nx_offc_install.nx source

1// nx_offc_install.nx -- ENGINEER GUARDRAIL against LM-026 (the stale-_offc landmine that cost a full 2// session on the MMU instruction-fetch rung): `nx_sov_build_run <name>` builds the FRESH binary to 3// /tmp/<name>.sov.elf and runs THAT as its smoke, but does NOT reliably install it to _offc/<name>.elf. 4// Gates/organs fork _offc/*.elf, so they silently test a STALE binary -- source edits never take effect 5// and diagnostics never fire. This organ is the structural prevention: it DETECTS the staleness (byte 6// mismatch between the installed _offc artifact and the fresh /tmp build) and ATOMICALLY installs the 7// fresh build (write temp + renameat = rule 16 immutable/atomic deploy), then VERIFIES byte-equal. 8// 9// It is the AUTO remedy seeded as known-issue LM-026 (nx_known_issue_seed): when any Engineer/Doctor 10// diagnostic contains the signature "STALE-OFFC-ARTIFACT", ki_recall routes here (nx_offc_install:oi_install) 11// so the team auto-heals instead of chasing phantom logic bugs. 12// 13// oi_stale(name) -> 1 if _offc/<name>.elf differs from /tmp/<name>.sov.elf (or _offc absent while a 14// fresh /tmp build exists); 0 if byte-identical (fresh) or no /tmp build to judge. 15// oi_install(name) -> atomically copy /tmp/<name>.sov.elf -> _offc/<name>.elf + verify; 1 on success. 16// main <name> -> detect; install-if-stale; emit the STALE-OFFC-ARTIFACT recall signature + verdict. 17// Sovereign, no gcc/.sh. license_tier: ORIGINAL 18import "nx_syscalls.nx" 19const OI_MAGIC_1024: i64 = 1024 20const OI_MAGIC_1000000000: i64 = 1000000000 21 22const OI_SIG: *u8 = "STALE-OFFC-ARTIFACT" 23const OI_LOG: *u8 = "knowledge/status/offc_install.log" 24const OI_ATFDCWD: i64 = 0 - 100 25 26func oi_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 27func oi_p(s: *u8) -> i64 { sys_write(1, s, oi_len(s)); return 0 } 28func oi_fp(fd: i64, s: *u8) -> i64 { sys_write(fd, s, oi_len(s)); return 0 } 29 30// out = a + b + c (NUL-terminated); returns length. One concat for every path shape. 31func oi_cat(out: *u8, a: *u8, b: *u8, c: *u8) -> i64 { 32 var o: i64 = 0 33 var i: i64 = 0 34 while a[i] != (0 as u8) { out[o] = a[i]; o = o + 1; i = i + 1 } 35 i = 0 36 while b[i] != (0 as u8) { out[o] = b[i]; o = o + 1; i = i + 1 } 37 i = 0 38 while c[i] != (0 as u8) { out[o] = c[i]; o = o + 1; i = i + 1 } 39 out[o] = 0 as u8 40 return o 41} 42func oi_offc_path(name: *u8, out: *u8) -> i64 { return oi_cat(out, "_offc/" as *u8, name, ".elf" as *u8) } 43func oi_tmp_path(name: *u8, out: *u8) -> i64 { return oi_cat(out, "/tmp/" as *u8, name, ".sov.elf" as *u8) } 44func oi_tmpinstall_path(name: *u8, out: *u8) -> i64 { return oi_cat(out, "_offc/" as *u8, name, ".elf.oitmp" as *u8) } 45func oi_cat2(out: *u8, a: *u8, b: *u8) -> i64 { 46 var o: i64 = 0 47 var i: i64 = 0 48 while a[i] != (0 as u8) { out[o] = a[i]; o = o + 1; i = i + 1 } 49 i = 0 50 while b[i] != (0 as u8) { out[o] = b[i]; o = o + 1; i = i + 1 } 51 out[o] = 0 as u8 52 return o 53} 54 55// WHICH build artifact do we install FROM? 2026-08-06: this guardrail was run in anger for the first 56// time and reported "fresh, no install needed" for nx_boot_run_sov while _offc/nx_boot_run_sov.elf DID 57// NOT EXIST AT ALL -- because /tmp/<name>.sov.elf was gone and oi_stale reads "no /tmp twin" as "nothing 58// to judge -> not stale". /tmp is VOLATILE (the build notes warn it is cleared on idle), so the one 59// input this detector depended on is the one least likely to survive. 