code wiki / _hdl_build / nx_sovgit_push.nx
`nx_sovgit_push.nx` source

↩ module page · 1139 lines · 50886 B
1// nx_sovgit_push.nx -- ★SOVGIT F222: the SOVEREIGN GIT PUSHER. Snapshots a working tree and pushes it to a
2// sovgit host speaking the git receive-pack CLIENT wire, with ZERO /usr/bin/git anywhere in the path.
3// This is the no-git-law end-state for the replication leg: walk -> X0 sha256 objects -> X1b packfile ->
4// pkt-line ref-update + pack over HTTP -> report-status. The ark's crash-durability beat becomes sovereign.
5//
6// WHY A SNAPSHOT (not a git-history mirror): stock git CANNOT push a sha1 repo to a sha256 remote (no interop),
7// so the sovereign leg re-frames the working tree as sha256 objects. Each push chains a commit onto the remote
8// ref (parent = the advertised old sha) so history is preserved additively (rule 13) -- exactly the ark's job.
9//
10// SCALE ENVELOPE (declared in output, guarded in code, fail LOUD -- never a silent partial snapshot):
11//   entries per directory <= 20000     name bytes per directory <= 2 MiB     tree depth <= 32
12//   single file <= 64 MiB              pack <= 128 MiB                       path <= 4096
13//   skipped by design: .git, symlinks + special files, and SECRET MATERIAL (deny-by-construction:
14//     secret/passw/token/credential/.pem/.cap/.key/_key(s)/privkey/id_rsa/id_ed25519/_seed.bin/opaque)
15//     -- every exclusion is COUNTED and NAMED on stderr, never silently dropped
16//   ⚠the SERVER's request envelope also binds (nx_sovgit_git req buffer); a push above it is refused there.
17// Transport rung 1 = loopback TCP (127.0.0.1:<port>) -- the daemon is wall-only by design; the TLS/edge
18// transport for off-box pushes is the sibling rung (compose mcl_req-class primitives).
19// license_tier: ORIGINAL
20import "nx_sovgit_obj.nx"
21import "nx_connect.nx"   // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
22// TLS transport (rung 2) -- the SAME request bytes over sovereign TLS-1.3 so an OFF-BOX (laptop) ark
23// can push to the hub through the edge. Composes the proven nx_mgmt_client stack, nothing new invented.
24import "nx_acme_http.nx"
25import "nx_https_url_for_fetch.nx"
26import "nx_https_url_connect.nx"
27import "nx_tls13_client_session_run.nx"
28import "nx_tls13_client_session.nx"
29import "nx_tls13.nx"
30import "nx_tls13_record.nx"
31import "nx_tls13_read_record_from_fd.nx"
32import "nx_csprng.nx"
33const SGP_MAGIC_131072: i64 = 131072
34const SGP_MAGIC_61440: i64 = 61440
35const SGP_MAGIC_16384: i64 = 16384
36const SGP_MAGIC_32768: i64 = 32768
37const SGP_MAGIC_16645: i64 = 16645
38const SGP_MAGIC_2048: i64 = 2048
39const SGP_MAGIC_18691: i64 = 18691
40const SGP_MAGIC_4194304: i64 = 4194304
41const SGP_MAGIC_8192: i64 = 8192
42const SGP_MAGIC_1024: i64 = 1024
43const SGP_MAGIC_65536: i64 = 65536
44const SGP_MAGIC_4096: i64 = 4096
45
46// ★MEASURED 2026-07-20 (debt seq334): pushing a body larger than this THROUGH THE EDGE does not merely
47// fail -- it drove sites.elf into a crash loop and took every public site down twice. Bodies <=1.4MB
48// succeeded consistently. So the client REFUSES to send an over-safe body over the edge rather than
49// discover the limit by knocking the web surface over. Loopback (on-box, no edge in the path) is
50// unaffected. Remove this only when the edge itself refuses over-cap bodies with a bounded 413.
