nx_site_release_gate_t141.nx source
↩ module page · 87 lines · 9146 B
1// Private real-artifact qualification; requires a newly created scratch CWD.
2import "nx_site_publish_release_candidate_t141.nx"
3import "nx_gate_verdict.nx"
4func rg_eq(path: *u8,b: *u8,n: i64) -> i64 {let got: *u8=sys_mmap(n+1);let size: i64=pb_read_bounded(path,got,n+1);let eq: i64=pb_same_bytes(got,size,b,n);sys_munmap(got,n+1);return eq}
5func rg_manifest(v: *i64) -> *u8 {
6 let b: *u8=sys_mmap(PB_CONFCAP);let p: *i64=sys_mmap(8) as *i64;p[0]=0
7 let keys: *i64=sys_mmap(RM_VALUES_BYTES) as *i64
8 keys[0]="schema" as *u8 as i64;keys[1]="site" as *u8 as i64;keys[2]="consumer_source" as *u8 as i64
9 keys[3]="consumer_path" as *u8 as i64;keys[4]="consumer_sha256" as *u8 as i64;keys[5]="consumer_bytes" as *u8 as i64
10 keys[6]="expected_live" as *u8 as i64;keys[7]="dependency_source" as *u8 as i64;keys[8]="dependency_path" as *u8 as i64
11 keys[9]="dependency_sha256" as *u8 as i64;keys[10]="dependency_bytes" as *u8 as i64;keys[11]="registration" as *u8 as i64
12 pb_app(b,p,"{");var i: i64=0;while i<RM_FIELDS{if i>0{pb_app(b,p,",")};pb_app(b,p,"\"");pb_app(b,p,keys[i] as *u8);pb_app(b,p,"\":\"");pb_app(b,p,v[i] as *u8);pb_app(b,p,"\"");i=i+1};pb_app(b,p,"}\n")
13 sys_munmap(keys as *u8,RM_VALUES_BYTES);sys_munmap(p as *u8,8);return b
14}
15func rg_call(v: *i64) -> i64 {let b: *u8=rg_manifest(v);let h: *u8=sys_mmap(PB_SHA_HEX+1);pb_hash(b,vw_slen(b),h);ss_writefile("release.json",b,vw_slen(b));let av: *i64=sys_mmap(5*8) as *i64;av[0]="nx_site_publish" as *u8 as i64;av[1]="release-manifest" as *u8 as i64;av[2]="release.json" as *u8 as i64;av[3]=h as i64;av[4]=0;let rc: i64=sp_main(4,av);sys_munmap(b,PB_CONFCAP);sys_munmap(h,PB_SHA_HEX+1);sys_munmap(av as *u8,40);return rc}
16func rg_parse_text(b: *u8) -> i64 {let v: *i64=sys_mmap(RM_VALUES_BYTES) as *i64;return rm_parse(b,vw_slen(b),v)}
17func main(argc: i64,argv: *i64) -> i64 {
18 if argc!=4{return 2}
19 let page: *i64=sys_mmap(16) as *i64;let dep: *i64=sys_mmap(16) as *i64
20 if rm_artifact(argv[2] as *u8,"1147239","349e55ad736edabebbda30e201a38550d54a8b879fad511fc74724e86bd5953c",page)!=0{return 3}
21 if rm_artifact(argv[3] as *u8,"389535","ff946352f88107828acd6206aeb5e7ab67eca01e93fc070449959439f38856fd",dep)!=0{return 3}
22 if sys_mkdir(argv[1] as *u8,0x1ed)!=0{return 2};if sys_chdir(argv[1] as *u8)!=0{return 2}
23 let preserved: i64=sys_openat_wr("gate-stdout-handle",FSX_MODE_RW);if preserved<0{return 4}
24 if sys_dup3(1,preserved,0)<0{return 4}
25 let capture: i64=sys_openat_wr("gate-output.txt",FSX_MODE_RW);if capture<0{return 4}
26 if sys_dup3(capture,1,0)<0{return 4}
27 let pass: *i64=gv_ctr()
28 sys_mkdir("knowledge",0x1ed);sys_mkdir("sites",0x1ed);sys_mkdir("sites/gatesite",0x1ed);sys_mkdir("sites/gatesite/beta",0x1ed);sys_mkdir("sites/gatesite/releases",0x1ed)
29 let conf: *u8="gatesite\tsites/gatesite\tknowledge/pub-\thttps://example.invalid\tGate\tprivate/\n"
30 ss_writefile("knowledge/pub_sites.conf",conf,vw_slen(conf))
31 let seed: *i64=ss_begin_cap(64);ss_add(seed,1,"q:n","0",1);ss_commit("knowledge/pub-",seed,ss_next_segid("knowledge/pub-"))