60// The DURABLE twin is the staged artifact /api/build leaves at <name>.sov.elf.new in the serving root. 61// Prefer /tmp (freshest), then the staged copy, then the PROMOTED root binary. 62// Returns 1=/tmp, 2=staged .sov.elf.new, 3=promoted <name>.elf, 0=NO BUILD ARTIFACT ANYWHERE. 63func oi_src_pick(name: *u8, out: *u8) -> i64 { 64 oi_tmp_path(name, out) 65 let l1: *i64 = sys_mmap(16) as *i64 66 let b1: *u8 = sys_read_file(out, l1) 67 if (b1 as i64) != 0 { return 1 } 68 oi_cat2(out, name, ".sov.elf.new" as *u8) 69 let l2: *i64 = sys_mmap(16) as *i64 70 let b2: *u8 = sys_read_file(out, l2) 71 if (b2 as i64) != 0 { return 2 } 72 // 2026-08-06 THIRD SOURCE, measured on the seven kernel gates. nx_priv_emit, nx_timer_irq_emit and 73 // nx_drv_proto_emit each have a PROMOTED <name>.elf sitting in the serving root and NO /tmp twin and 74 // NO staged .new -- their builds landed and were promoted long ago, so BOTH volatile sources are 75 // gone while the authoritative binary is right there. With only two sources this guardrail answered 76 // CANNOT-JUDGE for exactly the organs it exists to install, and _offc/ stayed empty for all seven. 77 // A PROMOTED ARTIFACT IS THE MOST DURABLE BUILD OUTPUT THERE IS -- it belongs in the source list. 78 // Ranked LAST on purpose: it is the oldest of the three (nx_boot_run_sov root=116433B vs staged 79 // 119445B), so it must never win over a fresher build that still exists. 80 oi_cat2(out, name, ".elf" as *u8) 81 let l3: *i64 = sys_mmap(16) as *i64 82 let b3: *u8 = sys_read_file(out, l3) 83 if (b3 as i64) != 0 { return 3 } 84 out[0] = 0 as u8 85 return 0 86} 87 88// 1 if the two buffers differ (length OR any byte). The staleness signal. 89func oi_differ(a: *u8, alen: i64, b: *u8, blen: i64) -> i64 { 90 if alen != blen { return 1 } 91 var i: i64 = 0 92 while i < alen { if a[i] != b[i] { return 1 } i = i + 1 } 93 return 0 94} 95 96// 1 = _offc artifact is STALE vs the fresh /tmp build (or absent while /tmp exists); 0 = fresh / nothing to judge. 97// 1 = _offc artifact is STALE vs the freshest build we can find (or absent while a build exists); 98// 0 = byte-identical; -1 = CANNOT JUDGE (no build artifact anywhere). 99// THE -1 IS THE FIX: the old contract folded "cannot judge" into "not stale" and main printed "fresh, 100// no install needed" -- so this guardrail reported healthy in precisely the state it exists to catch, 101// and _offc/ stayed empty for seven kernel gates while LM-026 sat marked as prevented. 102// A DETECTOR THAT CANNOT TELL "I LOOKED AND IT WAS FINE" FROM "I COULD NOT LOOK" IS NOT A DETECTOR. 103// ★★★EXECUTABILITY IS PART OF "INSTALLED", AND A BYTE COMPARE CANNOT SEE IT. 104// MEASURED 2026-08-14: a byte-identical copy placed into _offc/ WITHOUT the execute bit read as FRESH 105// here, so oi_install never ran -- and every gate forking that artifact got ZERO bytes of output. A 106// silent, total failure that looks exactly like a code bug in the organ being tested. (Proven by 107// control: the pre-existing _offc/nx_vizsla_calendar.elf ran fine while the byte-identical copy did not, 108// and nx_behaveprobe showed the SAME organ working from the promoted root.) 109// ★THIS ORGAN ALREADY CARRIES THE LAW IT WAS BREAKING -- "A DETECTOR THAT CANNOT TELL 'I LOOKED AND IT 110// WAS FINE' FROM 'I COULD NOT LOOK' IS NOT A DETECTOR" -- and this is the same shape one level down: 111// it could not tell INSTALLED-AND-RUNNABLE from INSTALLED-AND-INERT. 