51const SGP_EDGE_SAFE: i64 = 1400000
52const SGP_MAX_OBJ: i64 = 200000
53const SGP_HS_SIZE: i64 = 524288
54const SGP_MAX_ENT: i64 = 20000
55const SGP_NAMEARENA: i64 = 2097152
56const SGP_MAX_DEPTH: i64 = 32
57const SGP_MAX_FILE: i64 = 67108864
58const SGP_PACK_CAP: i64 = 134217728
59const SGP_PATHBUF: i64 = 4096
60const SGP_RESP: i64 = 65536
61
62// ---- byte / io helpers ----
63func sgp_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
64func sgp_we(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(2, s, n); return 0 }
65func sgp_wn(v: i64) -> i64 {
  let b: *u8 = sys_mmap(32)
  var x: i64 = v
  var neg: i64 = 0
  if x < 0 { neg = 1; x = 0 - x }
  var i: i64 = 31
  if x == 0 { b[i] = 48 as u8; i = i - 1 }
  while x > 0 { b[i] = (48 + x % 10) as u8; x = x / 10; i = i - 1 }
  if neg == 1 { b[i] = 45 as u8; i = i - 1 }
  sys_write(1, (b as i64 + i + 1) as *u8, 31 - i)
  sys_munmap(b, 32)
  return 0
77}
78func sgp_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
79func sgp_cat(dst: *u8, at: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { dst[at + i] = s[i]; i = i + 1 } return at + i }
80func sgp_dec(out: *u8, at: i64, v: i64) -> i64 {
  let tmp: *u8 = sys_mmap(32)
  var x: i64 = v
  var i: i64 = 31
  if x == 0 { tmp[i] = 48 as u8; i = i - 1 }
  while x > 0 { tmp[i] = (48 + x % 10) as u8; x = x / 10; i = i - 1 }
  var a: i64 = at
  var j: i64 = i + 1
  while j < 32 { out[a] = tmp[j]; a = a + 1; j = j + 1 }
  sys_munmap(tmp, 32)
  return a
91}
92func sgp_atoi(s: *u8) -> i64 {
  var v: i64 = 0
  var i: i64 = 0
  while s[i] != (0 as u8) {
      let c: i64 = s[i] as i64
      if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } }
      i = i + 1
  }
  return v
101}
102func sgp_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  var r: i64 = 1
  var go: i64 = 1
  while go == 1 {
      let ca: i64 = a[i] as i64
      let cb: i64 = b[i] as i64
      if ca != cb { r = 0; go = 0 } else { if ca == 0 { go = 0 } else { i = i + 1 } }
  }
  return r
112}
113// ---- SECRET EXCLUSION, deny-by-construction (rule 12: defensive at boundaries) ----
114// A tool that replicates a filesystem into a remote repo IS a boundary: without this, one push
115// silently exfiltrates private keys into a clonable repo forever (git history is additive -- an
116// accidental key push cannot be un-published). Mirrors the compiled-in nx_fs_write deny-list.
117// Needles are TARGETED so source files that merely IMPLEMENT crypto (nx_ed25519.nx) still ship,
118// while key MATERIAL (opaque_keys.bin, node_ed25519_seed.bin, tools_cap_secret.key) never does.
119// Every exclusion is COUNTED and NAMED on stderr -- over-denying is safe, silent denying is not.
120func sgp_lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
121func sgp_needle_ci(name: *u8, needle: *u8) -> i64 {
  let n: i64 = sgp_slen(name)
  let m: i64 = sgp_slen(needle)
  if m == 0 { return 0 }
  var i: i64 = 0
  while i + m <= n {
      var k: i64 = 0
      while k < m { if sgp_lc(name[i + k] as i64) != sgp_lc(needle[k] as i64) { k = m + 9 } else { k = k + 1 } }
      if k == m { return 1 }
      i = i + 1
  }
  return 0
133}
134// ---- DATA-DRIVEN IGNORE (rule 11: policy is DATA, never buried in code) ----
135// `<srcdir>/.sovgitignore`, one substring pattern per line (# comments + blanks skipped). Matched
136// case-insensitively against the ENTRY NAME. Needed for real trees: a huge constantly-rewritten log
137// (memory/worklog/worklog.tsv, 15MB) would blow the per-beat wire budget on every single beat.
