nx_plan_run.nx source

1// nx_plan_run.nx -- WORKFLOWS-AS-DATA: the sovereign plan executor (operator 2026-07-18: "i still 2// see scratchpadding not via nishi... get what you are doing outside of it in mcp and api and 3// workflow"). Kills the session-side shell-script orchestration class: a PLAN is rows in a plane 4// (seeded via the MCP-live nx_store_put), and ONE cap-gated tools/call executes the whole sequence 5// SERVER-SIDE, recording per-step results to a results plane (provenance in the plane, as always). 6// nx_plan_run <planid> [allowlist] [planprefix] [resultsprefix] 7// plan rows : knowledge/store/plan-<id>- seq<TAB>tool<TAB>arg... (executed in seq order) 8// results rows: knowledge/store/planrun-<id>- seq<TAB>tool<TAB>rc<TAB>output-snippet 9// SECURITY = the tools-plane model, no escalation: each step's tool MUST be a GREEN row in 10// tool_allowlist.conf; a row's PINNED args override plan args (fixed-arg pinning, caller args 11// ignored); unknown tool -> REFUSED fail-closed; a failing step STOPS the plan (later steps never 12// run) with the failure recorded. nx_plan_run itself is cap-gated on the tools plane. 13// license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0 14import "nx_store_seed_lib.nx" 15import "nx_seg_store.nx" 16import "nx_deploy_lib.nx" 17import "nx_syscalls.nx" 18import "nx_heavyio_lib.nx" // the estate-wide heavy-I/O concurrency bound (2026-09-03): a plan run fans out seg-store writes, so it asks BEFORE it starts 19 20const PR_CAP: i64 = 1048576 21const PR_NL: i64 = 10 22const PR_TAB: i64 = 9 23const PR_SP: i64 = 32 24const PR_MAXCOL: i64 = 16 25const PR_PAIR: i64 = 2 26const PR_SPB: i64 = 256 27const PR_MAXSTEP: i64 = 64 28const PR_MAXARG: i64 = 12 29const PR_ARENA: i64 = 65536 30const PR_PFXCAP: i64 = 256 31// ★200 -> 2000 (2026-07-30, ws=neuro). A 200-byte snippet is SMALLER THAN THE SUMMARY MANY ORGANS PRINT, 32// so the results plane silently reported only a tool's header and dropped its actual finding: nx_meshprofile 33// emits a DELIBERATE SHORTLIST (top-12 radius jumps, the whole point of the organ) and the plane carried only 34// the DIAG line, making the step unreadable while still recording rc=0. A results row that cannot hold the 35// result is a green light with the answer cut off. BOUNDED BY CONSTRUCTION, not by hope: res is mmap'd at 36// PR_CAP (1 MiB) and steps are capped at PR_MAXSTEP (64), so the worst case is 64*~2050 = ~131 KB, an eighth 37// of the arena. Raise PR_CAP first if PR_MAXSTEP ever grows. 38const PR_SNIP: i64 = 2000 39const PR_OUTCAP: i64 = 65536 40const PR_STDERR: i64 = 2 41const PR_EXIT_USAGE: i64 = 2 42const PR_EXIT_IO: i64 = 1 43const PR_EXIT_REFUSED: i64 = 4 44const PR_EXIT_STEPFAIL: i64 = 5 45const PR_ZERO: i64 = 48 46const PR_NINE: i64 = 57 47const PR_B10: i64 = 10 48 49func pr_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 50func pr_werr(s: *u8) -> i64 { sys_write(PR_STDERR, s, pr_slen(s)); return 0 } 51func pr_cols(q: *u8, ls: i64, le: i64, sp: *i64) -> i64 { 