112// st_mode is a u32 at offset 24 of struct stat; 0o100 (64) is S_IXUSR. Third state kept: -1 = could not 113// stat, which must NOT be reported as "not executable". 114const OI_STAT_MODE_OFF: i64 = 24 115const OI_S_IXUSR: i64 = 64 116func oi_executable(path: *u8) -> i64 { 117 let sb: *u8 = sys_mmap(160) 118 if sys_fstatat(path, sb) < 0 { return 0 - 1 } 119 let m: i64 = (sb[OI_STAT_MODE_OFF] as i64) + ((sb[OI_STAT_MODE_OFF+1] as i64) << 8) 120 if (m & OI_S_IXUSR) != 0 { return 1 } 121 return 0 122} 123func oi_stale(name: *u8) -> i64 { 124 let op: *u8 = sys_mmap(OI_MAGIC_1024); oi_offc_path(name, op) 125 let sp2: *u8 = sys_mmap(OI_MAGIC_1024) 126 if oi_src_pick(name, sp2) == 0 { return 0 - 1 } 127 let ol: *i64 = sys_mmap(16) as *i64 128 let sl: *i64 = sys_mmap(16) as *i64 129 let sb: *u8 = sys_read_file(sp2, sl) 130 if (sb as i64) == 0 { return 0 - 1 } 131 let ob: *u8 = sys_read_file(op, ol) 132 if (ob as i64) == 0 { return 1 } // _offc absent but a build exists -> never installed -> stale 133 // an artifact that cannot be EXECUTED is not installed, however perfect its bytes 134 if oi_executable(op) == 0 { return 1 } 135 return oi_differ(ob, ol[0], sb, sl[0]) 136} 137 138// atomically install /tmp/<name>.sov.elf -> _offc/<name>.elf (write .oitmp + renameat) + verify byte-equal. 139// THE ATOMIC INSTALL, PARAMETERISED BY SOURCE (2026-08-14, debt 1786758824). Extracted rather than 140// copied: there must stay exactly ONE implementation of write-temp + renameat + verify, or the two 141// copies diverge and only one of them stays correct. 142func oi_install_from(name: *u8, tp: *u8) -> i64 { 143 let op: *u8 = sys_mmap(OI_MAGIC_1024); oi_offc_path(name, op) 144 let xp: *u8 = sys_mmap(OI_MAGIC_1024); oi_tmpinstall_path(name, xp) 145 let tl: *i64 = sys_mmap(16) as *i64 146 let tb: *u8 = sys_read_file(tp, tl) 147 if (tb as i64) == 0 { return 0 } // nothing to install 148 let fd: i64 = sys_openat_wr(xp, 493) // 0755 (installed artifact stays executable) 149 if fd < 0 { return 0 } 150 sys_write(fd, tb, tl[0]); sys_close(fd) 151 if sys_renameat(xp, op) != 0 { return 0 } // atomic publish (same-dir rename) 152 let vl: *i64 = sys_mmap(16) as *i64 153 let vb: *u8 = sys_read_file(op, vl) // verify the install matches the build exactly 154 if (vb as i64) == 0 { return 0 } 155 if oi_differ(vb, vl[0], tb, tl[0]) == 1 { return 0 } 156 return 1 157} 158 159// DEVELOPER remedy: install the FRESHEST build found (/tmp > staged > promoted). Right when you are 160// healing your own build loop; WRONG for a fleet sweep, because the freshest may be unreviewed. 161func oi_install(name: *u8) -> i64 { 162 let tp: *u8 = sys_mmap(OI_MAGIC_1024); oi_src_pick(name, tp) 163 return oi_install_from(name, tp) 164} 165 166// FLEET remedy: install ONLY the PROMOTED root binary -- the bytes /api/promote already blessed through 167// its contentdiff and capability-loss guards. ★★★★★★A REPAIR THAT CAN PUBLISH UNREVIEWED BYTES IS NOT A 168// REPAIR, IT IS A DEPLOY WEARING A REPAIR'S NAME. This is the executor for the census's SAFE-REPAIR set, 169// and it converges _offc/ to what the estate already decided to run rather than to whatever build 170// happened to be lying around. 