nx_pub_cd2_gate.nx source

1// nx_pub_cd2_gate.nx -- R15 PROOF: multi-env promote-chain + multi-target fan-out + feature flags. 2// 3// PROMOTE-CHAIN -- a good artifact reaches prod through dev->stage->prod; a corrupt one STOPS at dev (prod untouched). 4// FAN-OUT -- a good artifact lands on all N targets; a corrupt one lands on ZERO (no target gets bad bytes). 5// FEATURE FLAGS -- a flag reads its last-set value; an unknown flag defaults OFF (fail-safe), decoupling deploy/release. 6// File-based (no forks). license_tier: ORIGINAL expect_exit: 0 7import "nx_syscalls.nx" 8import "nx_publisher.nx" 9import "nx_runpath.nx" 10 11func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 12func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 13func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w(" " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w("FAIL\n" as *u8) } return 0 } 14func sv_write(path: *u8, content: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } var n: i64=0; while content[n]!=(0 as u8){n=n+1} sys_write(fd, content, n); sys_close(fd); return 1 } 15func g_unlink(path: *u8) -> i64 { __syscall(87, path as i64, 0, 0, 0, 0, 0); return 0 } 16func g_mkdir(D: *u8, name: *u8) -> *u8 { let p: *u8 = sys_mmap(700); pub_join(D, name, p); __syscall(83, p as i64, 493, 0, 0, 0, 0); return p } 17func has_str(path: *u8, needle: *u8) -> i64 { let lp: *i64 = sys_mmap(8) as *i64; let d: *u8 = sys_read_file(path, lp); if (d as i64)==0 { return 0 } return pub_substr(d, lp[0], needle) } 18 19func main() -> i64 { 20 let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0 21 g_w("=== NX-PUB-CD2 GATE (promote-chain + fan-out + feature flags) ===\n" as *u8) 22 let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid) 23 let D: *u8 = sys_mmap(512); rp_path(wsid, "pcd2" as *u8, D); __syscall(83, D as i64, 493, 0, 0, 0, 0) 24 25 let stg: *u8 = g_mkdir(D, "stgroot" as *u8) 26 let dev: *u8 = g_mkdir(D, "dev" as *u8); let stage: *u8 = g_mkdir(D, "stage" as *u8); let prod: *u8 = g_mkdir(D, "prod" as *u8) 27 let dev2: *u8 = g_mkdir(D, "dev2" as *u8); let stage2: *u8 = g_mkdir(D, "stage2" as *u8); let prod2: *u8 = g_mkdir(D, "prod2" as *u8) 28 let t1: *u8 = g_mkdir(D, "t1" as *u8); let t2: *u8 = g_mkdir(D, "t2" as *u8); let t3: *u8 = g_mkdir(D, "t3" as *u8) 29 let tb1: *u8 = g_mkdir(D, "tb1" as *u8); let tb2: *u8 = g_mkdir(D, "tb2" as *u8); let tb3: *u8 = g_mkdir(D, "tb3" as *u8) 30 31 let src_good: *u8 = sys_mmap(700); pub_join(D, "good.src" as *u8, src_good); sv_write(src_good, "CHAIN-GOOD\n" as *u8) 32 let src_bad: *u8 = sys_mmap(700); pub_join(D, "bad.src" as *u8, src_bad); sv_write(src_bad, "CHAIN-BAD\n" as *u8) 33 let sha_good: *u8 = sys_mmap(72); pub_sha_file(src_good, sha_good) 34 35 // must-be-absent check files (idempotent re-run) 36 let prod2_pg: *u8 = sys_mmap(700); pub_join(prod2, "page.html" as *u8, prod2_pg); g_unlink(prod2_pg) 37 let tb1_f: *u8 = sys_mmap(700); pub_join(tb1, "f.html" as *u8, tb1_f); g_unlink(tb1_f) 38 39 // ---- PROMOTE-CHAIN ---- 40 let roots: *i64 = sys_mmap(64) as *i64; roots[0]=dev