code wiki / _hdl_build / nx_seat_drive.nx
`nx_seat_drive.nx` source

↩ module page · 188 lines · 8152 B
1// nx_seat_drive.nx -- S2 SEAT-PROTOCOL DRIVER (agent-seat system, 2026-07-20).
2// Runs the seat lifecycle around a lane-configured work step so a NON-CLAUDE seat
3// (local maker ensemble, cron, any executor) closes rungs through the same protocol
4// and gates as a Claude seat: CHECKIN -> WORK -> VERIFY(gate) -> CHECKOUT, with an
5// append-only journal (fa_appendz, torn-proof) as the resume/standup surface.
6// Single responsibility: the PROTOCOL. The work itself, its success gate, and the
7// hub verbs are all LANE CONFIG DATA (no magic behavior, rule 11/22).
8//
9// argv: <lanefile>
10// lanefile = KEY=VALUE lines (LF). Required: ws= actor= journal= workelf= workartifact= gateelf=
11// Optional: workarg1..workarg3, gatearg1..gatearg2, checkinelf= checkinarg1=, checkoutelf= checkoutarg1=
12// Hub-verb convention: checkin/checkout elfs are invoked as  <elf> [argN] <ws> <actor>
13// so a live wrapper (nx_seat checkin over tools/call) and a fixture both fit.
14//
15// ARTIFACT-TRUTH (banked law): the work step is judged by its DECLARED artifact
16// (workartifact unlinked before the run, must exist non-empty after), not only by
17// wait4 status. A work step that "succeeds" without producing its artifact is REFUSED.
18//
19// exit: 0 OK | 2 config | 3 checkin-refused (fail-closed) | 4 work-fail | 5 gate-RED
20//       6 artifact-missing | 7 checkout-fail
21// license_tier: ORIGINAL   No hw writes (Rule 26).
22import "nx_seat_drive_lib.nx"
23import "nx_seg_store.nx"
24import "nx_deploy_lib.nx"
25import "nx_framed_append.nx"
26import "nx_syscalls.nx"
27const SD_MAGIC_1048576: i64 = 1048576
28
29const SD_CONF_CAP: i64 = 65536
30const SD_REC_CAP: i64 = 2048
31
32// journal one frame: "SEATD <ws> <actor> <tag>[ rc=<rc>]" (rc skipped when rcflag==0)
33func sd_frame(journal: *u8, ws: *u8, actor: *u8, tag: *u8, rcflag: i64, rc: i64) -> i64 {
  let rec: *u8 = sys_mmap(SD_REC_CAP)
  var o: i64 = 0
  o = sd_cat(rec, o, "SEATD " as *u8)
  o = sd_cat(rec, o, ws)
  o = sd_cat(rec, o, " " as *u8)
  o = sd_cat(rec, o, actor)
  o = sd_cat(rec, o, " " as *u8)
  o = sd_cat(rec, o, tag)
  if rcflag == 1 {
      o = sd_cat(rec, o, " rc=" as *u8)
      o = sd_num(rec, o, rc)
  }
  let arc: i64 = fa_appendz(journal, rec, SD_REC_CAP)
  sys_write(1, rec, o)
  sys_write(1, "\n" as *u8, 1)
  return arc
50}
51
52func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 { sd_w("usage: nx_seat_drive <lanefile>\n" as *u8); sys_exit(2); return 2 }
  let lanep: *u8 = argv[1] as *u8
  let conf: *u8 = sys_mmap(SD_CONF_CAP)
  let cn: i64 = dp_read(lanep, conf, SD_CONF_CAP)
  if cn <= 0 { sd_w("SEATD-CONFIG-MISSING\n" as *u8); sys_exit(2); return 2 }
58
  let ws: *u8 = sd_val(conf, cn, "ws=" as *u8)
  let actor: *u8 = sd_val(conf, cn, "actor=" as *u8)
  let journal: *u8 = sd_val(conf, cn, "journal=" as *u8)
  let workelf: *u8 = sd_val(conf, cn, "workelf=" as *u8)
  let workart: *u8 = sd_val(conf, cn, "workartifact=" as *u8)
  let gateelf: *u8 = sd_val(conf, cn, "gateelf=" as *u8)
  if (ws as i64) == 0 { sd_w("SEATD-CONFIG-BAD missing=ws\n" as *u8); sys_exit(2); return 2 }
  if (actor as i64) == 0 { sd_w("SEATD-CONFIG-BAD missing=actor\n" as *u8); sys_exit(2); return 2 }
  if (journal as i64) == 0 { sd_w("SEATD-CONFIG-BAD missing=journal\n" as *u8); sys_exit(2); return 2 }
  if (workelf as i64) == 0 { sd_w("SEATD-CONFIG-BAD missing=workelf\n" as *u8); sys_exit(2); return 2 }
  if (workart as i64) == 0 { sd_w("SEATD-CONFIG-BAD missing=workartifact\n" as *u8); sys_exit(2); return 2 }
  if (gateelf as i64) == 0 { sd_w("SEATD-CONFIG-BAD missing=gateelf\n" as *u8); sys_exit(2); return 2 }
71
  let wa1: *u8 = sd_val(conf, cn, "workarg1=" as *u8)
  let wa2: *u8 = sd_val(conf, cn, "workarg2=" as *u8)
  let wa3: *u8 = sd_val(conf, cn, "workarg3=" as *u8)
  let ga1: *u8 = sd_val(conf, cn, "gatearg1=" as *u8)
  let ga2: *u8 = sd_val(conf, cn, "gatearg2=" as *u8)
  let cielf: *u8 = sd_val(conf, cn, "checkinelf=" as *u8)