171func oi_install_promoted(name: *u8) -> i64 { 172 let tp: *u8 = sys_mmap(OI_MAGIC_1024); oi_promoted_path(name, tp) 173 return oi_install_from(name, tp) 174} 175 176// FRESH-COMPILE GUARANTEE for the EXTERNAL-ORACLE gate path (LM-027). When a gate compiles buyer-runtime 177// source straight into _offc/<x>.elf and then runs it (e.g. the lang-export oracle gate: gcc lg_c.c -> 178// lg_c.elf -> ./lg_c.elf), oi_install CANNOT cover it -- there is no /tmp/<name>.sov.elf twin to diff, 179// and there is no stat/mtime syscall to detect staleness reactively. The robust PROACTIVE prevention is 180// to REMOVE the prior artifact before (re)compiling, so a stale binary can NEVER be forked: if the 181// compile then fails, the run fails LOUD instead of silently succeeding on yesterday's binary (the exact 182// trap that printed 650 for a 125 program). Returns 1 iff the artifact is absent afterwards (removed or 183// never existed = guaranteed fresh), 0 if it somehow survived. 184func oi_fresh(path: *u8) -> i64 { 185 __syscall(263, OI_ATFDCWD, path, 0, 0, 0, 0) // unlinkat(AT_FDCWD, path, 0); ENOENT is harmless 186 let l: *i64 = sys_mmap(16) as *i64 187 let b: *u8 = sys_read_file(path, l) 188 if (b as i64) == 0 { return 1 } 189 return 0 190} 191 192// file mtime in nanoseconds since epoch via sys_fstatat, or -1 if missing/unstattable. The reactive 193// freshness CHANNEL the LM-027 external-oracle gate path needs (it has no /tmp twin to byte-diff). 194func oi_mtime_ns(path: *u8) -> i64 { 195 let sb: *u8 = sys_mmap(160) // 144-byte struct stat + slack 196 if sys_fstatat(path, sb) < 0 { return 0 - 1 } 197 let secp: *i64 = (sb as i64 + 88) as *i64 // st_mtim.tv_sec 198 let nsecp: *i64 = (sb as i64 + 96) as *i64 // st_mtim.tv_nsec 199 return secp[0] * OI_MAGIC_1000000000 + nsecp[0] 200} 201 202// 1 if `artifact` is STALE vs `source` (artifact mtime strictly older than source, or artifact absent 203// while the source exists); 0 if fresh (artifact at-or-newer than source) or there is no source to be 204// stale against. The LM-027 REACTIVE detector (DISCIPLINE -> AUTO): unlike oi_stale (which needs the 205// /tmp/<name>.sov.elf twin), this works for ANY compile-then-run gate -- call it BEFORE running an 206// externally-built artifact; if stale -> recompile / fail LOUD instead of silently running yesterday's 207// binary (the exact trap that printed 650 for a 125-line program in the lang-export oracle gate). 208func oi_src_stale(artifact: *u8, source: *u8) -> i64 { 209 let sm: i64 = oi_mtime_ns(source) 210 if sm < 0 { return 0 } // no source -> cannot be stale against it 211 let am: i64 = oi_mtime_ns(artifact) 212 if am < 0 { return 1 } // source exists but artifact missing -> stale (never built) 213 if am < sm { return 1 } // artifact strictly older than source -> stale 214 return 0 215} 216 217func oi_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(fd,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 218 219// ---- FLEET CENSUS (2026-08-14, debt 1786758132) ------------------------------------------------- 220// WHY: /api/promote installs to the SERVING ROOT, but nx_job_run and organ-to-organ forks resolve 221// _offc/<name>.elf. So a promote can report success while every caller keeps executing the OLD binary, 222// with no signal anywhere. MEASURED THE SAME DAY: nx_secret_scan_gate read KAT 3/5 with its plant 223// undetected, and I filed a sev-8 saying the plaintext-secret DETECTOR was vacuous. It was not -- the 224// detector was byte-perfect, and TWO STACKED STALE _offc ARTIFACTS (the gate, and the scanner it forks) 225// were the entire defect. After installing both: 5/5 and prod GREEN over 15,566 files. 