as i64; roots[1]=stage as i64; roots[2]=prod as i64 41 let chain_good: i64 = pub_promote_chain(sha_good, src_good, "page.html" as *u8, roots, 3, stg) 42 let prod_pg: *u8 = sys_mmap(700); pub_join(prod, "page.html" as *u8, prod_pg) 43 let prod_serves: i64 = has_str(prod_pg, "CHAIN-GOOD" as *u8) 44 let roots2: *i64 = sys_mmap(64) as *i64; roots2[0]=dev2 as i64; roots2[1]=stage2 as i64; roots2[2]=prod2 as i64 45 let chain_bad: i64 = pub_promote_chain(sha_good, src_bad, "page.html" as *u8, roots2, 3, stg) // corrupt vs good sha 46 let prod2_absent: i64 = (pub_exists(prod2_pg)==0) as i64 47 48 // ---- FAN-OUT ---- 49 let tg: *i64 = sys_mmap(64) as *i64; tg[0]=t1 as i64; tg[1]=t2 as i64; tg[2]=t3 as i64 50 let fan_good: i64 = pub_fanout(sha_good, src_good, "f.html" as *u8, tg, 3, stg) 51 let t1_f: *u8 = sys_mmap(700); pub_join(t1, "f.html" as *u8, t1_f) 52 let t3_f: *u8 = sys_mmap(700); pub_join(t3, "f.html" as *u8, t3_f) 53 let all_targets: i64 = ((pub_exists(t1_f)==1) as i64) & ((pub_exists(t3_f)==1) as i64) 54 let tgb: *i64 = sys_mmap(64) as *i64; tgb[0]=tb1 as i64; tgb[1]=tb2 as i64; tgb[2]=tb3 as i64 55 let fan_bad: i64 = pub_fanout(sha_good, src_bad, "f.html" as *u8, tgb, 3, stg) // corrupt vs good sha 56 let tb_absent: i64 = (pub_exists(tb1_f)==0) as i64 57 58 // ---- FEATURE FLAGS ---- 59 let flags: *u8 = sys_mmap(700); pub_join(D, "flags.tsv" as *u8, flags); g_unlink(flags) 60 pub_flag_set(flags, "newui" as *u8, 1) 61 let f_on: i64 = pub_flag_get(flags, "newui" as *u8) 62 let f_unknown: i64 = pub_flag_get(flags, "nope" as *u8) 63 pub_flag_set(flags, "newui" as *u8, 0) 64 let f_off: i64 = pub_flag_get(flags, "newui" as *u8) 65 66 g_w(" chain_good=" as *u8); g_n(chain_good); g_w(" prod_serves=" as *u8); g_n(prod_serves); g_w(" chain_bad=" as *u8); g_n(chain_bad); g_w(" prod2_absent=" as *u8); g_n(prod2_absent); g_w("\n" as *u8) 67 g_w(" fan_good=" as *u8); g_n(fan_good); g_w(" all_targets=" as *u8); g_n(all_targets); g_w(" fan_bad=" as *u8); g_n(fan_bad); g_w(" tb_absent=" as *u8); g_n(tb_absent); g_w("\n" as *u8) 68 g_w(" flag on=" as *u8); g_n(f_on); g_w(" unknown=" as *u8); g_n(f_unknown); g_w(" off=" as *u8); g_n(f_off); g_w("\n" as *u8) 69 70 g_row("PROMOTE-CHAIN: good artifact reaches prod (3/3) and prod serves it" as *u8, ((chain_good==3) as i64) & prod_serves, pass) 71 g_row("PROMOTE-CHAIN fail-closed: corrupt stops at dev (0), prod NEVER touched" as *u8, ((chain_bad==0) as i64) & prod2_absent, pass) 72 g_row("FAN-OUT: good artifact lands on all 3 targets" as *u8, ((fan_good==3) as i64) & all_targets, pass) 73 g_row("FAN-OUT fail-closed: corrupt lands on ZERO targets (no bad bytes anywhere)" as *u8, ((fan_bad==0) as i64) & tb_absent, pass) 74 g_row("FEATURE FLAG: on->1, unknown->0 (fail-safe default off), off->0 (last wins)" as *u8, ((f_on==1) as i64) & ((f_unknown==0) as i64) & ((f_off==0) as i64), pass) 75 76 g_w("NX-PUB-CD2 rows=5 pass=" as *u8); g_n(pass[0]) 77 if pass[0]==5 { g_w(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 } 78 g_w(" verdict=RED\n" as *u8); sys_exit(1); return 1 79}