138// Like the secret list, every exclusion is COUNTED and NAMED -- silent dropping is never acceptable.
139// pst[7] = pattern buffer ptr, pst[8] = pattern count, pst[9] = entries ignored.
140func sgp_load_ignore(srcdir: *u8, ibuf: *u8, icap: i64, pst: *i64) -> i64 {
  pst[7] = 0
  pst[8] = 0
  pst[9] = 0
  let p: *u8 = sys_mmap(SGP_PATHBUF)
  var o: i64 = sgp_cat(p, 0, srcdir)
  o = sgp_cat(p, o, "/.sovgitignore" as *u8)
  p[o] = 0 as u8
  let szp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sgp_read_file(p, szp)
  sys_munmap(p, SGP_PATHBUF)
  if (b as i64) == 0 { sys_munmap(szp as *u8, 16); return 0 }
  let n: i64 = szp[0]
  sys_munmap(szp as *u8, 16)
  var out: i64 = 0
  var cnt: i64 = 0
  var i: i64 = 0
  while i < n {
      // one line: [s, e) where e is the '\n' index (or n). The position MUST survive the scan --
      // collapsing the loop variable to sentinel loses it and yields ONE pattern = the whole file.
      let s: i64 = i
      var e: i64 = s
      var scan: i64 = 1
      while scan == 1 {
          if e >= n { scan = 0 } else {
              if b[e] == (10 as u8) { scan = 0 } else { e = e + 1 }
          }
      }
      i = e + 1
      var t: i64 = e
      if t > s { if b[t - 1] == (13 as u8) { t = t - 1 } }   // CRLF tolerated (Windows-authored)
      let len: i64 = t - s
      var keep: i64 = 1
      if len <= 0 { keep = 0 }
      if keep == 1 { if b[s] == (35 as u8) { keep = 0 } }          // '#'
      if keep == 1 { if out + len + 2 >= icap { keep = 0 } }
      if keep == 1 {
          var k: i64 = 0
          while k < len { ibuf[out + k] = b[s + k]; k = k + 1 }
          ibuf[out + len] = 0 as u8
          out = out + len + 1
          cnt = cnt + 1
      }
  }
  sys_munmap(b, n + 16)
  pst[7] = ibuf as i64
  pst[8] = cnt
  return cnt
188}
189func sgp_is_ignored(name: *u8, pst: *i64) -> i64 {
  if pst[8] <= 0 { return 0 }
  let ibuf: *u8 = pst[7] as *u8
  var idx: i64 = 0
  var off: i64 = 0
  while idx < pst[8] {
      let pat: *u8 = (ibuf as i64 + off) as *u8
      if sgp_needle_ci(name, pat) == 1 { return 1 }
      off = off + sgp_slen(pat) + 1
      idx = idx + 1
  }
  return 0
201}
202// ⚠MEASURED 2026-07-20 on the real memory corpus: bare substring needles ATE 17 legitimate knowledge
203// files (feedback-token-economy-ai-layer-cost-axis.md, feedback-no-hardcoded-secrets-config-driven.md,
204// flux-token-taxonomy.md ...). For a BACKUP that is data loss. Key material is never a document, so
205// document/source extensions are exempt from the needle sweep. This does NOT weaken real protection:
206// filename matching never inspected content, so it never protected against a token QUOTED inside a
207// .md anyway -- it only ever guarded key FILES (.key/.pem/.bin/.cap), which stay fully covered.
