nx_servedrift.nx source
↩ module page · 230 lines · 11292 B
1// nx_artifactdrift.nx -- IS THE BINARY WE ARE SERVING THE ONE THE LAST BUILD PRODUCED?
2//
3// ⚠THIS ORGAN WAS NAMED WRONG TWICE, AND BOTH GUARDS WERE RIGHT. It shipped as `nx_promotestale` and
4// nx_job_run's launch guard refused it: that guard splits the name on '_' and denies any SEGMENT
5// STARTING WITH a control-plane stem, so "promotestale" reads as promote. Renamed to `nx_servedrift`,
6// /api/promote then refused it as a DAEMON and nx_job_run refused it again -- "servedrift" starts with
7// "serve", and that guard's header states it chose stem-prefix DELIBERATELY so `nx_server` could never
8// escape, calling an escaped server "the brick".
9// -- BOTH REFUSALS WERE CORRECT. A launch guard must be wrong in the direction of REFUSING, and a name
10// that starts with `serve` genuinely looks like a server. The tempting fix -- patch an allow-path into a
11// never-brick guard so it consults organ_kind.conf -- would trade a real safety property for a bad name.
12// -- SO THE NAME MOVED, NOT THE GUARD: this measures DRIFT BETWEEN THE BUILT AND SERVED ARTIFACT, which
13// `artifactdrift` says exactly and claims to be no kind of server.
14// ★★AN ORGAN'S NAME IS PART OF ITS INTERFACE, BECAUSE THE ESTATE'S OWN SAFETY RULES READ IT -- and when a
15// guard and a name disagree, the guard is the thing with a proof behind it.
16//
17// WHY IT EXISTS, MEASURED 2026-08-14: two organs were found SERVING STALE CODE purely because a human
18// happened to notice nx_catalog's BUILT and PROMOTED columns disagree -- nx_vizsla_digest (47,402 served
19// vs 47,596 built) and nx_vizsla_plan (176,882 served vs 217,561 built: ~40 KB, a FIFTH of the organ,
20// missing from the running binary). Both were invisible to every health check the estate runs.
21// -- A RUNNING BINARY THAT IS NOT WHAT ITS SOURCE BUILT IS A SILENT CORRECTNESS AND SECURITY DEFECT:
22// every fix, every audit and every gate verdict then describes code that is not the code being executed.
23// -- SPOTTING IT BY EYE DOES NOT SCALE. nx_catalog answers this one NAME at a time; this sweeps.
24//
25// nx_servedrift [registry] [buildroot]
26//
27// THE UNIT IS THE BINARY, NOT THE REGISTRY ROW. Several names legitimately share one elf (nx_status and
28// nx_torstat both point at nx_hostctl; nx_services/nx_health/nx_mgmt all at nx_mgmt_call.elf), so
29// counting rows would INFLATE the population and report one stale binary as three.
30//
31// CLASSES -- a PARTITION whose parts are printed and MUST sum:
32// IDENTICAL served bytes == built bytes -> what we run is what we built
33// STALE both exist and DIFFER -> THE WORKLIST; the served code is not the build
34// NO-BUILD no build artifact to compare against -> CANNOT JUDGE, never folded into IDENTICAL
35// NO-SERVED the registry points at a missing elf -> a dangling row, a different defect entirely
36// -- "I COULD NOT LOOK" GETS ITS OWN BUCKET. Folding NO-BUILD into IDENTICAL would report the fleet
37// healthy in exactly the state this organ exists to catch -- the defect nx_offc_install already made
38// once when it read "no twin to judge" as "not stale".
39//
40// CHEAP BY CONSTRUCTION: size comes from sys_fstatat (a stat, NOT a read), so the common case costs two
41// stats per binary and reads NOTHING. A full byte compare runs ONLY when the sizes match, which is the
42// only case where size cannot decide. Equal size with different bytes is real, so it is never assumed away.
43// exit 0 census printed | 2 usage | 3 cannot read registry | 4 no rows | 5 capacity exceeded (REFUSES)
44// license_tier: ORIGINAL. Read-only. No hw writes (Rule 26).
