nx_pub_hostop_e2e_gate.nx source

1// nx_pub_hostop_e2e_gate.nx -- COORDINATION CAPSTONE: the publisher and the host-operator work together end-to-end. 2// workstream --pub_submit--> PUBLISHER (stage->verify->atomic-promote->ledger to its liveroot) 3// --> HOST-OPERATOR (hostop_receive picks up the verified+staged release) 4// --> hostop_apply_verified (integrity re-check -> atomic host-swap to the host-root) 5// --> the host serves the release. 6// Integrity at EVERY hop (fail-closed): a wrong-sha host-apply returns 0 and leaves the host uncorrupted (never-brick). 7// SANDBOX publisher-liveroot + host-root (the real-NAS apply is coordinated). File-based. license_tier: ORIGINAL expect_exit: 0 8import "nx_syscalls.nx" 9import "nx_publisher.nx" 10import "nx_hostop.nx" 11import "nx_runpath.nx" 12 13func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 14func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 15func g_row(id: *u8, ok: i64, pass: *i64) -> i64 { g_w(" " as *u8); g_w(id); g_w(": " as *u8); if ok==1 { g_w("OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w("FAIL\n" as *u8) } return 0 } 16func sv_write(path: *u8, content: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } var n: i64=0; while content[n]!=(0 as u8){n=n+1} sys_write(fd, content, n); sys_close(fd); return 1 } 17func g_unlink(path: *u8) -> i64 { __syscall(87, path as i64, 0, 0, 0, 0, 0); return 0 } 18func g_mkdir(D: *u8, name: *u8) -> *u8 { let p: *u8 = sys_mmap(700); pub_join(D, name, p); __syscall(83, p as i64, 493, 0, 0, 0, 0); return p } 19func has_str(path: *u8, needle: *u8) -> i64 { let lp: *i64 = sys_mmap(8) as *i64; let d: *u8 = sys_read_file(path, lp); if (d as i64)==0 { return 0 } return pub_substr(d, lp[0], needle) } 20 21func main() -> i64 { 22 let pass: *i64 = sys_mmap(8) as *i64; pass[0]=0 23 g_w("=== NX-PUB-HOSTOP-E2E GATE (publisher + host-operator coordination, end-to-end) ===\n" as *u8) 24 let wsid: *u8 = sys_mmap(64); rp_wsid(wsid); rp_ensure(wsid) 25 let D: *u8 = sys_mmap(512); rp_path(wsid, "phe" as *u8, D); __syscall(83, D as i64, 493, 0, 0, 0, 0) 26 let stage: *u8 = g_mkdir(D, "pub_stage" as *u8) 27 let pub_live: *u8 = g_mkdir(D, "pub_live" as *u8) 28 let host: *u8 = g_mkdir(D, "host" as *u8) 29 let appr: *u8 = g_mkdir(D, "appr" as *u8) 30 let q: *u8 = sys_mmap(700); pub_join(D, "queue.tsv" as *u8, q); g_unlink(q) 31 let led: *u8 = sys_mmap(700); pub_join(D, "ledger.tsv" as *u8, led); g_unlink(led) 32 let src: *u8 = sys_mmap(700); pub_join(D, "src.html" as *u8, src); sv_write(src, "E2E-GOOD\n" as *u8) 33 let sha: *u8 = sys_mmap(72); pub_sha_file(src, sha) 34 let plive: *u8 = sys_mmap(700); pub_join(pub_live, "page.html" as *u8, plive); g_unlink(plive) 35 let hlive: *u8 = sys_mmap(700); pub_join(host, "page.html" as *u8, hlive); g_unlink(hlive) 36 37 // --- PUBLISHER leg: workstream submits -> publisher stages+verifies+promotes to its liveroot + ledgers --- 38 pub_submit_to(q, src, "page.html" as *u8, "site" as *u8, "ws" as *u8, "internal" as *u8) 39 let published: i64 = pub_run_governed(q, led, stage, pub_live, "phe_lock" as *u8, appr) 40 let pub_ok: i64 = ((published==1) as i64) & (has_str(plive, "E2E-GOOD" as *u8)) 41 42 // --- HOST-OPERATOR leg: receive the verified+staged release -> apply (integrity re-check) -> host serves it --- 43 let ready: i64 = hostop_is_ready(led, pub_live, "page.html" as *u8) 44 let applied: i64 = hostop_apply_verified(led, pub_live, host, "page.html" as *u8, sha) 45 let host_ok: i64 = ((applied==1) as i64) & (has_str(hlive, "E2E-GOOD" as *u8)) 46 47 // --- FAIL-CLOSED: a wrong-sha host-apply must return 0 and leave the host uncorrupted --- 48 let bad: i64 = hostop_apply_verified(led, pub_live, host, "page.html" as *u8, "WRONGSHA" as *u8) 49 let host_safe: i64 = ((bad==0) as i64) & (has_str(hlive, "E2E-GOOD" as *u8)) 50 51 g_w(" published=" as *u8); g_n(published); g_w(" ready=" as *u8); g_n(ready); g_w(" applied=" as *u8); g_n(applied); g_w(" bad=" as *u8); g_n(bad); g_w("\n" as *u8) 52 g_row("PUBLISHER stages+verifies the release to its liveroot + ledgers it" as *u8, pub_ok, pass) 53 g_row("HOST-OPERATOR receives the publisher-verified+staged release (ready==1)" as *u8, ready, pass) 54 g_row("HOST-OPERATOR applies it to the host (host serves E2E-GOOD), never half-applied" as *u8, host_ok, pass) 55 g_row("FAIL-CLOSED end-to-end: a wrong-sha host-apply returns 0, host stays uncorrupted" as *u8, host_safe, pass) 56 g_row("FULL CHAIN: workstream -> publisher -> host-operator -> host, integrity at every hop" as *u8, pub_ok & ready & host_ok & host_safe, pass) 57 58 g_w("NX-PUB-HOSTOP-E2E rows=5 pass=" as *u8); g_n(pass[0]) 59 if pass[0]==5 { g_w(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 } 60 g_w(" verdict=RED\n" as *u8); sys_exit(1); return 1 61}