nx_pub_canary_gate.nx source

1// nx_pub_canary_gate.nx -- R14b PROOF + MEASURED HEAD-TO-HEAD: canary rollout limits blast radius. 2// 3// A new version is staged to a SEPARATE canary slot and served-smoke-checked over a cohort BEFORE any promotion to 4// main. A bad version (served result != approved) fails the canary cohort -> ABORT -> main is never touched. Measured 5// vs the naive baseline that pushes straight to main: 6// bad version -> naive: main serves BAD (100% blast) vs canary: main untouched, still last-good (0% blast). 7// Forking server (psv_listen serves the slot dir); run foreground. license_tier: ORIGINAL expect_exit: 0 8import "nx_syscalls.nx" 9import "nx_publisher.nx" 10import "nx_pub_serve.nx" 11import "nx_runpath.nx" 12 13func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 14func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 15func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w(" " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w("FAIL\n" as *u8) } return 0 } 16func sv_write(path: *u8, content: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } var n: i64=0; while content[n]!=(0 as u8){n=n+1} sys_write(fd, content, n); sys_close(fd); return 1 } 17 18func main() -> i64 { 19 let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0 20 g_w("=== NX-PUB-CANARY GATE (separate-slot cohort smoke gate; blast radius measured vs naive) ===\n" as *u8) 21 let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid) 22 let D: *u8 = sys_mmap(512); rp_path(wsid, "pcan" as *u8, D); __syscall(83, D as i64, 493, 0, 0, 0, 0) 23 var psum: i64 = 0; var pj: i64 = 0; while wsid[pj]!=(0 as u8){ psum = psum + (wsid[pj] as i64); pj = pj + 1 } 24 let port: i64 = 19220 + (psum % 300) 25 26 let mainp: *u8 = sys_mmap(700); pub_join(D, "page.html" as *u8, mainp) 27 let src_good: *u8 = sys_mmap(700); pub_join(D, "good.src" as *u8, src_good); sv_write(src_good, "CANARY-GOOD-V2\n" as *u8) 28 let src_bad: *u8 = sys_mmap(700); pub_join(D, "bad.src" as *u8, src_bad); sv_write(src_bad, "CANARY-BAD\n" as *u8) 29 let sha_good: *u8 = sys_mmap(72); pub_sha_file(src_good, sha_good) 30 sv_write(mainp, "MAIN-LASTGOOD\n" as *u8) // main starts at last-good 31 32 let pid: i64 = sys_fork() 33 if pid == 0 { psv_listen(D, port); sys_exit(0) } // serve the slot dir 34 35 let resp: *u8 = sys_mmap(262144) 36 37 // GOOD rollout: cohort of 3 served-smokes pass -> promote to main 38 let r_good: i64 = pub_canary_rollout(sha_good, src_good, D, "page.html" as *u8, "page.html" as *u8, port, 3) 39 let ng: i64 = pub_http_get(port, "page.html" as *u8, resp, 262144) 40 let main_is_good: i64 = pub_substr(resp, ng, "CANARY-GOOD-V2" as *u8) 41 42 // reset main to last-good for the bad scenario 43 sv_write(mainp, "MAIN-LASTGOOD\n" as *u8) 44 // NAIVE: push the bad version straight to main 45 pub_copy(src_bad, mainp) 46 let nn: i64 = pub_http_get(port, "page.html" as *u8, resp, 262144) 47 let naive_main_bad: i64 = pub_substr(resp, nn, "CANARY-BAD" as *u8) 48 49 // reset main; CANARY the same bad version (expecting the GOOD sha -> served mismatch -> abort) 50 sv_write(mainp, "MAIN-LASTGOOD\n" as *u8) 51 let r_bad: i64 = pub_canary_rollout(sha_good, src_bad, D, "page.html" as *u8, "page.html" as *u8, port, 3) 52 let mb: i64 = pub_http_get(port, "page.html" as *u8, resp, 262144) 53 let canary_main_bad: i64 = pub_substr(resp, mb, "CANARY-BAD" as *u8) 54 let canary_main_lastgood: i64 = pub_substr(resp, mb, "MAIN-LASTGOOD" as *u8) 55 56 __syscall(129, pid, 9, 0, 0, 0, 0) // rv64 kill=129; raw x86 62 is an RV64 KEY translated to lseek(8) -- the kill never happened (debt idx 2277) 57 let st: *i64 = sys_mmap(8) as *i64; var rr: i64 = 0; while rr < 20 { sys_wait4(0 - 1, st, 1); rr = rr + 1 } 58 59 g_w(" r_good=" as *u8); g_n(r_good); g_w(" main_is_good=" as *u8); g_n(main_is_good); g_w(" | r_bad=" as *u8); g_n(r_bad); g_w(" naive_main_bad=" as *u8); g_n(naive_main_bad); g_w(" canary_main_bad=" as *u8); g_n(canary_main_bad); g_w(" canary_main_lastgood=" as *u8); g_n(canary_main_lastgood); g_w("\n" as *u8) 60 61 g_row("GOOD: cohort healthy -> canary PROMOTES, main serves the new version (r_good==1)" as *u8, ((r_good==1) as i64) & main_is_good, pass) 62 g_row("BASELINE REAL: naive pushes bad straight to main (100% blast)" as *u8, naive_main_bad, pass) 63 g_row("CANARY: bad version ABORTED (r_bad==0), main untouched = still last-good (0% blast)" as *u8, ((r_bad==0) as i64) & canary_main_lastgood & ((canary_main_bad==0) as i64), pass) 64 let exceeds: i64 = (naive_main_bad) & ((canary_main_bad==0) as i64) 65 g_w("\n HEAD-TO-HEAD: bad-version main blast naive=100% vs canary=0%" as *u8) 66 if exceeds==1 { g_w(" => EXCEEDS (measured, liar-kill: naive blast real)\n" as *u8) } else { g_w(" => NOT EXCEEDS\n" as *u8) } 67 g_row("MEASURED EXCEEDS: canary limits blast radius to 0% of main" as *u8, exceeds, pass) 68 69 g_w("NX-PUB-CANARY rows=4 pass=" as *u8); g_n(pass[0]) 70 if pass[0]==4 { g_w(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 } 71 g_w(" verdict=RED\n" as *u8); sys_exit(1); return 1 72}