nx_research_fork_fetch.nx source

1// nx_research_fork_fetch.nx -- RESEARCHER GROWTH rung: PROCESS-ISOLATED fetch. Each source is fetched in a FORKED 2// CHILD that does one fetch + sys_exit -- so every TLS mmap the fetch allocates is freed on child exit and the PARENT 3// never accumulates the per-fetch leak (the ceiling that capped pass size). Result crosses the process boundary via 4// the saved file. This makes fetch passes UNBOUNDED + isolates failures (a child SIGTERM can't kill the run). The 5// next rung is N children in flight (parallel) -- safest NAS-side, where TLS-CPU contention isn't a factor. 6// [[feedback-grow-researcher-team-continuously]] expect_exit: 0 license_tier: ORIGINAL 7import "nx_syscalls.nx" 8import "nx_x509_trust_store.nx" 9import "nx_trust_store_load_from_certdata.nx" 10import "nx_https_fetch_follow.nx" 11const K_MAGIC_4194304: i64 = 4194304 12const K_MAGIC_2097152: i64 = 2097152 13 14func gw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 15func gn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 } 16func have_file(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 } 17 18func fetch_save(url: *u8, opath: *u8, store: *TrustStore, out: *u8, cap: i64) -> i64 { 19 if have_file(opath) == 1 { return 1 } 20 let status: *i64 = sys_mmap(8) as *i64 21 let n: i64 = nx_https_fetch_follow(url, store, out, cap, 6, status) 22 if n <= 0 { return 0 } 23 let fd: i64 = sys_openat_wr(opath, 0x1a4) 24 if fd < 0 { return 0 } 25 sys_write(fd, out, n); sys_close(fd) 26 return 1 27} 28// PROCESS-ISOLATED single fetch: the CHILD does the fetch + exits (frees its mmaps); the PARENT only waits. 29func ffork_one(url: *u8, opath: *u8, store: *TrustStore, out: *u8, cap: i64) -> i64 { 30 if have_file(opath) == 1 { return 1 } 31 let pid: i64 = sys_fork() 32 if pid == 0 { 33 fetch_save(url, opath, store, out, cap) 34 sys_exit(0) 35 } 36 let st: *i64 = sys_mmap(16) as *i64 37 sys_wait4(pid, st, 0) 38 if have_file(opath) == 1 { return 1 } 39 return 0 40} 41// mechanism probe: fork a child that writes `content` to `path` and exits; parent waits. 42func ffork_write(path: *u8, content: *u8) -> i64 { 43 let pid: i64 = sys_fork() 44 if pid == 0 { 45 let fd: i64 = sys_openat_wr(path, 0x1a4) 46 if fd >= 0 { var n: i64=0; while content[n]!=(0 as u8){n=n+1} sys_write(fd, content, n); sys_close(fd) } 47 sys_exit(0) 48 } 49 let st: *i64 = sys_mmap(16) as *i64 50 sys_wait4(pid, st, 0) 51 return 0 52} 53 54func main() -> i64 { 55 var fail: i64 = 0 56 gw("=== nx_research_fork_fetch -- process-isolated (fork-per-fetch) researcher fetch ===\n" as *u8) 57 58 // M1: the fork mechanism -- 4 children each write a file + exit; parent wait4s; all land. 59 ffork_write("/tmp/ffork_0.txt" as *u8, "child0\n" as *u8) 60 ffork_write("/tmp/ffork_1.txt" as *u8, "child1\n" as *u8) 61 ffork_write("/tmp/ffork_2.txt" as *u8, "child2\n" as *u8) 62 ffork_write("/tmp/ffork_3.txt" as *u8, "child3\n" as *u8) 63 var m1: i64 = 0 64 if have_file("/tmp/ffork_0.txt" as *u8)==1 { if have_file("/tmp/ffork_1.txt" as *u8)==1 { if have_file("/tmp/ffork_2.txt" as *u8)==1 { if have_file("/tmp/ffork_3.txt" as *u8)==1 { m1 = 4 } } } } 65 gw(" M1 fork mechanism: " as *u8); gn(m1); gw("/4 children's files landed (fork+child-exit+wait4 + result-via-FS)\n" as *u8) 66 if m1 != 4 { fail = 1 } 67 68 // M2: a live PROCESS-ISOLATED fetch -- the fetch runs in a child, its mmaps freed on exit. 69 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, K_MAGIC_4194304) 70 if r <= 0 { gw(" M2 certdata load failed (skipping live fetch)\n" as *u8); fail = 1 } 71 else { 72 let store: *TrustStore = r as *TrustStore 73 let out: *u8 = sys_mmap(K_MAGIC_2097152) 74 let f: i64 = ffork_one("https://en.wikipedia.org/wiki/Favicon" as *u8, "knowledge/fetched/ffork_favicon.raw" as *u8, store, out, K_MAGIC_2097152) 75 gw(" M2 fork-fetched /wiki/Favicon -> landed=" as *u8); gn(f); gw(" (the fetch ran in a child; the parent never held its TLS mmaps)\n" as *u8) 76 if f != 1 { fail = 1 } 77 } 78 79 if fail == 0 { gw("\nVERDICT=GREEN -- process-isolated fetch works: fork-per-fetch kills the per-fetch mmap-leak ceiling (unbounded passes) + isolates failures.\n" as *u8); return 0 } 80 gw("\nVERDICT=RED\n" as *u8) 81 return 1 82}