45import "nx_syscalls.nx"
46
47const PS_MAXROW: i64 = 4096
48const PS_NAMEMAX: i64 = 256
49const PS_STAT_SIZE_OFF: i64 = 48
50const PS_DEFAULT_REG: *u8 = "tool_allowlist.conf"
51const PS_DEFAULT_BROOT: *u8 = "buildroot/_build/"
52const PS_TAB: i64 = 9
53const PS_NL: i64 = 10
54
55func ps_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
56func ps_puts(s: *u8) -> i64 { sys_write(1, s, ps_len(s)); return 0 }
57func ps_pn(v: i64) -> i64 {
58 var m: i64 = v
59 if m < 0 { ps_puts("-" as *u8); m = 0 - m }
60 let t: *u8 = sys_mmap(32)
61 var k: i64 = 0
62 if m == 0 { t[0] = 48 as u8; k = 1 }
63 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
64 let o: *u8 = sys_mmap(32)
65 var i: i64 = 0
66 while i < k { o[i] = t[k - 1 - i]; i = i + 1 }
67 sys_write(1, o, k)
68 return 0
69}
70// file size via stat -- NOT a read. -1 if it cannot be stat'd (absent/unreadable).
71func ps_size(path: *u8) -> i64 {
72 let sb: *u8 = sys_mmap(160)
73 if sys_fstatat(path, sb) < 0 { return 0 - 1 }
74 let sp: *i64 = (sb as i64 + PS_STAT_SIZE_OFF) as *i64
75 return sp[0]
76}
77func ps_streq(a: *u8, b: *u8) -> i64 {
78 var i: i64 = 0
79 var eq: i64 = 1
80 var go: i64 = 1
81 while go == 1 {
82 let ca: i64 = a[i] as i64
83 let cb: i64 = b[i] as i64
84 if ca != cb { eq = 0; go = 0 } else { if ca == 0 { go = 0 } else { i = i + 1 } }
85 }
86 return eq
87}
88// byte-compare two files. 1 identical, 0 differ, 0-1 unreadable (which must NOT read as identical).
89func ps_same(a: *u8, b: *u8) -> i64 {
90 let la: *i64 = sys_mmap(16) as *i64
91 let lb: *i64 = sys_mmap(16) as *i64
92 let ba: *u8 = sys_read_file(a, la)
93 if (ba as i64) == 0 { return 0 - 1 }
94 let bb: *u8 = sys_read_file(b, lb)
95 if (bb as i64) == 0 { return 0 - 1 }
96 if la[0] != lb[0] { return 0 }
97 var i: i64 = 0
98 var same: i64 = 1
99 var go: i64 = 1
100 while go == 1 {
101 if i >= la[0] { go = 0 } else {
102 if ba[i] != bb[i] { same = 0; go = 0 } else { i = i + 1 }
103 }
104 }
105 return same
106}
107
108func main(argc: i64, argv: *i64) -> i64 {
109 var reg: *u8 = PS_DEFAULT_REG
110 var broot: *u8 = PS_DEFAULT_BROOT
111 if argc >= 2 { reg = argv[1] as *u8 }
112 if argc >= 3 { broot = argv[2] as *u8 }
113
114 ps_puts("=== nx_servedrift registry=" as *u8); ps_puts(reg)
115 ps_puts(" buildroot=" as *u8); ps_puts(broot); ps_puts(" ===\n" as *u8)
116
117 let rl: *i64 = sys_mmap(16) as *i64
118 let rb: *u8 = sys_read_file(reg, rl)
119 if (rb as i64) == 0 {
120 ps_puts("SERVEDRIFT REFUSE: cannot read the registry\n" as *u8)
121 sys_exit(3)
122 return 3
123 }
124
125 let seen: *i64 = sys_mmap(PS_MAXROW*8) as *i64
126 var nseen: i64 = 0
127 var over: i64 = 0
128 var identical: i64 = 0
129 var stale: i64 = 0
130 var nobuild: i64 = 0
131 var noserved: i64 = 0
132 var rows: i64 = 0
133
134 ps_puts("\n-- STALE (the served binary is NOT the one the last build produced) --\n" as *u8)
135
136 var i: i64 = 0
137 while i < rl[0] {
138 var e: i64 = i
139 var seek: i64 = 1
140 while seek == 1 {
141 if e >= rl[0] { seek = 0 } else {
142 if (rb[e] as i64) == PS_NL { seek = 0 } else { e = e + 1 }
143 }
144 }
145 if e > i {
146 if (rb[i] as i64) != 35 {
