nx_offc_install.nx source

1// nx_offc_install.nx -- ENGINEER GUARDRAIL against LM-026 (the stale-_offc landmine that cost a full 2// session on the MMU instruction-fetch rung): `nx_sov_build_run <name>` builds the FRESH binary to 3// /tmp/<name>.sov.elf and runs THAT as its smoke, but does NOT reliably install it to _offc/<name>.elf. 4// Gates/organs fork _offc/*.elf, so they silently test a STALE binary -- source edits never take effect 5// and diagnostics never fire. This organ is the structural prevention: it DETECTS the staleness (byte 6// mismatch between the installed _offc artifact and the fresh /tmp build) and ATOMICALLY installs the 7// fresh build (write temp + renameat = rule 16 immutable/atomic deploy), then VERIFIES byte-equal. 8// 9// It is the AUTO remedy seeded as known-issue LM-026 (nx_known_issue_seed): when any Engineer/Doctor 10// diagnostic contains the signature "STALE-OFFC-ARTIFACT", ki_recall routes here (nx_offc_install:oi_install) 11// so the team auto-heals instead of chasing phantom logic bugs. 12// 13// oi_stale(name) -> 1 if _offc/<name>.elf differs from /tmp/<name>.sov.elf (or _offc absent while a 14// fresh /tmp build exists); 0 if byte-identical (fresh) or no /tmp build to judge. 15// oi_install(name) -> atomically copy /tmp/<name>.sov.elf -> _offc/<name>.elf + verify; 1 on success. 16// main <name> -> detect; install-if-stale; emit the STALE-OFFC-ARTIFACT recall signature + verdict. 17// Sovereign, no gcc/.sh. license_tier: ORIGINAL 18import "nx_syscalls.nx" 19const OI_MAGIC_1024: i64 = 1024 20const OI_MAGIC_1000000000: i64 = 1000000000 21 22const OI_SIG: *u8 = "STALE-OFFC-ARTIFACT" 23const OI_LOG: *u8 = "knowledge/status/offc_install.log" 24const OI_ATFDCWD: i64 = 0 - 100 25 26func oi_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 27func oi_p(s: *u8) -> i64 { sys_write(1, s, oi_len(s)); return 0 } 28func oi_fp(fd: i64, s: *u8) -> i64 { sys_write(fd, s, oi_len(s)); return 0 } 29 30// out = a + b + c (NUL-terminated); returns length. One concat for every path shape. 31func oi_cat(out: *u8, a: *u8, b: *u8, c: *u8) -> i64 { 32 var o: i64 = 0 33 var i: i64 = 0 34 while a[i] != (0 as u8) { out[o] = a[i]; o = o + 1; i = i + 1 } 35 i = 0 36 while b[i] != (0 as u8) { out[o] = b[i]; o = o + 1; i = i + 1 } 37 i = 0 38 while c[i] != (0 as u8) { out[o] = c[i]; o = o + 1; i = i + 1 } 39 out[o] = 0 as u8 40 return o 41} 42func oi_offc_path(name: *u8, out: *u8) -> i64 { return oi_cat(out, "_offc/" as *u8, name, ".elf" as *u8) } 43func oi_tmp_path(name: *u8, out: *u8) -> i64 { return oi_cat(out, "/tmp/" as *u8, name, ".sov.elf" as *u8) } 44func oi_tmpinstall_path(name: *u8, out: *u8) -> i64 { return oi_cat(out, "_offc/" as *u8, name, ".elf.oitmp" as *u8) } 45 46// 1 if the two buffers differ (length OR any byte). The staleness signal. 47func oi_differ(a: *u8, alen: i64, b: *u8, blen: i64) -> i64 { 48 if alen != blen { return 1 } 49 var i: i64 = 0 50 while i < alen { if a[i] != b[i] { return 1 } i = i + 1 } 51 return 0 52} 53 54// 1 = _offc artifact is STALE vs the fresh /tmp build (or absent while /tmp exists); 0 = fresh / nothing to judge. 55func oi_stale(name: *u8) -> i64 { 56 let op: *u8 = sys_mmap(OI_MAGIC_1024); oi_offc_path(name, op) 57 let tp: *u8 = sys_mmap(OI_MAGIC_1024); oi_tmp_path(name, tp) 58 let ol: *i64 = sys_mmap(16) as *i64 59 let tl: *i64 = sys_mmap(16) as *i64 60 let tb: *u8 = sys_read_file(tp, tl) 61 if (tb as i64) == 0 { return 0 } // no fresh /tmp build -> nothing to install -> not stale 62 let ob: *u8 = sys_read_file(op, ol) 63 if (ob as i64) == 0 { return 1 } // _offc absent but /tmp exists -> never installed -> stale 64 return oi_differ(ob, ol[0], tb, tl[0]) 65} 66 67// atomically install /tmp/<name>.sov.elf -> _offc/<name>.elf (write .oitmp + renameat) + verify byte-equal. 