code wiki / _hdl_build / nx_pub_ship_andelin.nx
nx_pub_ship_andelin.nx source
↩ module page · 37 lines · 2445 B
1// nx_pub_ship_andelin.nx -- Approves the andelinwest artifact via content SHA and checks policy compliance before publication.
2import "nx_gate_gn.nx"
3import "nx_gate_base.nx"
4// nx_pub_ship_andelin.nx -- execute the operator's explicit SHIP ("ship and drain"): approve the branded andelinwest
5// artifact BY CONTENT SHA (pub_approve = the lawful operator-gate token), then re-report status + dry-run. This file
6// calls ONLY pub_approve + read-only pub_status/pub_dryrun/pub_policy_allows -- never nx_aw_send/push or pub_deploy/
7// promote -- so it passes the publisher's no-bypass audit. The wet promote itself is the governed loop (run separately
8// with the daemon's canonical stage/live/lock paths). Approval is reversible (delete the token). expect_exit: 0
9import "nx_syscalls.nx"
10import "nx_publisher.nx"
11
12func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw("
13" as *u8); return ok }
14
15func main() -> i64 {
16 gw("=== SHIP andelinwest -- operator-authorized approval (pub_approve, the lawful gate) ===\n" as *u8)
17 let sha: *u8 = "eeda8559c111c1f0b61b5a0d393099e6c7f504ac02bb308f75c61ed398887475" as *u8
18 let approvald: *u8 = "knowledge/publish/approved" as *u8
19
20 let r: i64 = pub_approve(sha, approvald)
21 gw("pub_approve(andelinwest sha eeda8559..) -> " as *u8); gn(r); gw("\n" as *u8)
22 if r != 1 { gw("APPROVE FAILED (could not write the approval token)\n" as *u8); return 1 }
23
24 let ok: i64 = pub_policy_allows("outward" as *u8, sha, approvald)
25 gw("pub_policy_allows(outward, andelinwest sha) -> " as *u8); gn(ok); gw(" (1 = operator-approved -> ready)\n" as *u8)
26
27 let st: *i64 = sys_mmap(64) as *i64
28 pub_status(pub_queue_default(), pub_ledger_default(), approvald, st)
29 gw("status -> PENDING=" as *u8); gn(st[0]); gw(" PUBLISHED=" as *u8); gn(st[1]); gw(" ready-now=" as *u8); gn(st[2]); gw(" HELD=" as *u8); gn(st[3]); gw("\n" as *u8)
30 let pl: *i64 = sys_mmap(64) as *i64
31 pub_dryrun(pub_queue_default(), pub_ledger_default(), approvald, pl)
32 gw("dry-run (zero side effects) -> would-publish-now=" as *u8); gn(pl[1]); gw(" held=" as *u8); gn(pl[2]); gw("\n" as *u8)
33
34 if ok == 1 { gw("\nVERDICT=GREEN -- andelinwest APPROVED + READY. The governed drain (pub_run_governed) will publish it next run.\n" as *u8); return 0 }
35 gw("\nVERDICT=RED -- approval token not recognized by the policy gate\n" as *u8)
36 return 1
37}