52 var c: i64 = 0 53 var p: i64 = ls 54 while c < PR_MAXCOL { 55 var e: i64 = p 56 var s: i64 = 1 57 while s == 1 { if e >= le { s = 0 } else { if q[e] == (PR_TAB as u8) { s = 0 } else { e = e + 1 } } } 58 sp[c*PR_PAIR] = p 59 sp[c*PR_PAIR+1] = e 60 c = c + 1 61 if e >= le { return c } 62 p = e + 1 63 } 64 return c 65} 66func pr_slice_int(q: *u8, a: i64, b: i64) -> i64 { 67 var v: i64 = 0 68 var i: i64 = a 69 while i < b { let c: i64 = q[i]; if c >= PR_ZERO { if c <= PR_NINE { v = v * PR_B10 + (c - PR_ZERO) } } i = i + 1 } 70 return v 71} 72func pr_slice_eq(q: *u8, a: i64, b: i64, r: *u8, c: i64, d: i64) -> i64 { 73 if b - a != d - c { return 0 } 74 var i: i64 = 0 75 while a + i < b { if q[a+i] != r[c+i] { return 0 } i = i + 1 } 76 return 1 77} 78// copy slice into arena as a NUL-terminated C-string; returns its address, bumps off 79func pr_cstr(arena: *u8, off: *i64, q: *u8, a: i64, b: i64) -> i64 { 80 let base: i64 = off[0] 81 var i: i64 = a 82 var o: i64 = base 83 while i < b { arena[o] = q[i]; o = o + 1; i = i + 1 } 84 arena[o] = 0 as u8 85 off[0] = o + 1 86 return (arena as i64) + base 87} 88// find tool (slice) in allowlist buf; fill elfp[0]=elf cstr addr; pinned args into av[0..], returns nargs (-1 not found) 89func pr_find_tool(al: *u8, n: i64, q: *u8, ta: i64, tb: i64, arena: *u8, off: *i64, elfp: *i64, av: *i64) -> i64 { 90 let sp: *i64 = sys_mmap(PR_SPB) as *i64 91 var i: i64 = 0 92 while i < n { 93 var le: i64 = i 94 var s: i64 = 1 95 while s == 1 { if le >= n { s = 0 } else { if al[le] == (PR_NL as u8) { s = 0 } else { le = le + 1 } } } 96 if le > i { 97 let nc: i64 = pr_cols(al, i, le, sp) 98 if nc >= 3 { 99 if pr_slice_eq(al, sp[0], sp[1], q, ta, tb) == 1 { 100 elfp[0] = pr_cstr(arena, off, al, sp[2], sp[3]) 101 var na: i64 = 0 102 if nc >= 4 { 103 // pinned args col: split on spaces 104 var p: i64 = sp[6] 105 let pe: i64 = sp[7] 106 while p < pe { 107 var e2: i64 = p 108 var s2: i64 = 1 109 while s2 == 1 { if e2 >= pe { s2 = 0 } else { if al[e2] == (PR_SP as u8) { s2 = 0 } else { e2 = e2 + 1 } } } 110 if e2 > p { if na < PR_MAXARG { av[na] = pr_cstr(arena, off, al, p, e2); na = na + 1 } } 111 p = e2 + 1 112 } 113 } 114 return na 115 } 116 } 117 } 118 i = le + 1 119 } 120 return 0 - 1 121} 122// sanitize outfile content into a snippet: tabs/newlines -> spaces, cap PR_SNIP 123func pr_snip(dst: *u8, o: i64, src: *u8, n: i64) -> i64 { 124 var m: i64 = n 125 if m > PR_SNIP { m = PR_SNIP } 126 var oo: i64 = o 127 var i: i64 = 0 128 while i < m { 129 var c: i64 = src[i] 130 if c == PR_TAB { c = PR_SP } 131 if c == PR_NL { c = PR_SP } 132 if c < PR_SP { c = PR_SP } 133 dst[oo] = c as u8 134 oo = oo + 1 135 i = i + 1 136 } 137 return oo 138} 139 140func main(argc: i64, argv: *i64) -> i64 { 141 if argc < 2 { pr_werr("usage: nx_plan_run <planid> [allowlist] [planprefix] [resultsprefix]\n" as *u8); sys_exit(PR_EXIT_USAGE); return PR_EXIT_USAGE } 142 let planid: *u8 = argv[1] as *u8 143 // HEAVY-I/O BOUND (2026-09-03): a plan run fans out seg-store writes across its steps, so it asks the estate-wide 144 // concurrency bound BEFORE it starts. DEFER is this organ's own REFUSED code (PR_EXIT_REFUSED): the relay requeues 145 // the plan and it fires on the next pass. UNOBSERVABLE proceeds, announced. 