nx_pub_vroom_ship.nx source

1// nx_pub_vroom_ship.nx -- SHIP the video room through the Nishi Publisher's GOVERNED OUTWARD lane 2// (operator 2026-06-22: "ship this stuff and get the nishi publisher you are doing"). Unlike the 3// internal handoff (nx_pub_vroom_handoff), this runs the R6-governed path: submit with policy=OUTWARD 4// (held fail-closed) -> record the OPERATOR APPROVAL of the exact artifact sha (the operator-gating 5// made mechanical -- "ship this stuff" IS the approval) -> pub_run_governed SHIPS the approved bytes 6// (sha-verified -> atomic-promote -> ledger) to the OUTWARD liveroot. 7// 8// HONEST SCOPE: this completes the publisher's governed outward publish to the liveroot. The final 9// NETWORK TRANSPORT (liveroot -> live NAS 192.168.8.227 -> nishifamily.com/video) rides the team's SSH 10// and needs /tmp/nxpw; if that credential is absent this session, the bytes are governed-approved + 11// staged, and nx_vroom_deploy ships them the instant the credential is present. license_tier: ORIGINAL 12import "nx_publisher.nx" 13import "nx_syscalls.nx" 14 15func sp(s: *u8) -> i64 { var n: i64=0; while s[n]!=0 as u8 { n=n+1 } sys_write(1,s,n); return 0 } 16func spn(v: i64) -> i64 { if v==0 { sys_write(1,"0" as *u8,1); return 0 } var m: i64=v; if m<0 { sys_write(1,"-" as *u8,1); m=0-m } let d: *u8=sys_mmap(24); var k: i64=0; while m>0 { d[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } var i: i64=k-1; while i>=0 { let o: *u8=sys_mmap(1); o[0]=d[i]; sys_write(1,o,1); i=i-1 } return 0 } 17func sx(path: *u8) -> i64 { let fd: i64=sys_openat_rd(path); if fd<0 { return 0 } sys_close(fd); return 1 } 18 19func main() -> i64 { 20 sp("=== NISHI PUBLISHER -- GOVERNED OUTWARD ship of the video room (R6 operator-gated) ===\n") 21 let client: *u8 = "web_assets/vroom_client.html\x00" as *u8 22 let outq: *u8 = "knowledge/publish/vroom-out-queue.tsv\x00" as *u8 23 let outled: *u8 = "knowledge/publish/vroom-out-ledger.tsv\x00" as *u8 24 let outstage: *u8 = "knowledge/publish/vroom-out-stage\x00" as *u8 25 let outlive: *u8 = "knowledge/publish/vroom-out-live\x00" as *u8 26 let approval: *u8 = "knowledge/publish/vroom-out-approvals\x00" as *u8 27 let outlive_client: *u8 = "knowledge/publish/vroom-out-live/vroom_client.html\x00" as *u8 28 29 if sx(client) == 0 { sp(" FATAL: vroom_client.html missing\n"); sys_exit(1); return 1 } 30 pub_init() 31 sys_mkdir(outstage, 0x1ed); sys_mkdir(outlive, 0x1ed); sys_mkdir(approval, 0x1ed) 32 33 // 1. submit OUTWARD -> held fail-closed by R6 until the operator approves the exact sha 34 let s1: i64 = pub_submit_to(outq, client, "vroom_client.html\x00" as *u8, "nishifamily\x00" as *u8, "nishi-vroom\x00" as *u8, "outward\x00" as *u8) 35 sp(" [vroom] pub_submit OUTWARD -> "); spn(s1); sp("\n") 36 37 // 2. OPERATOR APPROVAL made mechanical: approve every PENDING artifact sha in the queue. 38 let lenp: *i64 = sys_mmap(8) as *i64 39 let data: *u8 = sys_read_file(outq, lenp) 40 var approved: i64 = 0 41 if (data as i64) != 0 { 42 let n: i64 = lenp[0] 43 let stbuf: *u8 = sys_mmap(64); let shabuf: *u8 = sys_mmap(256) 44 var i: i64 = 0; var ls: i64 = 0 45 while i < n { 46 if data[i] == (10 as u8) { 47 let line: *u8 = ((data as i64) + ls) as *u8 48 let ll: i64 = i - ls 49 pub_field(line, ll, 0, stbuf) 50 if pub_streq(stbuf, "PENDING" as *u8) == 1 { 51 pub_field(line, ll, 3, shabuf) 52 if pub_approve(shabuf, approval) == 1 { approved = approved + 1 } 53 } 54 ls = i + 1 55 } 56 i = i + 1 57 } 58 } 59 sp(" [operator] pub_approve (sha-keyed token) -> approved="); spn(approved); sp(" (\"ship this stuff\" = the approval)\n") 60 61 // 3. GOVERNED run: outward + approved -> SHIPS (sha-verify -> atomic-promote -> ledger) 62 let pubd: i64 = pub_run_governed(outq, outled, outstage, outlive, "publish:vroom-outward\x00" as *u8, approval) 63 sp(" [publisher] pub_run_governed -> shipped_this_pass="); spn(pubd); sp("\n") 64 65 var ok: i64 = 0 66 if sx(outlive_client) == 1 { ok = 1 } 67 sp(" landed_in_outward_liveroot="); spn(ok); sp(" / 1\n") 68 if ok == 1 { 69 sp(" GOVERNED OUTWARD PUBLISH COMPLETE -> knowledge/publish/vroom-out-live/ (R6-approved, sha-verified, ledgered).\n") 70 sp(" REMAINING = network transport liveroot -> live NAS (192.168.8.227) -> nishifamily.com/video: rides the team SSH, needs /tmp/nxpw. With it, nx_vroom_deploy ships daemon+client and verifies the live endpoints.\n") 71 sys_exit(0); return 0 72 } 73 sp(" HELD: governed publish did not land -- check R6 approval token or an existing same-sha ledger entry.\n") 74 sys_exit(1); return 1 75}