226// ★★★★★★A STALE COPY OF A CORRECT INSTRUMENT IS INDISTINGUISHABLE FROM A BROKEN INSTRUMENT, AND THE 227// ONE-AT-A-TIME VERB COULD NEVER FIND THE NEXT ONE -- IT ANSWERS ONLY FOR A NAME YOU ALREADY SUSPECT. 228// This verb asks the whole fleet at once, which is the difference between healing an incident and 229// closing a class. 230// ★THIRD STATE PRESERVED, NOT COLLAPSED: oi_stale returns -1 for CANNOT-JUDGE and this census keeps it 231// in its own bucket. Folding it into FRESH is the exact defect this organ's own header records from 232// 2026-08-06, and a census that hid it would re-commit it at fleet scale. 233// RESOURCE ENVELOPE, NAMED: oi_stale reads BOTH artifacts per name via sys_read_file (whole-file mmap, 234// not unmapped). This is a SHORT-LIVED ONE-SHOT process, so the kernel reclaims at exit and the peak is 235// bounded by the corpus -- but it is a real peak, so this is a census verb, never a per-request path. 236const OI_DIRBUF: i64 = 65536 237 238func oi_streq(a: *u8, b: *u8) -> i64 { 239 var i: i64 = 0 240 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } 241 if b[i] != (0 as u8) { return 0 } 242 return 1 243} 244 245func oi_ends(s: *u8, suf: *u8) -> i64 { 246 let sl: i64 = oi_len(s) 247 let fl: i64 = oi_len(suf) 248 if fl > sl { return 0 } 249 var i: i64 = 0 250 while i < fl { if s[sl - fl + i] != suf[i] { return 0 } i = i + 1 } 251 return 1 252} 253 254func oi_promoted_path(name: *u8, out: *u8) -> i64 { return oi_cat2(out, name, ".elf" as *u8) } 255 256// MIRROR MAINTENANCE, IDEMPOTENT AND CREATE-NOTHING (2026-08-14, debt 1786758132). 257// Refresh _offc/<name>.elf from the PROMOTED root binary ONLY IF an _offc copy ALREADY EXISTS. 258// ★★★★★★THE DIFFERENCE BETWEEN MAINTAINING A MIRROR AND CREATING ONE IS THE WHOLE SAFETY OF THIS 259// OPERATION. Not every organ belongs in the fork path; installing unconditionally would ADD artifacts 260// that were never there, quietly widening what runners can fork. Refresh maintains an invariant that 261// someone already opted into; install creates a new one. Only the first is safe to call automatically. 262// Returns 2=refreshed, 1=SKIP (no _offc mirror to maintain), 0=FAILED (mirror exists but install failed). 263func oi_refresh(name: *u8) -> i64 { 264 let op: *u8 = sys_mmap(OI_MAGIC_1024); oi_offc_path(name, op) 265 let ol: *i64 = sys_mmap(16) as *i64 266 if (sys_read_file(op, ol) as i64) == 0 { return 1 } 267 if oi_install_promoted(name) == 1 { return 2 } 268 return 0 269} 270 271// STALENESS AGAINST A CALLER-CHOSEN SOURCE, so the question can be asked precisely instead of always 272// against "the freshest thing lying around". Same tri-state contract as oi_stale: 1 STALE, 0 fresh, 273// -1 CANNOT JUDGE (that source does not exist). 274// ★★★★★WHY THIS EXISTS (debt 1786758824): oi_src_pick ranks /tmp > staged .sov.elf.new > promoted root, 275// which is RIGHT for a developer healing their own build loop and WRONG for a FLEET REPAIR -- installing 276// the freshest pick can publish an UNPROMOTED, UNREVIEWED build into the very path runners fork, 277// bypassing promote's contentdiff and capability-loss guards. A fleet repair must be able to demand the 278// PROMOTED tier. Measured on the assembler: staged 167048B unpromoted vs promoted 159852B. 279func oi_stale_vs(name: *u8, sp: *u8) -> i64 { 280 let sl: *i64 = sys_mmap(16) as *i64 281 let sb: *u8 = sys_read_file(sp, sl) 282 if (sb as i64) == 0 { return 0 - 1 } 283 let op: *u8 = sys_mmap(OI_MAGIC_1024); oi_offc_path(name, op) 284 let ol: *i64 = sys_mmap(16) as *i64 285 let ob: *u8 = sys_read_file(op, ol) 286 if (ob as i64) == 0 { return 1 } 287 return oi_differ(ob, ol[0], sb, sl[0]) 288} 289 290// Does NishiLang SOURCE exist for this artifact? 