nx_orchestrate_raci_recordfail_t52.nx source

1// nx_orchestrate_raci.nx -- ORCHESTRATION rung 3: the CONDUCTOR / the "call the API, it calls the team, 2// the team runs the workstream" engine (operator 2026-07-10: "standard mcp apis so that we call the apis 3// that call the teams that run the workstreams ... true orchestration like an orchestra ... key for 4// autonomous capabilities"). 5// 6// ---- seq1789: WHY THIS FILE WAS RENAMED (restored capability, do not undo) -------------------------- 7// This organ was `runtime/nx_orchestrate.nx`. A deduplication pass matched it against a COMPLETELY 8// DIFFERENT organ that happened to share the filename -- `runtime/_hdl_build/nx_orchestrate.nx`, the 9// wait-for-opening DEPLOY QUEUE POLLER -- and retired this one to `.dupe-reconciled`. They are not 10// duplicates: one resolves RACI and engages a team, the other polls a deploy queue. Nothing in their 11// CONTENT is shared; only the name was. 12// What that cost, measured 2026-07-30: nx_orchestrate_gate could no longer compile (expand_imports 13// failed), so it kept running its STALE binary -- which HANGS after two checks. That hang propagated: 14// nx_swcompare_evidence forks its domain gates with no deadline, so `librarian` never returned at all and 15// the failure surfaced as an MCP transport error, blaming the network for a retired source file. 16// LAW: A DEDUPLICATOR THAT MATCHES ON NAME RETIRES CAPABILITY, NOT DUPLICATION. Sameness is a property 17// of CONTENT; a filename is a label someone chose twice. Same family as the substring/role confusion in 18// md_promote_deny -- identity inferred from a name instead of read from the thing itself. 19// The name is now distinct from the poller's, so the collision cannot recur rather than being remembered. 20// 21// Given an ACTIVITY (workstream), this organ: 22// (1) RESOLVES its RACI from the sovereign RACI store -- the ONE Accountable role, the Responsible 23// role(s), Consulted, Informed. NEVER fabricates: an activity with no Accountable row -> DENY 24// (returns -1), so the orchestra cannot engage a role that does not own the work. 25// (2) BINDS the runnable workstream ORGAN from knowledge/orchestration/workstreams.conf (activity<TAB>organ). 26// (3) RECORDS the engagement durably on the seg-store (orchestration- prefix) -- who was engaged, what ran. 27// (4) DISPATCHES: forks _offc/nx_sov_build_run.elf <organ> and wait4s it = the team actually runs the 28// workstream (only with the run flag; resolve/plan is side-effect-free). 29// license_tier: ORIGINAL 30import "nx_syscalls.nx" 31import "nx_estate_path.nx" 32import "nx_raci_sov.nx" 33import "nx_seg_store.nx" 34const OR_MAGIC_131072: i64 = 131072 35const OR_MAGIC_16384: i64 = 16384 36 37// OR_RACI retired 2026-07-16: RACI reads from the sovereign store (raci_read_all) 38const OR_WS: *u8 = "knowledge/orchestration/workstreams.conf" 39const OR_STORE:*u8 = "/dev/null/nishi-recordfail-control-" 40 41func or_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 42func or_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){d[o]=s[i];o=o+1;i=i+1} d[o]=0 as u8; return o } 43func or_w(s: *u8) -> i64 { sys_write(1, s, or_slen(s)); return 0 } 44func or_eq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8){ if a[i]!=b[i]{return 0} i=i+1 } if b[i]!