nx_pm_sclass_deploy.nx source

1// nx_pm_sclass_deploy.nx -- the PM logs the PROPER S-class-EXCEED assignments for sovereign hosting 2// deployment (operator: "s-class-exceed assignments, not hacks or shortcuts"). Explicitly REJECTS the 3// shortcut of leaning on the legacy nishi_supervisor.sh; each assignment has a measurable gate that a hack 4// would fail. Composes the PM engine. license_tier: ORIGINAL 5import "nx_pm_review_log.nx" 6import "nx_syscalls.nx" 7 8func sd_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 9 10func main() -> i64 { 11 sd_puts("=== PM: PROPER S-class-EXCEED sovereign-deploy assignments (no hacks; each has a gate) ===\n\n" as *u8) 12 sd_puts("REJECTED shortcut: 'let nishi_supervisor.sh respawn the new daemon' -- that keeps a .sh in the\n" as *u8) 13 sd_puts(" hosting path. NOT S-class. The sovereign supervisor must OWN the lifecycle.\n\n" as *u8) 14 15 let fd: i64 = sys_openat_append("/tmp/nishi_pm_plan.log" as *u8, 0x1a4) 16 let pm: i64 = pm_open("/tmp/nishi_pm_review.log" as *u8) 17 pm_w(fd, "\n# S-CLASS SOVEREIGN DEPLOY assignments 2026-06-06 (no hacks; gated)\n" as *u8) 18 19 sd_puts("A1 Sovereign supervisor PROPERLY launched (retire nishi_supervisor.sh AND its boot hook)\n" as *u8) 20 sd_puts(" nx_hostctl supervise becomes the init-launched owner of sites.elf (spawn/monitor/respawn,\n" as *u8) 21 sd_puts(" pure syscalls). Launch via the OS boot mechanism (rc.d/scheduled-at-boot), NOT an ad-hoc\n" as *u8) 22 sd_puts(" ssh setsid (which is why takeover did not persist). Tutor: the detached-launch + reboot path.\n" as *u8) 23 sd_puts(" GATE (a hack fails these): survives a NAS reboot (comes back on :8443); respawns within\n" as *u8) 24 sd_puts(" <=2s after a crash; nishi_supervisor.sh is GONE from the boot hook (grep proves it).\n\n" as *u8) 25 pm_w(fd, "A1 sovereign supervisor init-launched (retire .sh + boot hook) GATE=reboot+crash-respawn+no-sh status=ASSIGNED\n" as *u8) 26 pm_flag(pm, "ASSIGN" as *u8, "deploy/supervisor" as *u8, "S-CLASS-NO-HACK" as *u8, 27 "sovereign supervisor owns lifecycle, init-launched, .sh retired" as *u8, 28 "gate: survives reboot + <=2s crash-respawn + boot hook has NO nishi_supervisor.sh" as *u8) 29 30 sd_puts("A2 Sovereign reload signal (deploy -> supervisor) -- NOT ssh-exec-launch-a-daemon\n" as *u8) 31 sd_puts(" deploy = stream (sovereign SSH, flow-control DONE) + atomic sys_renameat publish + drop a\n" as *u8) 32 sd_puts(" reload marker; the RUNNING supervisor detects it and restarts the daemon on the new binary.\n" as *u8) 33 sd_puts(" GATE: a content push is live next request with NO restart; a binary push swaps with the\n" as *u8) 34 sd_puts(" supervisor already running (no fresh ssh daemon-launch in the deploy path).\n\n" as *u8) 35 pm_w(fd, "A2 sovereign reload-signal deploy (no ssh-exec daemon launch) GATE=content-hot + binary-swap-via-running-supervisor status=ASSIGNED\n" as *u8) 36 pm_flag(pm, "ASSIGN" as *u8, "deploy/reload" as *u8, "S-CLASS-NO-HACK" as *u8, 37 "deploy signals the running supervisor (marker), no ssh-launched daemon" as *u8, 38 "gate: content hot (no restart); binary swap via the already-running sovereign supervisor" as *u8) 39 40 sd_puts("A3 EXCEED crown: FD-passing (SCM_RIGHTS) zero-downtime daemon hot-swap\n" as *u8) 41 sd_puts(" new binary inherits the listening socket; new listens before old drains -> ZERO dropped\n" as *u8) 42 sd_puts(" connections (beats nginx/Caddy drain-only). GATE: a load generator sees 0 dropped reqs across a swap.\n\n" as *u8) 43 // 2026-08-21: the MECHANISM half of A3 is built and proven; the ADOPTION half is not, and the 44 // status says so rather than rounding one to the other. sys_sendmsg/sys_recvmsg/sys_send_fd/ 45 // sys_recv_fd landed in the shim (offsets read from the platform headers, not recalled), and 46 // ts_handoff_nodrop in nx_http_server acquires a listener from an owner instead of binding. 47 // MEASURED by nx_ts_handoff_gate against the pre-declared accept rule, in DROPPED CONNECTIONS 48 // counted by the client and not by any daemon's log: handoff arm 17 attempted / 17 served / 49 // ZERO drops with the in-gap arrival connecting cleanly, neg-control on today's 50 // bind-per-process path 17 attempted / 1 drop / in-gap arrival refused ECONNREFUSED. 51 // NOT YET EARNED, and named so nobody reads this row as finished: the gate drives a SYNTHETIC 52 // STREAM, not the load generator this row's own wording asks for, so the structural property is 53 // proven and the failure RATE is not; and NO SERVING DAEMON CALLS ts_handoff_nodrop yet. 54 pm_w(fd, "A3 FD-passing zero-downtime hot-swap (SCM_RIGHTS) GATE=0-dropped-conns-across-swap status=MECHANISM-PROVEN-ADOPTION-OPEN (EXCEED)\n" as *u8) 55 pm_flag(pm, "ASSIGN" as *u8, "deploy/zero-downtime" as *u8, "S-CLASS-EXCEED" as *u8, 56 "FD-passing SCM_RIGHTS hot-swap (new-listens-before-old-drains) -- mechanism PROVEN 2026-08-21, adoption by a serving daemon still OPEN" as *u8, 57 "gate: nx_ts_handoff_gate measured 0 dropped connections across a real process swap; a LOAD GENERATOR run is still owed for the rate claim" as *u8) 58 59 sd_puts("STANDING (already triggered): W1 SSH s-class-exceed + comprehensive OpenSSH benchmark; W2 compiler\n" as *u8) 60 sd_puts("regalloc quadratic->linear (sovereign builds in seconds). Both gated on MEASURED numbers vs the incumbent.\n\n" as *u8) 61 sys_close(fd); sys_close(pm) 62 63 sd_puts(">>> Team works A1->A2->A3 (proper, gated); Claude tutors the init-launch + FD-passing; Auditor grades.\n" as *u8) 64 sd_puts(">>> A hack (lean on .sh, ssh-launch-a-daemon) FAILS the reboot/0-drop gates -- so it cannot pass as S-class.\n" as *u8) 65 sys_exit(0); return 0 66}