147 var t1: i64 = i
148 var s2: i64 = 1
149 while s2 == 1 { if t1 >= e { s2 = 0 } else { if (rb[t1] as i64) == PS_TAB { s2 = 0 } else { t1 = t1 + 1 } } }
150 if t1 < e {
151 var t2: i64 = t1 + 1
152 var s3: i64 = 1
153 while s3 == 1 { if t2 >= e { s3 = 0 } else { if (rb[t2] as i64) == PS_TAB { s3 = 0 } else { t2 = t2 + 1 } } }
154 let elf: *u8 = sys_mmap(PS_NAMEMAX)
155 var eo: i64 = 0
156 var k: i64 = t1 + 1
157 while k < t2 { if eo + 1 < PS_NAMEMAX { elf[eo] = rb[k]; eo = eo + 1 } k = k + 1 }
158 elf[eo] = 0 as u8
159 if eo > 0 {
160 var dup: i64 = 0
161 var d: i64 = 0
162 while d < nseen { if ps_streq(seen[d] as *u8, elf) == 1 { dup = 1 } d = d + 1 }
163 if dup == 0 {
164 if nseen < PS_MAXROW { seen[nseen] = elf as i64; nseen = nseen + 1 } else { over = 1 }
165 rows = rows + 1
166 var bs: i64 = 0
167 var q: i64 = 0
168 while q < eo { if (elf[q] as i64) == 47 { bs = q + 1 } q = q + 1 }
169 var te: i64 = eo
170 if eo >= 4 {
171 if (elf[eo-4] as i64) == 46 { if (elf[eo-3] as i64) == 101 {
172 if (elf[eo-2] as i64) == 108 { if (elf[eo-1] as i64) == 102 { te = eo - 4 } } } }
173 }
174 let bp: *u8 = sys_mmap(PS_NAMEMAX)
175 var bo: i64 = 0
176 var bi: i64 = 0
177 while broot[bi] != (0 as u8) { bp[bo] = broot[bi]; bo = bo + 1; bi = bi + 1 }
178 var m: i64 = bs
179 while m < te { bp[bo] = elf[m]; bo = bo + 1; m = m + 1 }
180 let sfx: *u8 = ".sov.elf" as *u8
181 var si: i64 = 0
182 while sfx[si] != (0 as u8) { bp[bo] = sfx[si]; bo = bo + 1; si = si + 1 }
183 bp[bo] = 0 as u8
184
185 let ssz: i64 = ps_size(elf)
186 let bsz: i64 = ps_size(bp)
187 if ssz < 0 { noserved = noserved + 1 } else {
188 if bsz < 0 { nobuild = nobuild + 1 } else {
189 var differ: i64 = 0
190 if ssz != bsz { differ = 1 } else {
191 if ps_same(elf, bp) == 0 { differ = 1 }
192 }
193 if differ == 1 {
194 stale = stale + 1
195 ps_puts(" " as *u8); ps_puts(elf)
196 ps_puts(" served=" as *u8); ps_pn(ssz)
197 ps_puts(" built=" as *u8); ps_pn(bsz)
198 ps_puts("\n" as *u8)
199 } else { identical = identical + 1 }
200 }
201 }
202 }
203 }
204 }
205 }
206 }
207 i = e + 1
208 }
209
210 if over == 1 {
211 ps_puts("SERVEDRIFT REFUSE: distinct-binary table exceeded capacity -- a partial census published\n" as *u8)
212 ps_puts("as a total is the defect this organ exists to find. Raise PS_MAXROW and re-run.\n" as *u8)
213 sys_exit(5)
214 return 5
215 }
216 if rows == 0 { ps_puts("SERVEDRIFT: no registry rows matched\n" as *u8); sys_exit(4); return 4 }
217 if stale == 0 { ps_puts(" (none)\n" as *u8) }
218
219 let sum: i64 = identical + stale + nobuild + noserved
220 ps_puts("\ndistinct_binaries=" as *u8); ps_pn(rows)
221 ps_puts(" IDENTICAL=" as *u8); ps_pn(identical)
222 ps_puts(" STALE=" as *u8); ps_pn(stale)
223 ps_puts(" NO-BUILD=" as *u8); ps_pn(nobuild)
224 ps_puts(" NO-SERVED=" as *u8); ps_pn(noserved)
225 ps_puts(" sum=" as *u8); ps_pn(sum)
226 if sum == rows { ps_puts(" partition=RECONCILES\n" as *u8) } else { ps_puts(" partition=LEAK\n" as *u8) }
227 ps_puts(" (NO-BUILD is CANNOT-JUDGE, never a pass: no build artifact exists to compare against.)\n" as *u8)
228 sys_exit(0)
229 return 0
230}