32 pl_register_asset("knowledge/pub-","beta/beach.html","isolated release gate")
33 ss_writefile("page.html",page[0] as *u8,page[1]);ss_writefile("engine.wasm",dep[0] as *u8,dep[1])
34 let old: *u8="<h1>predecessor</h1>";ss_writefile("sites/gatesite/beta/beach.html",old,vw_slen(old));let oldhash: *u8=sys_mmap(PB_SHA_HEX+1);pb_hash(old,vw_slen(old),oldhash)
35 let v: *i64=sys_mmap(RM_VALUES_BYTES) as *i64
36 v[0]=RM_SCHEMA as i64;v[1]="gatesite" as *u8 as i64;v[2]="page.html" as *u8 as i64;v[3]="beta/beach.html" as *u8 as i64
37 v[4]="349e55ad736edabebbda30e201a38550d54a8b879fad511fc74724e86bd5953c" as *u8 as i64;v[5]="1147239" as *u8 as i64;v[6]=oldhash as i64
38 v[7]="engine.wasm" as *u8 as i64;v[8]="releases/craft-mt-ff946352f88107828acd6206aeb5e7ab67eca01e93fc070449959439f38856fd.wasm" as *u8 as i64
39 v[9]="ff946352f88107828acd6206aeb5e7ab67eca01e93fc070449959439f38856fd" as *u8 as i64;v[10]="389535" as *u8 as i64;v[11]="allow" as *u8 as i64
40 gv_check("receipt-unavailable-stops-before-registration",rg_call(v)==FSX_RC_IO&&pr_check("knowledge/pub-",v[8] as *u8,v[9] as *u8)!=PR_OK,pass)
41 sys_mkdir("knowledge/gates",0x1ed)
42 v[11]="existing-only" as *u8 as i64
43 gv_check("explicit-existing-only-does-not-register",rg_call(v)!=0&&pr_check("knowledge/pub-",v[8] as *u8,v[9] as *u8)!=PR_OK,pass)
44 v[11]="allow" as *u8 as i64
45 let saved: i64=v[4];v[4]=oldhash as i64;gv_check("wrong-consumer-hash-preflight-refused",rg_call(v)==PB_RC_CONFLICT,pass);v[4]=saved
46 v[10]="389534" as *u8 as i64;gv_check("trailing-dependency-byte-refused",rg_call(v)==PB_RC_CONFLICT,pass);v[10]="389535" as *u8 as i64
47 let rel: i64=v[8];v[8]="releases/not-selected.wasm" as *u8 as i64;gv_check("missing-consumer-edge-refused",rg_call(v)==PB_RC_CONFLICT,pass);v[8]=rel
48 gv_check("preflight-refusals-left-registration-absent",pr_check("knowledge/pub-",v[8] as *u8,v[9] as *u8)!=PR_OK,pass)
49 let lockpath: *u8="sites/gatesite/releases/craft-mt-ff946352f88107828acd6206aeb5e7ab67eca01e93fc070449959439f38856fd.wasm.publish-lock"
50 let lock: i64=sys_openat_wr(lockpath,FSX_MODE_RW);sys_flock(lock,PB_LOCK_EX_NB)
51 gv_check("dependency-lock-refuses-stage",rg_call(v)==PB_RC_BUSY,pass)
52 gv_check("registration-retained-after-stage-contention",pr_check("knowledge/pub-",v[8] as *u8,v[9] as *u8)==PR_OK,pass)
53 gv_check("contention-retains-consumer",rg_eq("sites/gatesite/beta/beach.html",old,vw_slen(old))==1,pass);sys_close(lock)
54 gv_check("one-call-retry-publishes-real-page",rg_call(v)==0,pass)
55 gv_check("real-page-byte-identity",rg_eq("sites/gatesite/beta/beach.html",page[0] as *u8,page[1])==1,pass)
56 gv_check("real-wasm-byte-identity",rg_eq("sites/gatesite/releases/craft-mt-ff946352f88107828acd6206aeb5e7ab67eca01e93fc070449959439f38856fd.wasm",dep[0] as *u8,dep[1])==1,pass)
57 gv_check("predecessor-preserved",rg_eq("sites/gatesite/beta/beach.html.prev",old,vw_slen(old))==1,pass)
58 gv_check("identical-retry-keeps-original-precondition",rg_call(v)==0&&rg_eq("sites/gatesite/beta/beach.html.prev",old,vw_slen(old))==1,pass)
