(scheme, "http" as *u8)==1 { return MO_HTTP } 36 if mo_streq(scheme, "https" as *u8)==1 { return MO_HTTP } 37 if mo_streq(scheme, "torrent" as *u8)==1 { return MO_TORRENT } 38 if mo_streq(scheme, "magnet" as *u8)==1 { return MO_TORRENT } 39 return MO_REJECT 40} 41 42// the artifact's SHA-256 as lowercase hex (65 bytes incl NUL). = its content-address AND its integrity digest. 43func mo_sha_hex(bytes: *u8, n: i64, out_hex: *u8) -> i64 { 44 let dig: *u8 = sys_mmap(32) 45 sha256_digest(bytes, n, dig) 46 return mo_hexenc(dig, 32, out_hex) 47} 48 49// INTEGRITY VERIFY (never-store-corrupt): 1 iff sha256(bytes) hex == expect_hex, else 0 (FAIL-CLOSED). 50// This is the single guarantee that a byte-flipped / truncated / MITM'd download is NEVER written to the NAS. 51func mo_verify(bytes: *u8, n: i64, expect_hex: *u8) -> i64 { 52 let got: *u8 = sys_mmap(80) 53 mo_sha_hex(bytes, n, got) 54 return mo_streq(got, expect_hex) 55} 56 57// idempotent CONTENT-ADDRESS key = "sha|dest" (the artifact's identity). Same content -> same key -> re-mirror is a 58// no-op (the receipt/CAS layer skips a key it already holds). Mirrors nx_pub_receipt's rcpt_key exactly. 59func mo_cas_key(sha_hex: *u8, dest: *u8, out: *u8) -> i64 { 60 var o: i64 = mo_cat(out, 0, sha_hex); out[o]=124 as u8; o=o+1; o=mo_cat(out, o, dest); out[o]=0 as u8; return o 61} 62 63// assemble the PROVENANCE-RECEIPT binding in the EXACT nx_pub_receipt shape: status|sha|dest|verify|ts. 64// (rung-1 assembles it unsigned for the plan; rung-2 hands these same fields to rcpt_emit for the Ed25519 signature 65// + append-only seg_store commit.) Keeping the byte-shape identical here = the live receipt verifies against it. 66func mo_receipt_bind(buf: *u8, status: *u8, sha_hex: *u8, dest: *u8, verify: *u8, tsstr: *u8) -> i64 { 67 var o: i64=0 68 o=mo_cat(buf,o,status); buf[o]=124 as u8; o=o+1 69 o=mo_cat(buf,o,sha_hex); buf[o]=124 as u8; o=o+1 70 o=mo_cat(buf,o,dest); buf[o]=124 as u8; o=o+1 71 o=mo_cat(buf,o,verify); buf[o]=124 as u8; o=o+1 72 o=mo_cat(buf,o,tsstr); buf[o]=0 as u8; return o 73} 74 75// parse a TAB-delimited manifest row (name\tscheme\tsource\tsha256\tdest) -> field #idx into out (NUL-terminated). 76// returns field length; 0 (empty) if the row has fewer than idx+1 fields. No 'break' (nx) -> flag-driven. 77func mo_parse_field(line: *u8, idx: i64, out: *u8) -> i64 { 78 var f: i64=0; var i: i64=0; var stop: i64=0 79 while stop==0 { 80 if f >= idx { stop=1 } else { 81 let c: i64 = line[i] as i64 82 if c==0 { out[0]=0 as u8; return 0 } // ran out of fields 83 if c==9 { f=f+1 } 84 i=i+1 85 } 86 } 87 var o: i64=0; var done: i64=0 88 while done==0 { 89 let c: i64 = line[i] as i64 90 if c==0 { done=1 } else { if c==9 { done=1 } else { out[o]=line[i]; o=o+1; i=i+1 } } 91 } 92 out[o]=0 as u8 93 return o 94}