  let cia1: *u8 = sd_val(conf, cn, "checkinarg1=" as *u8)
  let coelf: *u8 = sd_val(conf, cn, "checkoutelf=" as *u8)
  let coa1: *u8 = sd_val(conf, cn, "checkoutarg1=" as *u8)
81
  // capture files ride next to the journal (declared, not hidden /tmp state)
  let wout: *u8 = sys_mmap(SD_VAL_CAP)
  var wo: i64 = 0
  wo = sd_cat(wout, 0, journal)
  wo = sd_cat(wout, wo, ".work.out" as *u8)
  let gout: *u8 = sys_mmap(SD_VAL_CAP)
  var go: i64 = 0
  go = sd_cat(gout, 0, journal)
  go = sd_cat(gout, go, ".gate.out" as *u8)
  let hout: *u8 = sys_mmap(SD_VAL_CAP)
  var ho: i64 = 0
  ho = sd_cat(hout, 0, journal)
  ho = sd_cat(hout, ho, ".hub.out" as *u8)
95
  let arc0: i64 = sd_frame(journal, ws, actor, "KICKOFF" as *u8, 0, 0)
  if arc0 < 0 { sd_w("SEATD-JOURNAL-FAIL\n" as *u8); sys_exit(2); return 2 }
98
  // CHECKIN (optional, fail-closed: a refused claim means DO NOT WORK)
  if (cielf as i64) != 0 {
      let cav: *i64 = sys_mmap(64) as *i64
      var cn2: i64 = 0
      if (cia1 as i64) != 0 { cav[cn2] = cia1 as i64; cn2 = cn2 + 1 }
      cav[cn2] = ws as i64
      cn2 = cn2 + 1
      cav[cn2] = actor as i64
      cn2 = cn2 + 1
      let rci: i64 = dep_run_capture(cielf, cav, cn2, hout)
      if rci != 0 {
          sd_frame(journal, ws, actor, "CHECKIN-REFUSED" as *u8, 1, rci)
          sys_exit(3)
          return 3
      }
      sd_frame(journal, ws, actor, "CHECKIN" as *u8, 1, rci)
  }
116
  // WORK -- artifact-truth: unlink the declared artifact first, require it after
  sys_unlinkat(workart)
  let wav: *i64 = sys_mmap(64) as *i64
  var wn: i64 = 0
  if (wa1 as i64) != 0 { wav[wn] = wa1 as i64; wn = wn + 1 }
  if (wa2 as i64) != 0 { wav[wn] = wa2 as i64; wn = wn + 1 }
  if (wa3 as i64) != 0 { wav[wn] = wa3 as i64; wn = wn + 1 }
  let rcw: i64 = dep_run_capture(workelf, wav, wn, wout)
  if rcw != 0 {
      sd_frame(journal, ws, actor, "WORKFAIL" as *u8, 1, rcw)
      sys_exit(4)
      return 4
  }
  let abuf: *u8 = sys_mmap(64)
  let an: i64 = dp_read(workart, abuf, 32)
  if an <= 0 {
      sd_frame(journal, ws, actor, "NOARTIFACT" as *u8, 0, 0)
      sys_exit(6)
      return 6
  }
  // EVIDENCE ARCHIVE (operator 2026-07-20 "needs evidence + a feedback loop keeping it honest"):
  // the declared artifact may live in a VOLATILE home (/tmp wiped 6x today) -- copy it to a
  // durable sibling of the journal BEFORE gating, so the lane gate/attestor and any later
  // auditor read evidence that cannot vanish. Fail LOUD if the archive cannot be written.
  let arcp: *u8 = sys_mmap(SD_VAL_CAP)
  var ao: i64 = 0
  ao = sd_cat(arcp, 0, journal)
  ao = sd_cat(arcp, ao, ".artifact" as *u8)
  let full: *u8 = sys_mmap(SD_MAGIC_1048576)
  let fn2: i64 = dp_read(workart, full, SD_MAGIC_1048576)
  var arc_rc: i64 = 0 - 1
  if fn2 > 0 { arc_rc = ss_writefile(arcp, full, fn2) }
  if arc_rc != 0 {
      sd_frame(journal, ws, actor, "ARCHIVE-FAIL" as *u8, 1, arc_rc)
      sys_exit(6)
      return 6
  }
154
  // VERIFY -- the lane's own gate must be GREEN (exit 0)
  let gav: *i64 = sys_mmap(64) as *i64
  var gn: i64 = 0
  if (ga1 as i64) != 0 { gav[gn] = ga1 as i64; gn = gn + 1 }
  if (ga2 as i64) != 0 { gav[gn] = ga2 as i64; gn = gn + 1 }
  let rcg: i64 = dep_run_capture(gateelf, gav, gn, gout)
  if rcg != 0 {
      sd_frame(journal, ws, actor, "GATERED" as *u8, 1, rcg)
      sys_exit(5)
      return 5
  }
166
  // CHECKOUT (optional; a failed release is LOUD, not swallowed)
  if (coelf as i64) != 0 {
      let oav: *i64 = sys_mmap(64) as *i64
      var on: i64 = 0
      if (coa1 as i64) != 0 { oav[on] = coa1 as i64; on = on + 1 }
      oav[on] = ws as i64
      on = on + 1
      oav[on] = actor as i64
      on = on + 1
      let rco: i64 = dep_run_capture(coelf, oav, on, hout)
      if rco != 0 {
          sd_frame(journal, ws, actor, "CHECKOUT-FAIL" as *u8, 1, rco)
          sys_exit(7)
          return 7
      }
  }
183
  sd_frame(journal, ws, actor, "DONE work_rc=0 gate_rc=0" as *u8, 0, 0)
  sd_w("NX-SEAT-DRIVE OK\n" as *u8)
  sys_exit(0)
  return 0
188}
nx_seat_drive.nx source

`nx_seat_drive.nx` source