1 = _hdl_build, 2 = runtime, 0 = nowhere. 291// ★★★★★★CANNOT-JUDGE IS TWO OPPOSITE SITUATIONS WEARING ONE COUNT: an artifact whose SOURCE still 292// exists is merely UNBUILT (build + promote and it is judgeable again), while one with no source anywhere 293// is a binary in the fork path that NOTHING IN THE ESTATE CAN REBUILD OR VERIFY. The first is a chore, 294// the second is capability that exists only as compiled bytes -- and reporting them as one number hides 295// the second inside the first. A BUCKET NAMED FOR HOW THE READER FAILED MERGES REMEDIES THAT DIVERGE. 296func oi_has_source(name: *u8, out: *u8) -> i64 { 297 oi_cat(out, "buildroot/runtime/_hdl_build/" as *u8, name, ".nx" as *u8) 298 let l1: *i64 = sys_mmap(16) as *i64 299 if (sys_read_file(out, l1) as i64) != 0 { return 1 } 300 oi_cat(out, "buildroot/runtime/" as *u8, name, ".nx" as *u8) 301 let l2: *i64 = sys_mmap(16) as *i64 302 if (sys_read_file(out, l2) as i64) != 0 { return 2 } 303 return 0 304} 305 306func oi_census() -> i64 { 307 let dfd: i64 = sys_openat_rd("_offc" as *u8) 308 if dfd < 0 { oi_p("OFFC-CENSUS verdict=RED reason=_offc-unreadable -- a census that scanned nothing is not a clean census\n" as *u8); return 3 } 309 let dbuf: *u8 = sys_mmap(OI_DIRBUF + 64) 310 let nm: *u8 = sys_mmap(OI_MAGIC_1024) 311 // Scratch paths allocated ONCE and reused: sys_mmap is page-granular with no allocator behind it, 312 // so a per-iteration mmap over 142 artifacts leaks a page each time (the 27.7GB class). 313 let sp: *u8 = sys_mmap(OI_MAGIC_1024) 314 let pp: *u8 = sys_mmap(OI_MAGIC_1024) 315 var total: i64 = 0 316 var stale: i64 = 0 317 var fresh: i64 = 0 318 var unjudge: i64 = 0 319 var vs_prom: i64 = 0 320 var unbuilt: i64 = 0 321 var orphan: i64 = 0 322 var run: i64 = 1 323 while run == 1 { 324 let nb: i64 = sys_getdents64(dfd, dbuf, OI_DIRBUF) 325 if nb <= 0 { run = 0 } else { 326 var off: i64 = 0 327 while off < nb { 328 let rec: *u8 = ((dbuf as i64) + off) as *u8 329 let rl: i64 = dirent_reclen(rec) 330 if rl <= 0 { off = nb } else { 331 let dn: *u8 = dirent_name(rec) 332 if dirent_type(rec) == 8 { 333 if oi_ends(dn, ".elf" as *u8) == 1 { 334 let l: i64 = oi_len(dn) 335 var i: i64 = 0 336 while i < l - 4 { nm[i] = dn[i]; i = i + 1 } 337 nm[l - 4] = 0 as u8 338 let st: i64 = oi_stale(nm) 339 total = total + 1 340 if st == 1 { 341 stale = stale + 1 342 // NAME THE TIER THE VERDICT WAS COMPUTED AGAINST. "STALE" alone cannot 343 // tell BEHIND-THE-PROMOTED-BINARY (a real fleet defect, safe to repair) 344 // from BEHIND-SOMEONE'S-SCRATCH-BUILD (repairing it would PUBLISH an 345 // unreviewed build). Those have opposite remedies, so they must not 346 // share one word. 347 let tier: i64 = oi_src_pick(nm, sp) 348 oi_promoted_path(nm, pp) 349 let vsp: i64 = oi_stale_vs(nm, pp) 350 if vsp == 1 { vs_prom = vs_prom + 1 } 351 oi_p(" STALE " as *u8); oi_p(nm) 352 oi_p(" freshest_tier=" as *u8); oi_wn(1, tier) 353 oi_p(" vs_promoted=" as *u8); oi_wn(1, vsp) 354 if vsp == 1 { oi_p(" SAFE-REPAIR (differs from the PROMOTED binary)" as *u8) } 355 if vsp == 0 { oi_p(" DO-NOT-BULK-INSTALL (already matches PROMOTED; only a scratch build is newer)" as *u8) } 356 if vsp < 0 { oi_p(" NO-PROMOTED-BINARY (nothing blessed to install from)" as *u8) } 357 oi_p("\n" as *u8) 358 } 359 if st == 0 { fresh = fresh + 1 } 360 if st < 0 { 361 unjudge = unjudge + 1 362 // SPLIT THE BUCKET AT THE POINT OF MEASUREMENT, not in a later pass: 363 // UNBUILT (source present -> build+promote) vs ORPHAN (no source anywhere 364 // -> a binary nothing can rebuild or verify). 