208func sgp_is_doc_ext(name: *u8) -> i64 {
  let n: i64 = sgp_slen(name)
  if n >= 3 { if sgp_needle_ci((name as i64 + n - 3) as *u8, ".md" as *u8) == 1 { return 1 } }
  if n >= 3 { if sgp_needle_ci((name as i64 + n - 3) as *u8, ".nx" as *u8) == 1 { return 1 } }
  if n >= 4 { if sgp_needle_ci((name as i64 + n - 4) as *u8, ".css" as *u8) == 1 { return 1 } }
  if n >= 5 { if sgp_needle_ci((name as i64 + n - 5) as *u8, ".html" as *u8) == 1 { return 1 } }
  return 0
215}
216func sgp_is_secret(name: *u8) -> i64 {
  if sgp_is_doc_ext(name) == 1 { return 0 }
  if sgp_needle_ci(name, "secret" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "passw" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "token" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "credential" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, ".pem" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, ".cap" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, ".key" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "_key" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "_keys" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "privkey" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "private_key" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "id_rsa" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "id_ed25519" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "_seed.bin" as *u8) == 1 { return 1 }
  if sgp_needle_ci(name, "opaque" as *u8) == 1 { return 1 }
  return 0
234}
235func sgp_isdots(nm: *u8) -> i64 {
  if nm[0] == (46 as u8) {
      if nm[1] == (0 as u8) { return 1 }
      if nm[1] == (46 as u8) { if nm[2] == (0 as u8) { return 1 } }
  }
  return 0
241}
242// path[base] = '/' then name; NUL-terminate; return new length
243func sgp_join(buf: *u8, base: i64, name: *u8) -> i64 {
  buf[base] = 47 as u8
  var o: i64 = base + 1
  var i: i64 = 0
  while name[i] != (0 as u8) { buf[o] = name[i]; o = o + 1; i = i + 1 }
  buf[o] = 0 as u8
  return o
250}
251// little-endian u32 out of a struct stat field
252func sgp_u32(b: *u8, at: i64) -> i64 {
  return (b[at] as i64) | ((b[at + 1] as i64) << 8) | ((b[at + 2] as i64) << 16) | ((b[at + 3] as i64) << 24)
254}
255// bounded file read (NEVER sys_read_file: its 4 GiB fallback cap fires on every 0-byte file).
256// FAILS LOUD on a short read -- a truncated blob would hash + push as VALID-looking wrong content,
257// the worst failure class. On success out_len[0]==the mapped size, so the caller's munmap is exact.
258func sgp_read_file(path: *u8, out_len: *i64) -> *u8 {
  out_len[0] = 0
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 as *u8 }
  let sz: i64 = sys_lseek(fd, 0, 2)
  sys_lseek(fd, 0, 0)
  if sz < 0 { sys_close(fd); return 0 as *u8 }
  let buf: *u8 = sys_mmap(sz + 16)
  var tot: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if tot >= sz { go = 0 } else {
          let n: i64 = sys_read(fd, (buf as i64 + tot) as *u8, sz - tot)
          if n <= 0 { go = 0 } else { tot = tot + n }
      }
  }
  sys_close(fd)
  if tot != sz { sys_munmap(buf, sz + 16); return 0 as *u8 }
  out_len[0] = tot
  return buf
278}
279
280// ---- packfile (X1b) ----
281func sgp_be32(out: *u8, at: i64, v: i64) -> i64 {
  out[at] = ((v >> 24) & 255) as u8
  out[at + 1] = ((v >> 16) & 255) as u8
