nx_pub_sweep.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_pub_sweep.nx -- the NISHI PUBLISHER's REQUIRED-GATE SWEEP. Forks/execs the sovereign build runner on each 4// publisher gate; RED if ANY fails. This is the canonical "these must be GREEN to ship the publisher" set, and it 5// INCLUDES the no-bypass enforcement gates (nx_pub_bypass2_gate = the law covers the whole surface; nx_pub_nobypass_gate 6// = the no-new-bypass ratchet) -- so the no-bypass LAW is now part of the required regression, not an optional check. 7// 8// This list is the FILE-BASED gates (WSL-safe). The forking/server gates -- nx_pub_submit_gate, nx_pub_loop_gate, 9// nx_pub_exceed_gate, nx_pub_smoke_gate, nx_pub_serve_gate, nx_pub_canary_gate -- are verified individually (each GREEN 10// this session) and run in a Linux CI; they are excluded HERE only because batched process-forking destabilizes WSL 11// (Wsl/Service/E_UNEXPECTED). Same fork/exec idiom as nx_gate_sweep. CWD must be nxc2. license_tier: ORIGINAL 12import "nx_syscalls.nx" 13 14const PSWEEP_RUNNER: *u8 = "_offc/nx_sov_build_run.elf" 15 16func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 17" as *u8); return ok } 18 19func run_gate(name: *u8) -> i64 { 20 let pid: i64 = sys_fork() 21 if pid == 0 { 22 let dn: i64 = sys_openat_wr("/dev/null\x00" as *u8, 420) 23 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 24 let argv: *i64 = sys_mmap(64) as *i64 25 argv[0] = PSWEEP_RUNNER as i64 26 argv[1] = name as i64 27 argv[2] = 0 28 let envp: *i64 = sys_mmap(16) as *i64 29 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64; envp[1] = 0 30 sys_execve(PSWEEP_RUNNER, argv, envp) 31 sys_exit(127) 32 } 33 let st: *i64 = sys_mmap(16) as *i64 34 sys_wait4(pid, st, 0) 35 return (st[0] >> 8) & 0xff 36} 37 38func report(name: *u8, tally: *i64) -> i64 { 39 let code: i64 = run_gate(name) 40 gw(" " as *u8); gw(name); gw(": " as *u8) 41 if code == 0 { gw("GREEN\n" as *u8); tally[0] = tally[0] + 1 } 42 else { gw("RED (exit " as *u8); gn(code); gw(")\n" as *u8); tally[1] = tally[1] + 1 } 43 return code 44} 45 46func main() -> i64 { 47 gw("=== nx_pub_sweep: NISHI PUBLISHER required-gate sweep (incl. no-bypass enforcement) ===\n" as *u8) 48 let tally: *i64 = sys_mmap(16) as *i64 49 tally[0] = 0; tally[1] = 0 50 report("nx_pub_census\x00" as *u8, tally) 51 report("nx_pub_func_census\x00" as *u8, tally) 52 report("nx_pub_deploy_gate\x00" as *u8, tally) 53 report("nx_pub_promote_gate\x00" as *u8, tally) 54 report("nx_pub_obs_gate\x00" as *u8, tally) 55 report("nx_pub_audit_gate\x00" as *u8, tally) 56 report("nx_pub_metrics_gate\x00" as *u8, tally) 57 report("nx_pub_govern2_gate\x00" as *u8, tally) 58 report("nx_pub_bluegreen_gate\x00" as *u8, tally) 59 report("nx_pub_cd2_gate\x00" as *u8, tally) // promote-chain + fan-out + feature flags 60 report("nx_pub_rel_gate\x00" as *u8, tally) // rolling + retention/GC + bounded retry 61 report("nx_pub_q_gate\x00" as *u8, tally) // priority lanes + per-env lockgroups 62 report("nx_pub_pd_exceed_gate\x00" as *u8, tally) // measured: progressive delivery limits blast radius 63 report("nx_pub_daemon_gate\x00" as *u8, tally) // continuous drain (ship-all / idempotent / new-arrival) 64 report("nx_pub_daemon2_gate\x00" as *u8, tally) // best-practice daemon: heartbeat+event-driven+graceful+crash-only 65 report("nx_pub_dns_gate\x00" as *u8, tally) // public-domain wiring emit 66 report("nx_pub_tls_gate\x00" as *u8, tally) // serve over the proven sovereign TLS-1.3 server 67 report("nx_pub_bypass2_gate\x00" as *u8, tally) // no-bypass LAW covers the whole surface 68 report("nx_pub_nobypass_gate\x00" as *u8, tally) // no-new-bypass RATCHET (the forcing function) 69 gw("---\nGREEN=" as *u8); gn(tally[0]); gw(" RED=" as *u8); gn(tally[1]); gw(" total=" as *u8); gn(tally[0]+tally[1]); gw("\n" as *u8) 70 if tally[1] == 0 { gw("PUB-SWEEP verdict=ALL-GREEN (publisher required set incl. no-bypass enforcement)\n" as *u8); sys_exit(0); return 0 } 71 gw("PUB-SWEEP verdict=REGRESSION\n" as *u8); sys_exit(1); return 1 72}