365 if oi_has_source(nm, sp) == 0 { 366 orphan = orphan + 1 367 oi_p(" ORPHAN " as *u8); oi_p(nm) 368 oi_p(" -- in the fork path, NO build artifact and NO .nx source anywhere: nothing can rebuild or verify it\n" as *u8) 369 } else { unbuilt = unbuilt + 1 } 370 } 371 } 372 } 373 off = off + rl 374 } 375 } 376 } 377 } 378 sys_close(dfd) 379 // NON-VACUITY FLOOR: zero artifacts scanned prints all-zero counts that read exactly like a clean 380 // fleet. Refuse instead. 381 if total <= 0 { oi_p("OFFC-CENSUS verdict=RED reason=no-artifacts-scanned\n" as *u8); return 3 } 382 oi_p("OFFC-CENSUS artifacts=" as *u8); oi_wn(1, total) 383 oi_p(" fresh=" as *u8); oi_wn(1, fresh) 384 oi_p(" STALE=" as *u8); oi_wn(1, stale) 385 oi_p(" cannot-judge=" as *u8); oi_wn(1, unjudge) 386 oi_p(" (unbuilt=" as *u8); oi_wn(1, unbuilt) 387 oi_p(" ORPHAN=" as *u8); oi_wn(1, orphan) 388 oi_p(")" as *u8) 389 // THE ACTIONABLE SUBSET. Only artifacts that differ from the PROMOTED binary can be repaired without 390 // publishing unreviewed bytes; the remainder are stale only against a scratch build and must be left 391 // alone. ★A WORKLIST THAT DOES NOT SEPARATE SAFE FROM UNSAFE REPAIRS IS NOT A WORKLIST. 392 oi_p(" SAFE-REPAIR(differ-from-promoted)=" as *u8); oi_wn(1, vs_prom) 393 // A PARTITION IS A CLAIM: CHECK THE PARTS SUM. 394 let sum: i64 = fresh + stale + unjudge 395 oi_p(" partition=" as *u8); oi_wn(1, sum) 396 if sum == total { oi_p(" == artifacts OK" as *u8) } else { oi_p(" != artifacts UNSOUND" as *u8) } 397 // THE SUB-PARTITION IS A CLAIM TOO: unbuilt + orphan must reconstitute cannot-judge, or the split is 398 // dropping rows and its ORPHAN count -- the alarming half -- would be an undercount. 399 let usum: i64 = unbuilt + orphan 400 oi_p(" cj_split=" as *u8); oi_wn(1, usum) 401 if usum == unjudge { oi_p(" == cannot-judge OK" as *u8) } else { oi_p(" != cannot-judge UNSOUND" as *u8) } 402 // ★★★★★★THE VERDICT ALARMS ONLY ON WHAT CAN BE SAFELY ACTED UPON. Keying RED on stale>0 would make 403 // this permanently RED on states that are CORRECT: an artifact that already matches the promoted 404 // binary (only a scratch build is newer) is exactly where it should be, and one with NO promoted 405 // binary anywhere cannot be repaired by any install. A DETECTOR THAT IS PERMANENTLY RED IS ONE 406 // EVERYONE LEARNS TO IGNORE -- and this organ is meant for a beat, where that is fatal. 407 // The other buckets are still PRINTED, because unactionable is not the same as uninteresting. 408 if vs_prom == 0 { oi_p(" verdict=GREEN (no artifact differs from its PROMOTED binary; remaining STALE rows are correct states, reported above)\n" as *u8); return 0 } 409 oi_p(" verdict=RED (SAFE-REPAIR rows differ from the blessed binary: nx_offc_install <name> promoted)\n" as *u8) 410 return 1 411} 412 413func main(argc: i64, argv: *i64) -> i64 { 414 if argc < 2 { 415 oi_p("nx_offc_install <organ-name> (e.g. nx_boot_run_sov) -- detect + install stale _offc artifact\n" as *u8) 416 return 1 417 } 418 let name: *u8 = argv[1] as *u8 419 // FLEET verb: ask every installed artifact at once instead of only the one name you already suspect. 