146 let hio: *i64 = sys_mmap(32) as *i64 147 let hv: i64 = hio_admit(hio) 148 hio_announce(1, hv, hio) 149 if hv == HIO_DEFER { pr_werr("PLAN-RUN DEFERRED: heavy-I/O bound reached; requeue and re-fire\n" as *u8); sys_exit(PR_EXIT_REFUSED); return PR_EXIT_REFUSED } 150 var alpath: *u8 = "tool_allowlist.conf" as *u8 151 if argc > 2 { alpath = argv[2] as *u8 } 152 let ppfx: *u8 = sys_mmap(PR_PFXCAP) 153 let rpfx: *u8 = sys_mmap(PR_PFXCAP) 154 if argc > 3 { 155 let p3: *u8 = argv[3] as *u8 156 var i0: i64 = 0 157 while p3[i0] != (0 as u8) { ppfx[i0] = p3[i0]; i0 = i0 + 1 } 158 ppfx[i0] = 0 as u8 159 } else { 160 var o1: i64 = ss_cat(ppfx, 0, "knowledge/store/plan-" as *u8) 161 o1 = ss_cat(ppfx, o1, planid) 162 o1 = ss_cat(ppfx, o1, "-" as *u8) 163 ppfx[o1] = 0 as u8 164 } 165 if argc > 4 { 166 let p4: *u8 = argv[4] as *u8 167 var i1: i64 = 0 168 while p4[i1] != (0 as u8) { rpfx[i1] = p4[i1]; i1 = i1 + 1 } 169 rpfx[i1] = 0 as u8 170 } else { 171 var o2: i64 = ss_cat(rpfx, 0, "knowledge/store/planrun-" as *u8) 172 o2 = ss_cat(rpfx, o2, planid) 173 o2 = ss_cat(rpfx, o2, "-" as *u8) 174 rpfx[o2] = 0 as u8 175 } 176 177 let plan: *u8 = sys_mmap(PR_CAP) 178 let pn: i64 = sts_load(ppfx, plan, PR_CAP) 179 if pn <= 0 { pr_werr("plan plane EMPTY / unseeded (fail-closed)\n" as *u8); sys_exit(PR_EXIT_IO); return PR_EXIT_IO } 180 let al: *u8 = sys_mmap(PR_CAP) 181 let an: i64 = dp_read(alpath, al, PR_CAP - 4) 182 if an <= 0 { pr_werr("allowlist unreadable (fail-closed)\n" as *u8); sys_exit(PR_EXIT_IO); return PR_EXIT_IO } 183 184 // collect step line spans + seqs 185 let lss: *i64 = sys_mmap(PR_MAXSTEP*8) as *i64 186 let les: *i64 = sys_mmap(PR_MAXSTEP*8) as *i64 187 let sqs: *i64 = sys_mmap(PR_MAXSTEP*8) as *i64 188 let sp: *i64 = sys_mmap(PR_SPB) as *i64 189 var nstep: i64 = 0 190 var i: i64 = 0 191 while i < pn { 192 var le: i64 = i 193 var s: i64 = 1 194 while s == 1 { if le >= pn { s = 0 } else { if plan[le] == (PR_NL as u8) { s = 0 } else { le = le + 1 } } } 195 if le > i { if nstep < PR_MAXSTEP { 196 let nc: i64 = pr_cols(plan, i, le, sp) 197 if nc >= 2 { 198 lss[nstep] = i 199 les[nstep] = le 200 sqs[nstep] = pr_slice_int(plan, sp[0], sp[1]) 201 nstep = nstep + 1 202 } 203 } } 204 i = le + 1 205 } 206 // insertion sort by seq 207 var a: i64 = 1 208 while a < nstep { 209 var b: i64 = a 210 while b > 0 { 211 if sqs[b-1] > sqs[b] { 212 let t0: i64 = sqs[b-1] 213 sqs[b-1] = sqs[b] 214 sqs[b] = t0 215 let t1: i64 = lss[b-1] 216 lss[b-1] = lss[b] 217 lss[b] = t1 218 let t2: i64 = les[b-1] 219 les[b-1] = les[b] 220 les[b] = t2 221 b = b - 1 222 } else { b = 0 } 223 } 224 a = a + 1 225 } 226 227 let arena: *u8 = sys_mmap(PR_ARENA) 228 let aoff: *i64 = sys_mmap(16) as *i64 229 let res: *u8 = sys_mmap(PR_CAP) 230 let