  out[at + 2] = ((v >> 8) & 255) as u8
  out[at + 3] = (v & 255) as u8
  return at + 4
287}
288func sgp_objhdr(out: *u8, at: i64, typ: i64, size: i64) -> i64 {
  var a: i64 = at
  var b: i64 = (typ << 4) | (size & 15)
  var s: i64 = size >> 4
  while s > 0 { out[a] = (b | 128) as u8; a = a + 1; b = s & 127; s = s >> 7 }
  out[a] = b as u8; a = a + 1
  return a
295}
296// pst: [0]=offset [1]=object count [2]=overflow flag
297func sgp_pack_begin(pack: *u8, pst: *i64) -> i64 {
  pack[0] = 80 as u8; pack[1] = 65 as u8; pack[2] = 67 as u8; pack[3] = 75 as u8
  var o: i64 = sgp_be32(pack, 4, 2)
  o = sgp_be32(pack, o, 0)
  pst[0] = o
  pst[1] = 0
  pst[2] = 0
  return 0
305}
306// append one object; fixed-Huffman deflate EXPANDS high-entropy data ~1.3x so the guard reserves 1.5x
307func sgp_pack_add(pack: *u8, pst: *i64, typ: i64, content: *u8, clen: i64) -> i64 {
  if pst[2] != 0 { return 0 - 1 }
  if pst[0] + clen + (clen >> 1) + 256 > SGP_PACK_CAP - 64 { pst[2] = 1; return 0 - 1 }
  var a: i64 = sgp_objhdr(pack, pst[0], typ, clen)
  let z: *u8 = (pack as i64 + a) as *u8
  let zl: i64 = sg_zwrap(content, clen, z)
  pst[0] = a + zl
  pst[1] = pst[1] + 1
  return 0
316}
317// ---- INCREMENTAL PACKS: a PROVEN-have cache ----
318// Soundness: the remote's ref only advances AFTER `unpack ok`, so if the advert's old ref equals the
319// commit we cached from our last successful push, the remote PROVABLY holds that snapshot's whole
320// object set -- those objects can be skipped. ANY mismatch (someone else pushed, cache lost, repo
321// reset) falls back to a full thick pack. Fail-safe BY CONSTRUCTION: we never skip on an assumption,
322// only on a server-confirmed fact. A wrong skip would produce a repo that clones with "missing blob".
323// Cache file = [32B commit][32B object]*N under knowledge/sovgit_have/.
324func sgp_hs_hash(sha: *u8, mask: i64) -> i64 {
  var h: i64 = 0
  var i: i64 = 0
  while i < 7 { h = (h << 8) | (sha[i] as i64); i = i + 1 }   // 7 bytes: never sets the sign bit
  return h & mask
329}
330func sgp_hs_build(shas: *u8, n: i64, table: *i64, tsize: i64) -> i64 {
  var i: i64 = 0
  while i < tsize { table[i] = 0; i = i + 1 }
  let mask: i64 = tsize - 1
  i = 0
  while i < n {
      let s: *u8 = (shas as i64 + i * 32) as *u8
      var slot: i64 = sgp_hs_hash(s, mask)
      var placed: i64 = 0
      while placed == 0 {
          if table[slot] == 0 { table[slot] = i + 1; placed = 1 } else { slot = (slot + 1) & mask }
      }
      i = i + 1
  }
  return 0
345}
346func sgp_hs_has(shas: *u8, table: *i64, tsize: i64, q: *u8) -> i64 {
  if tsize <= 0 { return 0 }
  let mask: i64 = tsize - 1
  var slot: i64 = sgp_hs_hash(q, mask)
  var res: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let v: i64 = table[slot]
      if v == 0 { go = 0 } else {
          let s: *u8 = (shas as i64 + (v - 1) * 32) as *u8
          var k: i64 = 0
          while k < 32 { if s[k] != q[k] { k = 40 } else { k = k + 1 } }
          if k == 32 { res = 1; go = 0 } else { slot = (slot + 1) & mask }
      }
  }
  return res
362}
363// cache path: knowledge/sovgit_have/<repo>_<ref with '/' -> '_'>
364func sgp_havepath(dst: *u8, repo: *u8, ref: *u8) -> i64 {
  var o: i64 = sgp_cat(dst, 0, "knowledge/sovgit_have/" as *u8)
