nx_promotestale.nx source
↩ module page · 224 lines · 10643 B
1// nx_promotestale.nx -- IS THE BINARY WE ARE SERVING THE ONE THE LAST BUILD PRODUCED?
2//
3// WHY IT EXISTS, MEASURED 2026-08-14: two organs were found SERVING STALE CODE purely because a human
4// happened to notice nx_catalog's BUILT and PROMOTED columns disagree -- nx_vizsla_digest (47,402 served
5// vs 47,596 built) and nx_vizsla_plan (176,882 served vs 217,561 built: ~40 KB, a FIFTH of the organ,
6// missing from the running binary). Both were invisible to every health check the estate runs, because
7// nothing compares those two numbers across the fleet.
8// -- A RUNNING BINARY THAT IS NOT WHAT ITS SOURCE BUILT IS A SILENT CORRECTNESS AND SECURITY DEFECT:
9// every fix, every audit and every gate verdict describes code that is not the code being executed.
10// -- SPOTTING IT BY EYE DOES NOT SCALE. nx_catalog answers this one NAME at a time; this sweeps.
11//
12// nx_promotestale [registry] [buildroot]
13//
14// THE UNIT IS THE BINARY, NOT THE REGISTRY ROW. Several names legitimately share one elf (nx_status and
15// nx_torstat both point at nx_hostctl; nx_services/nx_health/nx_mgmt all at nx_mgmt_call.elf), so
16// counting rows would INFLATE the population and report one stale binary as three.
17//
18// CLASSES -- a PARTITION whose parts are printed and MUST sum:
19// IDENTICAL served bytes == built bytes -> what we run is what we built
20// STALE both exist and DIFFER -> THE WORKLIST; the served code is not the build
21// NO-BUILD no build artifact to compare against -> CANNOT JUDGE, never folded into IDENTICAL
22// NO-SERVED the registry points at a missing elf -> a dangling row, a different defect entirely
23// -- "I COULD NOT LOOK" GETS ITS OWN BUCKET. Folding NO-BUILD into IDENTICAL would report the fleet
24// healthy in exactly the state this organ exists to catch -- the defect nx_offc_install already made
25// once when it read "no twin to judge" as "not stale".
26//
27// CHEAP BY CONSTRUCTION: size comes from sys_fstatat (a stat, NOT a read), so the common case costs two
28// stats per binary and reads NOTHING. A full byte compare runs ONLY when the sizes match, which is the
29// only case where size cannot decide. Equal size with different bytes is real, so it is never assumed away.
30// exit 0 census printed | 2 usage | 3 cannot read registry | 4 no rows | 5 capacity exceeded (REFUSES)
31// license_tier: ORIGINAL. Read-only. No hw writes (Rule 26).
32import "nx_syscalls.nx"
33
34const PS_MAXROW: i64 = 4096
35const PS_NAMEMAX: i64 = 256
36const PS_STAT_SIZE_OFF: i64 = 48
37const PS_DEFAULT_REG: *u8 = "tool_allowlist.conf"
38const PS_DEFAULT_BROOT: *u8 = "buildroot/_build/"
39const PS_TAB: i64 = 9
40const PS_NL: i64 = 10
41
42func ps_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
43func ps_puts(s: *u8) -> i64 { sys_write(1, s, ps_len(s)); return 0 }
44func ps_pn(v: i64) -> i64 {
45 var m: i64 = v
46 if m < 0 { ps_puts("-" as *u8); m = 0 - m }
47 let t: *u8 = sys_mmap(32)
48 var k: i64 = 0
49 if m == 0 { t[0] = 48 as u8; k = 1 }
50 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
51 let o: *u8 = sys_mmap(32)
52 var i: i64 = 0
53 while i < k { o[i] = t[k - 1 - i]; i = i + 1 }
54 sys_write(1, o, k)
55 return 0
56}
57// file size via stat -- NOT a read. -1 if it cannot be stat'd (absent/unreadable).