420 if oi_streq(name, "census" as *u8) == 1 { return oi_census() } 421 // FLEET-SAFE remedy: `nx_offc_install <name> promoted` installs ONLY the blessed root binary, never a 422 // scratch or staged build. This is the executor the census's SAFE-REPAIR rows name. 423 if argc >= 3 { 424 // MIRROR REFRESH: safe to call unconditionally after any promote, because it CREATES NOTHING. 425 if oi_streq(argv[2] as *u8, "refresh" as *u8) == 1 { 426 let rr: i64 = oi_refresh(name) 427 oi_p("OFFC-REFRESH name=" as *u8); oi_p(name) 428 if rr == 2 { oi_p(" REFRESHED (an _offc mirror existed and now matches the PROMOTED binary)\n" as *u8); return 0 } 429 if rr == 1 { oi_p(" SKIP (no _offc mirror exists; refresh MAINTAINS mirrors, it never creates them)\n" as *u8); return 0 } 430 oi_p(" FAILED (an _offc mirror exists but could not be refreshed from the promoted binary)\n" as *u8) 431 return 1 432 } 433 if oi_streq(argv[2] as *u8, "promoted" as *u8) == 1 { 434 let okp: i64 = oi_install_promoted(name) 435 oi_p("OFFC-INSTALL-PROMOTED name=" as *u8); oi_p(name) 436 oi_p(" installed=" as *u8); oi_wn(1, okp) 437 if okp == 1 { oi_p(" (from the PROMOTED root binary; _offc now matches what promote blessed)\n" as *u8); return 0 } 438 oi_p(" FAILED -- no promoted binary to install from, or the verify byte-compare failed\n" as *u8) 439 return 1 440 } 441 } 442 let st: i64 = oi_stale(name) 443 var fixed: i64 = 0 444 if st == 1 { if oi_install(name) == 1 { fixed = 1 } } 445 446 let lf: i64 = sys_openat_append(OI_LOG, 420) 447 if st == 1 { 448 // diagnostic carries the recall signature so the Doctor's ki_recall (LM-026) routes here. 449 oi_p("OFFC-INSTALL " as *u8); oi_p(OI_SIG); oi_p(" name=" as *u8); oi_p(name); oi_p(" installed=" as *u8); oi_wn(1, fixed); oi_p("\n" as *u8) 450 if lf >= 0 { oi_fp(lf, "OFFC-INSTALL " as *u8); oi_fp(lf, OI_SIG); oi_fp(lf, " name=" as *u8); oi_fp(lf, name); oi_fp(lf, " installed=" as *u8); oi_wn(lf, fixed); oi_fp(lf, "\n" as *u8); sys_close(lf) } 451 if fixed == 1 { return 0 } 452 return 1 453 } 454 if st < 0 { 455 // CANNOT JUDGE is NOT fresh. Report it LOUDLY and say whether the artifact the gates fork is 456 // even present, because "no build to compare + no installed artifact" is the WORST state and 457 // the old code printed it as "fresh". 458 let op2: *u8 = sys_mmap(OI_MAGIC_1024); oi_offc_path(name, op2) 459 let ol2: *i64 = sys_mmap(16) as *i64 460 let ob2: *u8 = sys_read_file(op2, ol2) 461 var present: i64 = 1 462 if (ob2 as i64) == 0 { present = 0 } 463 oi_p("OFFC-INSTALL CANNOT-JUDGE name=" as *u8); oi_p(name) 464 oi_p(" (no build artifact at /tmp/<n>.sov.elf NOR <n>.sov.elf.new) offc_present=" as *u8); oi_wn(1, present) 465 if present == 0 { oi_p(" -- the artifact gates fork is ABSENT and there is nothing to install it from: BUILD THE TARGET FIRST" as *u8) } 466 oi_p("\n" as *u8) 467 if lf >= 0 { oi_fp(lf, "OFFC-INSTALL CANNOT-JUDGE name=" as *u8); oi_fp(lf, name); oi_fp(lf, " offc_present=" as *u8); oi_wn(lf, present); oi_fp(lf, "\n" as *u8); sys_close(lf) } 468 return 2 469 } 470 oi_p("OFFC-INSTALL fresh name=" as *u8); oi_p(name); oi_p(" (installed artifact is byte-identical to the build)\n" as *u8) 471 if lf >= 0 { oi_fp(lf, "OFFC-INSTALL fresh name=" as *u8); oi_fp(lf, name); oi_fp(lf, "\n" as *u8); sys_close(lf) } 472 return 0 473}