=(0 as u8){return 0} return 1 } 45func or_read(path: *u8, buf: *u8, cap: i64) -> i64 { 46 let fd: i64 = sys_openat_rd(path); if fd<0 { return 0 } 47 var n: i64=0; var r: i64=sys_read(fd, buf, cap-1) 48 while r>0 { n=n+r; if n>=cap-1 { r=0 } else { r=sys_read(fd, buf+n, cap-1-n) } } 49 sys_close(fd); buf[n]=0 as u8; return n 50} 51// field col (0-based, TAB-delimited) of line [ls,le) into dst (NUL-term); returns len. 52func or_field(buf: *u8, ls: i64, le: i64, col: i64, dst: *u8) -> i64 { 53 var c: i64=0; var p: i64=ls; var k: i64=0 54 while p<le { 55 if buf[p]==(9 as u8) { if c==col { dst[k]=0 as u8; return k } c=c+1; if c==col { k=0 } } 56 else { if c==col { if buf[p]!=(13 as u8) { dst[k]=buf[p]; k=k+1 } } } 57 p=p+1 58 } 59 dst[k]=0 as u8; return k 60} 61func or_has_letter(letters: *u8, L: u8) -> i64 { var i: i64=0; while letters[i]!=(0 as u8){ if letters[i]==L { return 1 } i=i+1 } return 0 } 62 63// Resolve every role for ACTIVITY whose RACI letters include L (A/R/C/I) -> comma-joined into out. returns count. 64func orch_roles(activity: *u8, L: u8, out: *u8) -> i64 { 65 let buf: *u8 = sys_mmap(OR_MAGIC_131072); let n: i64 = raci_read_all(buf, OR_MAGIC_131072) 66 let role: *u8 = sys_mmap(64); let act: *u8 = sys_mmap(64); let let3: *u8 = sys_mmap(16) 67 var o: i64 = 0; var cnt: i64 = 0 68 var ls: i64=0; var i: i64=0 69 while i<=n { 70 var eol: i64=0 71 if i==n { eol=1 } else { if buf[i]==(10 as u8) { eol=1 } } 72 if eol==1 { 73 if i>ls { if buf[ls]!=(35 as u8) { 74 or_field(buf, ls, i, 0, role) 75 or_field(buf, ls, i, 1, act) 76 or_field(buf, ls, i, 2, let3) 77 if or_eq(act, activity)==1 { if or_has_letter(let3, L)==1 { 78 if cnt>0 { out[o]=44 as u8; o=o+1 } 79 var j: i64=0; while role[j]!=(0 as u8){ out[o]=role[j]; o=o+1; j=j+1 } 80 cnt=cnt+1 81 } } 82 } } 83 ls=i+1 84 } 85 i=i+1 86 } 87 out[o]=0 as u8 88 return cnt 89} 90// the ONE Accountable role for activity into out; returns 1 found / 0 none (DENY: never fabricate). 91func orch_accountable(activity: *u8, out: *u8) -> i64 { 92 let tmp: *u8 = sys_mmap(256) 93 let c: i64 = orch_roles(activity, 65 as u8, tmp) 94 if c < 1 { out[0]=0 as u8; return 0 } 95 var i: i64=0; while tmp[i]!=(0 as u8){ if tmp[i]==(44 as u8) { out[i]=0 as u8; return 1 } out[i]=tmp[i]; i=i+1 } out[i]=0 as u8 96 return 1 97} 98// runnable organ bound to activity from workstreams.conf into out; returns 1 found / 0 none. 99func orch_organ(activity: *u8, out: *u8) -> i64 { 100 let buf: *u8 = sys_mmap(OR_MAGIC_16384); let n: i64 = or_read(OR_WS, buf, OR_MAGIC_16384) 101 let act: *u8 = sys_mmap(64) 102 var ls: i64=0; var i: i64=0 103 while i<=n { 104 var eol: i64=0 105 if i==n { eol=1 } else { if buf[i]==(10 as u8) { eol=1 } } 106 if eol==1 { 107 if i>ls { if buf[ls]!=(35 as u8) { 108 or_field(buf, ls, i, 0, act) 109 if or_eq(act, activity)==1 { or_field(buf, ls, i, 1, out); return 1 } 110 } } 111 ls=i+1 112 } 113 i=i+1 114 } 115 out[0]=0 as u8; return 0 116} 117// record the engagement durably on the seg-store. 