58func ps_size(path: *u8) -> i64 {
59 let sb: *u8 = sys_mmap(160)
60 if sys_fstatat(path, sb) < 0 { return 0 - 1 }
61 let sp: *i64 = (sb as i64 + PS_STAT_SIZE_OFF) as *i64
62 return sp[0]
63}
64func ps_streq(a: *u8, b: *u8) -> i64 {
65 var i: i64 = 0
66 var eq: i64 = 1
67 var go: i64 = 1
68 while go == 1 {
69 let ca: i64 = a[i] as i64
70 let cb: i64 = b[i] as i64
71 if ca != cb { eq = 0; go = 0 } else { if ca == 0 { go = 0 } else { i = i + 1 } }
72 }
73 return eq
74}
75// byte-compare two files. 1 identical, 0 differ, 0-1 unreadable (which must NOT read as identical).
76func ps_same(a: *u8, b: *u8) -> i64 {
77 let la: *i64 = sys_mmap(16) as *i64
78 let lb: *i64 = sys_mmap(16) as *i64
79 let ba: *u8 = sys_read_file(a, la)
80 if (ba as i64) == 0 { return 0 - 1 }
81 let bb: *u8 = sys_read_file(b, lb)
82 if (bb as i64) == 0 { return 0 - 1 }
83 if la[0] != lb[0] { return 0 }
84 var i: i64 = 0
85 var same: i64 = 1
86 var go: i64 = 1
87 while go == 1 {
88 if i >= la[0] { go = 0 } else {
89 if ba[i] != bb[i] { same = 0; go = 0 } else { i = i + 1 }
90 }
91 }
92 return same
93}
94
95func main(argc: i64, argv: *i64) -> i64 {
96 var reg: *u8 = PS_DEFAULT_REG
97 var broot: *u8 = PS_DEFAULT_BROOT
98 if argc >= 2 { reg = argv[1] as *u8 }
99 if argc >= 3 { broot = argv[2] as *u8 }
100
101 ps_puts("=== nx_promotestale registry=" as *u8); ps_puts(reg)
102 ps_puts(" buildroot=" as *u8); ps_puts(broot); ps_puts(" ===\n" as *u8)
103
104 let rl: *i64 = sys_mmap(16) as *i64
105 let rb: *u8 = sys_read_file(reg, rl)
106 if (rb as i64) == 0 {
107 ps_puts("PROMOTESTALE REFUSE: cannot read the registry\n" as *u8)
108 sys_exit(3)
109 return 3
110 }
111
112 // seen elf paths, so one binary behind several registry names is counted ONCE
113 let seen: *i64 = sys_mmap(PS_MAXROW*8) as *i64
114 var nseen: i64 = 0
115 var over: i64 = 0
116 var identical: i64 = 0
117 var stale: i64 = 0
118 var nobuild: i64 = 0
119 var noserved: i64 = 0
120 var rows: i64 = 0
121
122 ps_puts("\n-- STALE (the served binary is NOT the one the last build produced) --\n" as *u8)
123
124 var i: i64 = 0
125 while i < rl[0] {
126 // line [i, e)
127 var e: i64 = i
128 var seek: i64 = 1
129 while seek == 1 {
130 if e >= rl[0] { seek = 0 } else {
131 if (rb[e] as i64) == PS_NL { seek = 0 } else { e = e + 1 }
132 }
133 }
134 if e > i {
135 if (rb[i] as i64) != 35 {
136 // field 0 = name, field 1 = elf path
137 var t1: i64 = i
138 var s2: i64 = 1
139 while s2 == 1 { if t1 >= e { s2 = 0 } else { if (rb[t1] as i64) == PS_TAB { s2 = 0 } else { t1 = t1 + 1 } } }
140 if t1 < e {
141 var t2: i64 = t1 + 1
142 var s3: i64 = 1
143 while s3 == 1 { if t2 >= e { s3 = 0 } else { if (rb[t2] as i64) == PS_TAB { s3 = 0 } else { t2 = t2 + 1 } } }
144 let elf: *u8 = sys_mmap(PS_NAMEMAX)
145 var eo: i64 = 0
146 var k: i64 = t1 + 1
147 while k < t2 { if eo + 1 < PS_NAMEMAX { elf[eo] = rb[k]; eo = eo + 1 } k = k + 1 }
