nx_publish_verify.nx source
↩ module page · 186 lines · 11583 B
1// nx_publish_verify.nx -- THE LAST STEP OF THE PUBLISHING LOOP: is the page the PUBLIC URL serves the page the emitter just
2// wrote? (operator 2026-09-02: "beach wasnt receiving the updates for review and still isnt ... the pipeline needs to be
3// fully mature").
4//
5// WHY THE LOOP WAS OPEN: nx_craft_emit's [5/5] SHIPPED step reads the FILE back and verifies its marker -- it proves the write
6// landed on disk and nothing about what a visitor receives through the edge (cache, a stale docroot, a route pointing at an older
7// tree, an injected banner). nx_page_verify proves the served page's assets fetch and decode and says nothing about WHICH build
8// it is. Neither answers the reviewer's question "am I looking at the build you just shipped?", so the reviewer answered it by
9// eye and was wrong for a day.
10//
11// WHAT THIS DOES, composing the estate's own instruments and never a third-party client: reads the emitted file's build stamp
12// (`REVIEW STAGE b<epoch>` in the <title>, written by nx_game_page_emit), fetches the PUBLIC URL through the sovereign TLS client
13// (forks nx_https_get with the our-domain connect override so the request crosses the real edge), reads the served stamp, and
14// prints ONE verdict line a human or a seat can act on:
15// SERVED-CURRENT the edge serves the stamp the file carries (exit 0)
16// SERVED-STALE the edge serves an OLDER (or different) stamp (exit 1) -- both stamps and the byte delta printed
17// NO-MARKER the file or the served page carries no stamp (exit 4)
18// UNREACHABLE the fetch failed; nothing is claimed about the page (exit 3)
19// plus the REVIEW URL with every see-it lever on (?review=1&cast=1&hud=1) so the reviewer is never left to guess a query string.
20// The served body may legitimately exceed the file (the edge injects its notice bytes); the delta is PRINTED, never hidden.
21// nx_publish_verify <world> [base-url] (default base https://nishifamily.com/world/ ; file sites/nishifamily/world/<world>.html)
22// license_tier: ORIGINAL No hw writes (Rule 26).
23import "nx_syscalls.nx"
24import "nx_https_fetch_lib.nx" // the sovereign HTTPS GET composition, IN-PROCESS (see the fetch block below for why no fork)
25
26const PV_BASE_DEFAULT: *u8 = "https://nishifamily.com/world/"
27const PV_FILE_PFX: *u8 = "sites/nishifamily/world/"
28const PV_FILE_EXT: *u8 = ".html"
29const PV_MARK: *u8 = "REVIEW STAGE b"
30const PV_REVIEW_QUERY: *u8 = "?review=1&cast=1&hud=1"
31const PV_CONNECT_IP: i64 = 2130706433 // 127.0.0.1 packed big-endian (0x7F000001): connect to the sovereign edge on this host
32const PV_CONNECT_PORT: i64 = 8443 // sites.elf's LAN listener; SNI, Host and cert name stay the URL's host
33const PV_DECODE: i64 = 1 // hf_fetch_mode: decode the transport coding so the body is the document
34const PV_CAP: i64 = 4194304 // a world page is ~620 KB; 4 MiB of capture headroom, announced when hit
35const PV_TMO_MS: i64 = 30000
36const PV_PATH: i64 = 1024
37const PV_OUT: i64 = 4096
38const PV_STAMP_MAX: i64 = 24
39const PV_EXIT_OK: i64 = 0
40const PV_EXIT_STALE: i64 = 1
41const PV_EXIT_USAGE: i64 = 2
42const PV_EXIT_UNREACH: i64 = 3
43const PV_EXIT_NOMARK: i64 = 4
44const PV_CH_0: i64 = 48
45const PV_CH_9: i64 = 57
46const PV_CH_NL: i64 = 10
47// GP3/GE45: every world page carries the render-door ladder as data (nx_tier_ladder_lib emits it); the verifier reads it
48// BACK from the served body so a build that lost it is named on the verdict line instead of discovered by a visitor's HUD.