59 v[11]="existing-only" as *u8 as i64;gv_check("existing-only-succeeds-after-registration",rg_call(v)==0,pass);v[11]="allow" as *u8 as i64
60 let newer: *u8=sys_mmap(page[1]+1);var i: i64=0;while i<page[1]{newer[i]=(page[0] as *u8)[i];i=i+1};newer[i]=10
61 let newhash: *u8=sys_mmap(PB_SHA_HEX+1);pb_hash(newer,page[1]+1,newhash);ss_writefile("new.html",newer,page[1]+1)
62 v[2]="new.html" as *u8 as i64;v[4]=newhash as i64;v[5]="1147240" as *u8 as i64
63 gv_check("stale-prior-refuses-new-consumer",rg_call(v)==PB_RC_CONFLICT&&rg_eq("sites/gatesite/beta/beach.html",page[0] as *u8,page[1])==1,pass)
64 v[6]=saved
65 let consumerlock: i64=sys_openat_wr("sites/gatesite/beta/beach.html.publish-lock",FSX_MODE_RW);sys_flock(consumerlock,PB_LOCK_EX_NB)
66 gv_check("consumer-lock-refuses-placement",rg_call(v)==PB_RC_BUSY,pass);sys_close(consumerlock)
67 gv_check("correct-prior-publishes-changed-consumer",rg_call(v)==0,pass)
68 gv_check("changed-retry-retains-last-different-version",rg_call(v)==0&&rg_eq("sites/gatesite/beta/beach.html.prev",page[0] as *u8,page[1])==1,pass)
69 let json: *u8=rg_manifest(v);let hash: *u8=sys_mmap(PB_SHA_HEX+1);pb_hash(json,vw_slen(json),hash)
70 let receipt: *u8=sys_mmap(PB_PATH);let p: *i64=sys_mmap(8) as *i64;p[0]=0;pb_app(receipt,p,RM_RECEIPT_ROOT);pb_app(receipt,p,"site-release-");pb_app(receipt,p,hash);pb_app(receipt,p,".jsonl")
71 let log: *u8=sys_mmap(PB_CONFCAP);let ln: i64=pb_read_bounded(receipt,log,PB_CONFCAP)
72 gv_check("durable-receipt-names-published-review-pending",ln>0&&fsx_find(log,ln,"published-served-review-pending")>=0,pass)
73 gv_check("durable-receipt-retains-publish-contention",fsx_find(log,ln,"waiting-owner-retry-required")>=0,pass)
74 let bank: *u8=sys_mmap(PB_PATH);p[0]=0;pb_app(bank,p,RM_RECEIPT_ROOT);pb_app(bank,p,"site-release-");pb_app(bank,p,hash);pb_app(bank,p,".manifest.json")
75 gv_check("exact-authorization-manifest-retained",rg_eq(bank,json,vw_slen(json))==1,pass)
76 gv_check("receipt-identifies-attempt-process",fsx_find(log,ln,"attempt_pid")>=0,pass)
77 gv_check("duplicate-key-refused",rg_parse_text("{\"schema\":\"site-release/v1\",\"schema\":\"site-release/v1\"}")==PB_RC_USAGE,pass)
78 gv_check("unknown-key-refused",rg_parse_text("{\"oops\":\"x\"}")==PB_RC_USAGE,pass)
79 gv_check("missing-fields-refused",rg_parse_text("{\"schema\":\"site-release/v1\"}")==PB_RC_USAGE,pass)
80 let av: *i64=sys_mmap(5*8) as *i64;av[0]="nx_site_publish" as *u8 as i64;av[1]="release-manifest" as *u8 as i64;av[2]="release.json" as *u8 as i64;av[3]=oldhash as i64;av[4]=0
81 gv_check("manifest-identity-mismatch-refused",sp_main(4,av)==PB_RC_CONFLICT,pass)
82 let verdict: i64=gv_verdict("SITE-RELEASE-GATE",pass,"actual Beach artifacts in isolated docroot; registration authority, locks, exact extents, safe retry and durable phase outcomes; browser review remains pending")
83 if sys_fsync(capture)!=0{return 4};if sys_dup3(preserved,1,0)<0{return 4}
84 sys_close(capture);sys_close(preserved)
85 fsx_puts("Full per-case evidence: ");fsx_puts(argv[1] as *u8);fsx_puts("/gate-output.txt\n")
86 return gv_verdict("SITE-RELEASE-GATE",pass,"full output retained in gate-output.txt; native artifact qualification only")
87}