outbuf: *u8 = sys_mmap(PR_OUTCAP) 231 let elfp: *i64 = sys_mmap(16) as *i64 232 let av: *i64 = sys_mmap((PR_MAXARG+2)*8) as *i64 233 let outfile: *u8 = "/tmp/nx_plan_step.out" as *u8 234 var ro: i64 = 0 235 var k: i64 = 0 236 var failed: i64 = 0 237 while k < nstep { 238 if failed == 0 { 239 aoff[0] = 0 240 let nc2: i64 = pr_cols(plan, lss[k], les[k], sp) 241 // resolve tool (col1) in allowlist 242 var na: i64 = pr_find_tool(al, an, plan, sp[2], sp[3], arena, aoff, elfp, av) 243 if na < 0 { 244 ro = ss_catn(res, ro, sqs[k]) 245 res[ro] = PR_TAB as u8 246 ro = ro + 1 247 var rr: i64 = ro 248 rr = pr_snip(res, rr, "REFUSED-unknown-tool" as *u8, 20) 249 ro = rr 250 res[ro] = PR_NL as u8 251 ro = ro + 1 252 failed = PR_EXIT_REFUSED 253 } else { 254 if na == 0 { 255 // no pinned args -> plan cols 2.. are the argv 256 var c: i64 = 2 257 while c < nc2 { 258 if na < PR_MAXARG { av[na] = pr_cstr(arena, aoff, plan, sp[c*PR_PAIR], sp[c*PR_PAIR+1]); na = na + 1 } 259 c = c + 1 260 } 261 } 262 let rc: i64 = dep_run_capture(elfp[0] as *u8, av, na, outfile) 263 let on: i64 = dp_read(outfile, outbuf, PR_OUTCAP - 4) 264 ro = ss_catn(res, ro, sqs[k]) 265 res[ro] = PR_TAB as u8 266 ro = ro + 1 267 ro = ss_cat(res, ro, "rc=" as *u8) 268 ro = ss_catn(res, ro, rc) 269 res[ro] = PR_TAB as u8 270 ro = ro + 1 271 var on2: i64 = on 272 if on2 < 0 { on2 = 0 } 273 ro = pr_snip(res, ro, outbuf, on2) 274 res[ro] = PR_NL as u8 275 ro = ro + 1 276 if rc != 0 { failed = PR_EXIT_STEPFAIL } 277 } 278 } 279 k = k + 1 280 } 281 if sts_seed(rpfx, res, ro) < 0 { pr_werr("results commit error\n" as *u8); sys_exit(PR_EXIT_IO); return PR_EXIT_IO } 282 let msg: *u8 = sys_mmap(PR_PFXCAP) 283 var mo: i64 = ss_cat(msg, 0, "PLAN " as *u8) 284 mo = ss_cat(msg, mo, planid) 285 mo = ss_cat(msg, mo, " steps=" as *u8) 286 mo = ss_catn(msg, mo, nstep) 287 if failed != 0 { mo = ss_cat(msg, mo, " FAILED (stopped fail-closed, results recorded)" as *u8) } else { mo = ss_cat(msg, mo, " ok" as *u8) } 288 msg[mo] = PR_NL as u8 289 mo = mo + 1 290 // RELAY THE STEP ROWS TO STDOUT BEFORE THE PLAN LINE (2026-09-02). Every step's `<seq>\trc=<rc>\t<snippet>` 291 // row was committed to the planrun plane and NEVER written to this process's own stdout, so a caller 292 // that captures this runner (nx_orchestrate's fire path) saw only `PLAN ... FAILED` and could not tell 293 // an admission refusal from a compile failure. MEASURED the day this landed: the orchestrator's 294 // oc_runner_refused keys on the runner literal `REFUSED-BUILD-ADMIT` in its capture, the literal sat in 295 // the plane row and nowhere else, so three of four fires in one headroom pass were marked fired-rc5 296 // and FORGOTTEN by the queue that exists to remember them (requeued=0). The rows are bounded (PR_SNIP 297 // per step) and the PLAN line stays LAST, so a positional last-line reader is unchanged. 298 sys_write(1, res, ro) 299 sys_write(1, msg, mo) 300 if failed != 0 { sys_exit(failed); return failed } 301 sys_exit(0) 302 return 0 303}