118func orch_record(activity: *u8, acct: *u8, organ: *u8, verdict: *u8) -> i64 { 119 let key: *u8 = sys_mmap(128); var ko: i64 = or_cat(key, 0, "orch:engage:" as *u8); or_cat(key, ko, activity) 120 let val: *u8 = sys_mmap(512); var o: i64 = 0 121 o = or_cat(val, o, "activity="); o = or_cat(val, o, activity) 122 o = or_cat(val, o, "|accountable="); o = or_cat(val, o, acct) 123 o = or_cat(val, o, "|organ="); o = or_cat(val, o, organ) 124 o = or_cat(val, o, "|verdict="); o = or_cat(val, o, verdict) 125 val[o]=0 as u8 126 let w: *i64 = ss_begin() 127 if ss_add(w, 1, key, val, o) != 0 { return 0-1 } 128 if ss_commit(OR_STORE, w, sys_now_us()) != 0 { return 0-2 } 129 return 0 130} 131// DISPATCH: fork+exec `_offc/nx_sov_build_run.elf <organ>` and wait; returns child exit code, or -1 on fork fail. 132func orch_dispatch(organ: *u8) -> i64 { 133 let pid: i64 = sys_fork() 134 if pid < 0 { return 0-1 } 135 if pid == 0 { 136 let argv: *i64 = sys_mmap(64) as *i64 137 argv[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64 138 argv[1] = organ as i64 139 argv[2] = 0 140 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0 141 sys_execve("_offc/nx_sov_build_run.elf" as *u8, argv, envp) 142 sys_exit(127) 143 } 144 let st: *i64 = sys_mmap(16) as *i64 145 let waited: i64 = sys_wait4(pid, st, 0) 146 if waited != pid { return -1 } 147 return wait_status_rc(st[0]) 148} 149 150// ORCHESTRATE one activity. do_run: 0 = resolve+plan+record only; 1 = also dispatch the workstream. 151// returns 1 GREEN (engaged; if run, workstream exit 0) / 0 workstream-nonzero / -1 DENY (no accountable role). 152func orch_engage(activity: *u8, do_run: i64) -> i64 { 153 let acct: *u8 = sys_mmap(128) 154 if orch_accountable(activity, acct) == 0 { 155 or_w("ORCHESTRATE deny activity="); or_w(activity); or_w(" reason=no-accountable-role (not in the RACI SSOT)\n" as *u8) 156 return 0-1 157 } 158 let resp: *u8 = sys_mmap(256); orch_roles(activity, 82 as u8, resp) 159 let cons: *u8 = sys_mmap(256); orch_roles(activity, 67 as u8, cons) 160 let inf: *u8 = sys_mmap(256); orch_roles(activity, 73 as u8, inf) 161 let organ: *u8 = sys_mmap(128); let hasorgan: i64 = orch_organ(activity, organ) 162 or_w("ORCHESTRATE activity="); or_w(activity) 163 or_w("\n Accountable="); or_w(acct) 164 or_w(" Responsible="); or_w(resp) 165 or_w("\n Consulted="); or_w(cons) 166 or_w(" Informed="); or_w(inf) 167 or_w("\n workstream-organ="); if hasorgan==1 { or_w(organ) } else { or_w("(none bound)" as *u8) } 168 or_w("\n" as *u8) 169 var verdict: *u8 = "PLANNED" as *u8 170 var rc: i64 = 1 171 if do_run == 1 && hasorgan == 0 { 172 verdict = "NOT-RUN-UNBOUND"; rc = 0 173 or_w(" reason=no-workstream-bound next=bind-qualified-workstream\n") 174 } 175 if do_run == 1 { if hasorgan == 1 { 176 or_w(" DISPATCHING -> the "); or_w(acct); or_w(" team runs "); or_w(organ); or_w("...\n" as *u8) 177 let ex: i64 = orch_dispatch(organ) 178 if ex == 0 { verdict = "RAN-GREEN" as *u8 } else { verdict = "RAN-NONZERO" as *u8; rc = 0 } 179 } } 180 let recorded: i64 = orch_record(activity, acct, organ, verdict) 181 or_w(" verdict="); or_w(verdict) 182 if recorded != 0 { 183 or_w(" evidence=write-failed next=repair-engagement-store\n") 184 return -2 185 } 186 or_w(" (engagement recorded on the seg-store)\n" as *u8) 187 return rc 188} 189 190func main(argc: i64, argv: *i64) -> i64 { 191 if argc < 2 { 192 or_w("usage: nx_orchestrate_raci <activity> [run] (activity from the RACI store: research organize curate verify redteam ...)\n" as *u8) 193 return 1 194 } 195 if ep_anchor() < 0 { or_w("ORCHESTRATE unavailable reason=estate-context-unresolved\n"); return 3 } 196 let activity: *u8 = argv[1] as *u8 197 var do_run: i64 = 0 198 if argc >= 3 { if or_eq(argv[2] as *u8, "run" as *u8)==1 { do_run=1 } } 199 let r: i64 = orch_engage(activity, do_run) 200 if r != 1 { return 1 } 201 return 0 202}