nx_reader_page.nx source

1// nx_reader_page.nx -- the SOVEREIGN emitter for the reader last-mile (R-EMIT: closes the hardware-rung-up gap 2// "even the last-mile HTML must be EMITTED by a Nishi organ"). It produces the served reader.html from a canonical 3// source artifact via Nishi syscalls only (no shell/cp), and is FAIL-CLOSED on sovereignty: if the source carries 4// ANY third-party load (<script src>, offsite src/href, @import, <iframe>, CDN, epub.js) the organ REFUSES to emit 5// and the served file is left untouched -- so a 3rd-party dependency can never reach the deployable by accident. 6// 7// SSOT = runtime/assets/reader_src.html (the source you edit). Output = knowledge/staging/media/reader.html (served). 8// Bootstrap: on first default run, if the source is missing, it is SEEDED from the current served reader.html, so 9// this is a byte-identical, zero-regression cutover. argv override: `nx_reader_page <src> <dest>` (used by the gate 10// to test fail-closed on a scratch source without touching the real files). expect_exit: 0 license_tier: ORIGINAL 11import "nx_syscalls.nx" 12import "nx_reader_sov.nx" 13 14func rp_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 15func rp_n(v0: i64) -> i64 { var v: i64=v0; if v<0 { sys_write(1,"-" as *u8,1); v=0-v } let b: *u8=sys_mmap(24); var k: i64=0; if v==0 {b[0]=48 as u8;k=1} while v>0 {b[k]=(48+(v%10)) as u8; v=v/10; k=k+1} let o: *u8=sys_mmap(24); var j: i64=0; while j<k {o[j]=b[k-1-j];j=j+1} sys_write(1,o,k); return 0 } 16func rp_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 } 17func ensure_dir(path: *u8) -> i64 { __syscall(258, 0-100, path, 0x1ed, 0, 0, 0); return 0 } 18func rp_write(path: *u8, buf: *u8, n: i64) -> i64 { 19 let fd: i64 = sys_openat_wr(path, 0x1a4) 20 if fd < 0 { return 0-1 } 21 sys_write(fd, buf, n) 22 sys_close(fd) 23 return n 24} 25// fail-closed sovereignty predicate lives in nx_reader_sov.nx (reader_sovereign_ok) -- shared with the gate. 26 27func main(argc: i64, argv: *i64) -> i64 { 28 var src: *u8 = "runtime/assets/reader_src.html" as *u8 29 var dest: *u8 = "knowledge/staging/media/reader.html" as *u8 30 var custom: i64 = 0 31 if argc >= 3 { src = argv[1] as *u8; dest = argv[2] as *u8; custom = 1 } 32 33 // bootstrap (default mode only): seed the source from the current served reader.html, byte-identical. 34 if custom == 0 { 35 if rp_exists(src) == 0 { 36 if rp_exists(dest) == 1 { 37 ensure_dir("runtime/assets" as *u8) 38 let lpb: *i64 = sys_mmap(8) as *i64; lpb[0] = 0 39 let d0: *u8 = sys_read_file(dest, lpb) 40 if (d0 as i64) != 0 { rp_write(src, d0, lpb[0]); rp_p(" [bootstrap] seeded reader_src.html from current reader.html (byte-identical cutover)\n" as *u8) } 41 } 42 } 43 } 44 45 let lp: *i64 = sys_mmap(8) as *i64; lp[0] = 0 46 let buf: *u8 = sys_read_file(src, lp) 47 if (buf as i64) == 0 { rp_p("READER-EMIT FAIL read-src\n" as *u8); sys_exit(1); return 1 } 48 let n: i64 = lp[0] 49 50 if reader_sovereign_ok(buf, n) == 0 { 51 rp_p("READER-EMIT REFUSED: source carries a 3rd-party load -> fail-closed, dest NOT written\n" as *u8) 52 sys_exit(2); return 2 53 } 54 let w: i64 = rp_write(dest, buf, n) 55 if w < 0 { rp_p("READER-EMIT FAIL write-dest\n" as *u8); sys_exit(1); return 1 } 56 rp_p("READER-EMIT ok bytes=" as *u8); rp_n(n); rp_p(" sovereign=1 -> " as *u8); rp_p(dest); rp_p("\n" as *u8) 57 sys_exit(0); return 0 58}