148 elf[eo] = 0 as u8
149 if eo > 0 {
150 // dedupe by elf path -- the UNIT IS THE BINARY, not the row
151 var dup: i64 = 0
152 var d: i64 = 0
153 while d < nseen { if ps_streq(seen[d] as *u8, elf) == 1 { dup = 1 } d = d + 1 }
154 if dup == 0 {
155 if nseen < PS_MAXROW { seen[nseen] = elf as i64; nseen = nseen + 1 } else { over = 1 }
156 rows = rows + 1
157 // target = basename with a trailing ".elf" removed
158 var bs: i64 = 0
159 var q: i64 = 0
160 while q < eo { if (elf[q] as i64) == 47 { bs = q + 1 } q = q + 1 }
161 var te: i64 = eo
162 if eo >= 4 {
163 if (elf[eo-4] as i64) == 46 { if (elf[eo-3] as i64) == 101 {
164 if (elf[eo-2] as i64) == 108 { if (elf[eo-1] as i64) == 102 { te = eo - 4 } } } }
165 }
166 let bp: *u8 = sys_mmap(PS_NAMEMAX)
167 var bo: i64 = 0
168 var bi: i64 = 0
169 while broot[bi] != (0 as u8) { bp[bo] = broot[bi]; bo = bo + 1; bi = bi + 1 }
170 var m: i64 = bs
171 while m < te { bp[bo] = elf[m]; bo = bo + 1; m = m + 1 }
172 let sfx: *u8 = ".sov.elf" as *u8
173 var si: i64 = 0
174 while sfx[si] != (0 as u8) { bp[bo] = sfx[si]; bo = bo + 1; si = si + 1 }
175 bp[bo] = 0 as u8
176
177 let ssz: i64 = ps_size(elf)
178 let bsz: i64 = ps_size(bp)
179 if ssz < 0 { noserved = noserved + 1 } else {
180 if bsz < 0 { nobuild = nobuild + 1 } else {
181 var differ: i64 = 0
182 if ssz != bsz { differ = 1 } else {
183 // sizes agree -- only NOW is a full read needed, and equal-size
184 // different-bytes is real, so it is never assumed away
185 if ps_same(elf, bp) == 0 { differ = 1 }
186 }
187 if differ == 1 {
188 stale = stale + 1
189 ps_puts(" " as *u8); ps_puts(elf)
190 ps_puts(" served=" as *u8); ps_pn(ssz)
191 ps_puts(" built=" as *u8); ps_pn(bsz)
192 ps_puts("\n" as *u8)
193 } else { identical = identical + 1 }
194 }
195 }
196 }
197 }
198 }
199 }
200 }
201 i = e + 1
202 }
203
204 if over == 1 {
205 ps_puts("PROMOTESTALE REFUSE: distinct-binary table exceeded capacity -- a partial census published\n" as *u8)
206 ps_puts("as a total is the defect this organ exists to find. Raise PS_MAXROW and re-run.\n" as *u8)
207 sys_exit(5)
208 return 5
209 }
210 if rows == 0 { ps_puts("PROMOTESTALE: no registry rows matched\n" as *u8); sys_exit(4); return 4 }
211 if stale == 0 { ps_puts(" (none)\n" as *u8) }
212
213 let sum: i64 = identical + stale + nobuild + noserved
214 ps_puts("\ndistinct_binaries=" as *u8); ps_pn(rows)
215 ps_puts(" IDENTICAL=" as *u8); ps_pn(identical)
216 ps_puts(" STALE=" as *u8); ps_pn(stale)
217 ps_puts(" NO-BUILD=" as *u8); ps_pn(nobuild)
218 ps_puts(" NO-SERVED=" as *u8); ps_pn(noserved)
219 ps_puts(" sum=" as *u8); ps_pn(sum)
220 if sum == rows { ps_puts(" partition=RECONCILES\n" as *u8) } else { ps_puts(" partition=LEAK\n" as *u8) }
221 ps_puts(" (NO-BUILD is CANNOT-JUDGE, never a pass: no build artifact exists to compare against.)\n" as *u8)
222 sys_exit(0)
223 return 0
224}