nx_pub_sweep.nx source

1// nx_pub_sweep.nx -- Runs required gates to ensure all publisher checks pass before deployment, enforcing no-bypass laws and regression standards. 2import "nx_gate_gn.nx" 3import "nx_gate_base.nx" 4// nx_pub_sweep.nx -- the NISHI PUBLISHER's REQUIRED-GATE SWEEP. Forks/execs the sovereign build runner on each 5// publisher gate; RED if ANY fails. This is the canonical "these must be GREEN to ship the publisher" set, and it 6// INCLUDES the no-bypass enforcement gates (nx_pub_bypass2_gate = the law covers the whole surface; nx_pub_nobypass_gate 7// = the no-new-bypass ratchet) -- so the no-bypass LAW is now part of the required regression, not an optional check. 8// 9// This list is the FILE-BASED gates (WSL-safe). The forking/server gates -- nx_pub_submit_gate, nx_pub_loop_gate, 10// nx_pub_exceed_gate, nx_pub_smoke_gate, nx_pub_serve_gate, nx_pub_canary_gate -- are verified individually (each GREEN 11// this session) and run in a Linux CI; they are excluded HERE only because batched process-forking destabilizes WSL 12// (Wsl/Service/E_UNEXPECTED). Same fork/exec idiom as nx_gate_sweep. CWD must be nxc2. license_tier: ORIGINAL 13import "nx_syscalls.nx" 14 15const PSWEEP_RUNNER: *u8 = "_offc/nx_sov_build_run.elf" 16 17func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 18" as *u8); return ok } 19 20func run_gate(name: *u8) -> i64 { 21 let pid: i64 = sys_fork() 22 if pid == 0 { 23 let dn: i64 = sys_openat_wr("/dev/null\x00" as *u8, 420) 24 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 25 let argv: *i64 = sys_mmap(64) as *i64 26 argv[0] = PSWEEP_RUNNER as i64 27 argv[1] = name as i64 28 argv[2] = 0 29 let envp: *i64 = sys_mmap(16) as *i64 30 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 31 sys_execve(PSWEEP_RUNNER, argv, envp) 32 sys_exit(127) 33 } 34 let st: *i64 = sys_mmap(16) as *i64 35 sys_wait4(pid, st, 0) 36 return (st[0] >> 8) & 0xff 37} 38 39func report(name: *u8, tally: *i64) -> i64 { 40 let code: i64 = run_gate(name) 41 gw(" " as *u8); gw(name); gw(": " as *u8) 42 if code == 0 { gw("GREEN\n" as *u8); tally[0] = tally[0] + 1 } 43 else { gw("RED (exit " as *u8); gn(code); gw(")\n" as *u8); tally[1] = tally[1] + 1 } 44 return code 45} 46 47func main() -> i64 { 48 gw("=== nx_pub_sweep: NISHI PUBLISHER required-gate sweep (incl. no-bypass enforcement) ===\n" as *u8) 49 let tally: *i64 = sys_mmap(16) as *i64 50 tally[0] = 0; tally[1] = 0 51 report("nx_pub_census\x00" as *u8, tally) 52 report("nx_pub_func_census\x00" as *u8, tally) 53 report("nx_pub_deploy_gate\x00" as *u8, tally) 54 report("nx_pub_promote_gate\x00" as *u8, tally) 55 report("nx_pub_obs_gate\x00" as *u8, tally) 56 report("nx_pub_audit_gate\x00" as *u8, tally) 57 report("nx_pub_metrics_gate\x00" as *u8, tally) 58 report("nx_pub_govern2_gate\x00" as *u8, tally) 59 report("nx_pub_bluegreen_gate\x00" as *u8, tally) 60 report("nx_pub_cd2_gate\x00" as *u8, tally) // promote-chain + fan-out + feature flags 61 report("nx_pub_rel_gate\x00" as *u8, tally) // rolling + retention/GC + bounded retry 62 report("nx_pub_q_gate\x00" as *u8, tally) // priority lanes + per-env lockgroups 63 report("nx_pub_pd_exceed_gate\x00" as *u8, tally) // measured: progressive delivery limits blast radius 64 report("nx_pub_daemon_gate\x00" as *u8, tally) // continuous drain (ship-all / idempotent / new-arrival) 65 report("nx_pub_daemon2_gate\x00" as *u8, tally) // best-practice daemon: heartbeat+event-driven+graceful+crash-only 66 report("nx_pub_dns_gate\x00" as *u8, tally) // public-domain wiring emit 67 report("nx_pub_tls_gate\x00" as *u8, tally) // serve over the proven sovereign TLS-1.3 server 68 report("nx_pub_bypass2_gate\x00" as *u8, tally) // no-bypass LAW covers the whole surface 69 report("nx_pub_nobypass_gate\x00" as *u8, tally) // no-new-bypass RATCHET (the forcing function) 70 gw("---\nGREEN=" as *u8); gn(tally[0]); gw(" RED=" as *u8); gn(tally[1]); gw(" total=" as *u8); gn(tally[0]+tally[1]); gw("\n" as *u8) 71 if tally[1] == 0 { gw("PUB-SWEEP verdict=ALL-GREEN (publisher required set incl. no-bypass enforcement)\n" as *u8); sys_exit(0); return 0 } 72 gw("PUB-SWEEP verdict=REGRESSION\n" as *u8); sys_exit(1); return 1 73}