68func oi_install(name: *u8) -> i64 { 69 let tp: *u8 = sys_mmap(OI_MAGIC_1024); oi_tmp_path(name, tp) 70 let op: *u8 = sys_mmap(OI_MAGIC_1024); oi_offc_path(name, op) 71 let xp: *u8 = sys_mmap(OI_MAGIC_1024); oi_tmpinstall_path(name, xp) 72 let tl: *i64 = sys_mmap(16) as *i64 73 let tb: *u8 = sys_read_file(tp, tl) 74 if (tb as i64) == 0 { return 0 } // nothing to install 75 let fd: i64 = sys_openat_wr(xp, 493) // 0755 (installed artifact stays executable) 76 if fd < 0 { return 0 } 77 sys_write(fd, tb, tl[0]); sys_close(fd) 78 if sys_renameat(xp, op) != 0 { return 0 } // atomic publish (same-dir rename) 79 let vl: *i64 = sys_mmap(16) as *i64 80 let vb: *u8 = sys_read_file(op, vl) // verify the install matches the build exactly 81 if (vb as i64) == 0 { return 0 } 82 if oi_differ(vb, vl[0], tb, tl[0]) == 1 { return 0 } 83 return 1 84} 85 86// FRESH-COMPILE GUARANTEE for the EXTERNAL-ORACLE gate path (LM-027). When a gate compiles buyer-runtime 87// source straight into _offc/<x>.elf and then runs it (e.g. the lang-export oracle gate: gcc lg_c.c -> 88// lg_c.elf -> ./lg_c.elf), oi_install CANNOT cover it -- there is no /tmp/<name>.sov.elf twin to diff, 89// and there is no stat/mtime syscall to detect staleness reactively. The robust PROACTIVE prevention is 90// to REMOVE the prior artifact before (re)compiling, so a stale binary can NEVER be forked: if the 91// compile then fails, the run fails LOUD instead of silently succeeding on yesterday's binary (the exact 92// trap that printed 650 for a 125 program). Returns 1 iff the artifact is absent afterwards (removed or 93// never existed = guaranteed fresh), 0 if it somehow survived. 94func oi_fresh(path: *u8) -> i64 { 95 __syscall(263, OI_ATFDCWD, path, 0, 0, 0, 0) // unlinkat(AT_FDCWD, path, 0); ENOENT is harmless 96 let l: *i64 = sys_mmap(16) as *i64 97 let b: *u8 = sys_read_file(path, l) 98 if (b as i64) == 0 { return 1 } 99 return 0 100} 101 102// file mtime in nanoseconds since epoch via sys_fstatat, or -1 if missing/unstattable. The reactive 103// freshness CHANNEL the LM-027 external-oracle gate path needs (it has no /tmp twin to byte-diff). 104func oi_mtime_ns(path: *u8) -> i64 { 105 let sb: *u8 = sys_mmap(160) // 144-byte struct stat + slack 106 if sys_fstatat(path, sb) < 0 { return 0 - 1 } 107 let secp: *i64 = (sb as i64 + 88) as *i64 // st_mtim.tv_sec 108 let nsecp: *i64 = (sb as i64 + 96) as *i64 // st_mtim.tv_nsec 109 return secp[0] * OI_MAGIC_1000000000 + nsecp[0] 110} 111 112// 1 if `artifact` is STALE vs `source` (artifact mtime strictly older than source, or artifact absent 113// while the source exists); 0 if fresh (artifact at-or-newer than source) or there is no source to be 114// stale against. The LM-027 REACTIVE detector (DISCIPLINE -> AUTO): unlike oi_stale (which needs the 115// /tmp/<name>.sov.elf twin), this works for ANY compile-then-run gate -- call it BEFORE running an 116// externally-built artifact; if stale -> recompile / fail LOUD instead of silently running yesterday's 117// binary (the exact trap that printed 650 for a 125-line program in the lang-export oracle gate). 118func oi_src_stale(artifact: *u8, source: *u8) -> i64 { 119 let sm: i64 = oi_mtime_ns(source) 120 if sm < 0 { return 0 } // no source -> cannot be stale against it 121 let am: i64 = oi_mtime_ns(artifact) 122 if am < 0 { return 1 } // source exists but artifact missing -> stale (never built) 123 if am < sm { return 1 } // artifact strictly older than source -> stale 124 return 0 125} 126 127func oi_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 128 129func main(argc: i64, argv: *i64) -> i64 { 130 if argc < 2 { 131 oi_p("nx_offc_install <organ-name> (e.g. nx_boot_run_sov) -- detect + install stale _offc artifact\n" as *u8) 132 return 1 133 } 134 let name: *u8 = argv[1] as *u8 135 let st: i64 = oi_stale(name) 136 var fixed: i64 = 0 137 if st == 1 { if oi_install(name) == 1 { fixed = 1 } } 138 139 let lf: i64 = sys_openat_append(OI_LOG, 420) 140 if st == 1 { 141 // diagnostic carries the recall signature so the Doctor's ki_recall (LM-026) routes here. 142 oi_p("OFFC-INSTALL " as *u8); oi_p(OI_SIG); oi_p(" name=" as *u8); oi_p(name); oi_p(" installed=" as *u8); oi_wn(1, fixed); oi_p("\n" as *u8) 143 if lf >= 0 { oi_fp(lf, "OFFC-INSTALL " as *u8); oi_fp(lf, OI_SIG); oi_fp(lf, " name=" as *u8); oi_fp(lf, name); oi_fp(lf, " installed=" as *u8); oi_wn(lf, fixed); oi_fp(lf, "\n" as *u8); sys_close(lf) } 144 if fixed == 1 { return 0 } 145 return 1 146 } 147 oi_p("OFFC-INSTALL fresh name=" as *u8); oi_p(name); oi_p(" (no install needed)\n" as *u8) 148 if lf >= 0 { oi_fp(lf, "OFFC-INSTALL fresh name=" as *u8); oi_fp(lf, name); oi_fp(lf, "\n" as *u8); sys_close(lf) } 149 return 0 150}