49const PV_LADDER_MARK: *u8 = "window.__nx_ladder=["
50
51func pv_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
52func pv_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; var p: i64 = o; while s[i] != (0 as u8) { d[p] = s[i]; p = p + 1; i = i + 1 } return p }
53func pv_num(d: *u8, o: i64, v: i64) -> i64 {
54 var m: i64 = v
55 var p: i64 = o
56 if m < 0 { d[p] = 45 as u8; p = p + 1; m = 0 - m }
57 if m == 0 { d[p] = PV_CH_0 as u8; return p + 1 }
58 let t: *u8 = sys_mmap(32)
59 var k: i64 = 0
60 while m > 0 { t[k] = (PV_CH_0 + (m % 10)) as u8; m = m / 10; k = k + 1 }
61 var i: i64 = k - 1
62 while i >= 0 { d[p] = t[i]; p = p + 1; i = i - 1 }
63 sys_munmap(t, 32)
64 return p
65}
66// the stamp: the digits following the FIRST `REVIEW STAGE b` in buf[0..n); -1 when absent
67func pv_stamp(b: *u8, n: i64) -> i64 {
68 let ml: i64 = pv_slen(PV_MARK)
69 var i: i64 = 0
70 while i + ml <= n {
71 var m: i64 = 1
72 var k: i64 = 0
73 while k < ml { if b[i + k] != PV_MARK[k] { m = 0; k = ml } else { k = k + 1 } }
74 if m == 1 {
75 var v: i64 = 0
76 var any: i64 = 0
77 var p: i64 = i + ml
78 var go: i64 = 1
79 while go == 1 { if p >= n { go = 0 } else { let c: i64 = b[p] as i64; if c >= PV_CH_0 { if c <= PV_CH_9 { v = v*10 + (c - PV_CH_0); any = 1; p = p + 1 } else { go = 0 } } else { go = 0 } } }
80 if any == 1 { return v }
81 return 0 - 1
82 }
83 i = i + 1
84 }
85 return 0 - 1
86}
87func pv_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
88// first offset of needle in b[0..n), or -1
89func pv_find(b: *u8, n: i64, needle: *u8) -> i64 {
90 let ml: i64 = pv_slen(needle)
91 if ml == 0 { return 0 - 1 }
92 var i: i64 = 0
93 while i + ml <= n {
94 var k: i64 = 0
95 var hit: i64 = 1
96 while k < ml { if b[i + k] != needle[k] { hit = 0; k = ml } k = k + 1 }
97 if hit == 1 { return i }
98 i = i + 1
99 }
100 return 0 - 1
101}
102
103func main(argc: i64, argv: *i64) -> i64 {
104 let out: *u8 = sys_mmap(PV_OUT)
105 if argc < 2 {
106 sys_write(1, "usage: nx_publish_verify <world> [base-url] -- is the PUBLIC URL serving the build the emitter wrote?\n" as *u8, 103)
107 sys_exit(PV_EXIT_USAGE); return PV_EXIT_USAGE
108 }
109 let world: *u8 = argv[1] as *u8
110 var base: *u8 = PV_BASE_DEFAULT
111 if argc >= 3 { base = argv[2] as *u8 }
112 // the emitted file and its stamp
113 let fpath: *u8 = sys_mmap(PV_PATH)
114 var fo: i64 = pv_cat(fpath, 0, PV_FILE_PFX); fo = pv_cat(fpath, fo, world); fo = pv_cat(fpath, fo, PV_FILE_EXT); fpath[fo] = 0 as u8
115 let lp: *i64 = sys_mmap(16) as *i64
116 let fb: *u8 = sys_read_file(fpath, lp)
117 var file_bytes: i64 = 0 - 1
118 var file_stamp: i64 = 0 - 1
119 var file_ladder: i64 = 0
120 if (fb as i64) != 0 { file_bytes = lp[0]; file_stamp = pv_stamp(fb, lp[0]); if pv_find(fb, lp[0], PV_LADDER_MARK) >= 0 { file_ladder = 1 } }
121 // the public URL through the sovereign TLS client IN-PROCESS: nx_https_fetch_lib is the same composition the
122 // nx_https_get CLI runs (trust store, CSPRNG, TLS 1.3 chrome-JA3 hello with fallbacks, redirects, transport decode),
123 // with the connect override so the request crosses the real edge. NO FORK, DELIBERATELY: the first byte of this
124 // organ forked ./nx_https_get.elf through tr_run_capture_to and the child produced ZERO bytes with rc 0 on every
125 // url, including a control url whose only possible output is an ERROR line -- and nx_behaveprobe read the
126 // laptop-built and the NAS-built binaries IDENTICAL (544 B, rc 3), so the fork path, not the toolchain, was the
127 // defect. Composing the library removes the fork and with it the question.
128 let url: *u8 = sys_mmap(PV_PATH)
129 var uo: i64 = pv_cat(url, 0, base); uo = pv_cat(url, uo, world); url[uo] = 0 as u8
130 let cap: *u8 = sys_mmap(PV_CAP)
131 var served_bytes: i64 = 0
132 var served_stamp: i64 = 0 - 1
133 var served_ladder: i64 = 0
134 var rc: i64 = HF_ERR_STORE
135 let store_i: i64 = hf_store_load()
136 if store_i > 0 {
137 let resp_n: i64 = hf_fetch_mode(store_i, url, PV_CONNECT_IP, PV_CONNECT_PORT, cap, PV_CAP, PV_DECODE)
138 rc = resp_n
139 if resp_n > 0 {
140 let he: i64 = hf_body_off(cap, resp_n)
141 if he >= 0 {
142 served_bytes = resp_n - he
143 served_stamp = pv_stamp(((cap as i64) + he) as *u8, served_bytes)
144 if pv_find(((cap as i64) + he) as *u8, served_bytes, PV_LADDER_MARK) >= 0 { served_ladder = 1 }
145 }
146 }
147 }
148 var o: i64 = pv_cat(out, 0, "PUBLISH-VERIFY world=" as *u8); o = pv_cat(out, o, world)
149 o = pv_cat(out, o, " file=" as *u8); o = pv_cat(out, o, fpath)
150 o = pv_cat(out, o, " file_bytes=" as *u8); o = pv_num(out, o, file_bytes)
151 o = pv_cat(out, o, " file_stamp=" as *u8); o = pv_num(out, o, file_stamp)
152 o = pv_cat(out, o, " url=" as *u8); o = pv_cat(out, o, url)
153 o = pv_cat(out, o, " fetch_rc=" as *u8); o = pv_num(out, o, rc)
154 o = pv_cat(out, o, " served_bytes=" as *u8); o = pv_num(out, o, served_bytes)
155 if served_bytes >= PV_CAP { o = pv_cat(out, o, " (CAPTURE AT CAP -- the body may be longer than what was read)" as *u8) }
156 o = pv_cat(out, o, " served_stamp=" as *u8); o = pv_num(out, o, served_stamp)
157 o = pv_cat(out, o, " file_ladder=" as *u8); o = pv_num(out, o, file_ladder)
158 o = pv_cat(out, o, " served_ladder=" as *u8); o = pv_num(out, o, served_ladder)
159 if served_bytes > 0 { if file_bytes > 0 { o = pv_cat(out, o, " edge_delta_bytes=" as *u8); o = pv_num(out, o, served_bytes - file_bytes) } }
160 o = pv_cat(out, o, "\nREVIEW-URL " as *u8); o = pv_cat(out, o, url); o = pv_cat(out, o, PV_REVIEW_QUERY); o = pv_cat(out, o, " (review=1 summons the reference cast and auto-frames it, cast=1 loads the visiting rigs, hud=1 shows the frame budget line)\n" as *u8)
161 var verdict: i64 = PV_EXIT_OK
162 if served_bytes <= 0 {
163 verdict = PV_EXIT_UNREACH
164 o = pv_cat(out, o, "verdict=UNREACHABLE -- the sovereign client got no body from the edge; nothing is claimed about what visitors see. Check the edge (nx_health), not the emitter.\n" as *u8)
165 } else { if file_stamp < 0 {
166 verdict = PV_EXIT_NOMARK
167 o = pv_cat(out, o, "verdict=NO-MARKER -- the emitted file carries no REVIEW STAGE stamp; the emitter did not write one, so served-vs-emitted cannot be judged.\n" as *u8)
168 } else { if served_stamp < 0 {
169 verdict = PV_EXIT_NOMARK
170 o = pv_cat(out, o, "verdict=NO-MARKER -- the served page carries no REVIEW STAGE stamp: the edge is serving something that is not this emitter's page (wrong docroot or route).\n" as *u8)
171 } else { if served_stamp == file_stamp {
172 o = pv_cat(out, o, "verdict=SERVED-CURRENT -- the public URL serves the build the emitter wrote (stamp b" as *u8); o = pv_num(out, o, file_stamp); o = pv_cat(out, o, ")" as *u8)
173 if served_ladder == 0 { o = pv_cat(out, o, "; the served page carries NO render-door ladder (window.__nx_ladder absent): GP3/GE45 rk_tier_ladder did not reach this build" as *u8) }
174 if served_ladder == 1 { o = pv_cat(out, o, "; the served page carries the render-door ladder (GP3/GE45), so its HUD names the door and the refusals" as *u8) }
175 o = pv_cat(out, o, ".\n" as *u8)
176 } else {
177 verdict = PV_EXIT_STALE
178 o = pv_cat(out, o, "verdict=SERVED-STALE -- the edge serves b" as *u8); o = pv_num(out, o, served_stamp); o = pv_cat(out, o, " while the file carries b" as *u8); o = pv_num(out, o, file_stamp)
179 if served_stamp < file_stamp { o = pv_cat(out, o, " (OLDER: a cache or a stale docroot is between the emitter and the visitor; reload the edge or purge, then re-run)" as *u8) }
180 else { o = pv_cat(out, o, " (NEWER than the file: another emit landed after this one, or the route serves a different tree)" as *u8) }
181 o = pv_cat(out, o, "\n" as *u8)
182 } } } }
183 sys_write(1, out, o)
184 sys_exit(verdict)
185 return verdict
186}