  o = sgp_cat(dst, o, repo)
  dst[o] = 95 as u8; o = o + 1
  var i: i64 = 0
  while ref[i] != (0 as u8) {
      if ref[i] == (47 as u8) { dst[o] = 95 as u8 } else { dst[o] = ref[i] }
      o = o + 1; i = i + 1
  }
  dst[o] = 0 as u8
  return o
375}
376// record every object of the snapshot, and pack it ONLY if the remote does not provably have it
377func sgp_emit(pack: *u8, pst: *i64, typ: i64, content: *u8, clen: i64, raw32: *u8, allshas: *u8, hshas: *u8, htab: *i64) -> i64 {
  if pst[3] >= SGP_MAX_OBJ { pst[2] = 1; return 0 - 1 }
  let d: *u8 = (allshas as i64 + pst[3] * 32) as *u8
  var i: i64 = 0
  while i < 32 { d[i] = raw32[i]; i = i + 1 }
  pst[3] = pst[3] + 1
  if pst[5] > 0 { if sgp_hs_has(hshas, htab, pst[5], raw32) == 1 { pst[6] = pst[6] + 1; return 0 } }
  return sgp_pack_add(pack, pst, typ, content, clen)
385}
386func sgp_pack_end(pack: *u8, pst: *i64) -> i64 {
  sgp_be32(pack, 8, pst[1])
  let dig: *u8 = sys_mmap(32)
  sha256_digest(pack, pst[0], dig)
  var i: i64 = 0
  while i < 32 { pack[pst[0]] = dig[i]; pst[0] = pst[0] + 1; i = i + 1 }
  sys_munmap(dig, 32)
  return pst[0]
394}
395
396// ---- git tree entry ordering: names compare as if a directory carried a trailing '/' ----
397func sgp_chr(s: *u8, n: i64, isdir: i64, i: i64) -> i64 {
  if i < n { return s[i] as i64 }
  if i == n { if isdir == 1 { return 47 } }
  return 0 - 1
401}
402func sgp_keycmp(a: *u8, an: i64, ad: i64, b: *u8, bn: i64, bd: i64) -> i64 {
  var i: i64 = 0
  var r: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let ca: i64 = sgp_chr(a, an, ad, i)
      let cb: i64 = sgp_chr(b, bn, bd, i)
      if ca < cb { r = 0 - 1; go = 0 } else {
          if ca > cb { r = 1; go = 0 } else {
              if ca < 0 { r = 0; go = 0 } else { i = i + 1 }
          }
      }
  }
  return r
416}
417func sgp_entcmp(arena: *u8, noff: *i64, nlen: *i64, isdir: *i64, x: i64, y: i64) -> i64 {
  let ax: *u8 = (arena as i64 + noff[x]) as *u8
  let ay: *u8 = (arena as i64 + noff[y]) as *u8
  return sgp_keycmp(ax, nlen[x], isdir[x], ay, nlen[y], isdir[y])
421}
422// bottom-up merge sort (O(n log n)): a 15k-file directory makes insertion sort quadratic = minutes
423func sgp_msort(arena: *u8, noff: *i64, nlen: *i64, isdir: *i64, idx: *i64, aux: *i64, n: i64) -> i64 {
  var width: i64 = 1
  while width < n {
      var i: i64 = 0
      while i < n {
          var mid: i64 = i + width
          var hi: i64 = i + width + width
          if mid > n { mid = n }
          if hi > n { hi = n }
          var a: i64 = i
          var b: i64 = mid
          var o: i64 = i
          while o < hi {
              var take: i64 = 0
              if a >= mid { take = 1 } else {
                  if b >= hi { take = 0 } else {
                      let c: i64 = sgp_entcmp(arena, noff, nlen, isdir, idx[a], idx[b])
                      if c > 0 { take = 1 } else { take = 0 }
                  }
              }
              if take == 1 { aux[o] = idx[b]; b = b + 1 } else { aux[o] = idx[a]; a = a + 1 }
              o = o + 1
          }
          i = i + width + width
      }
      var k: i64 = 0
      while k < n { idx[k] = aux[k]; k = k + 1 }
      width = width + width
  }
  return 0
453}
454
455// ---- the recursive snapshot walk ----
456// stats: [0]=files [1]=dirs [2]=skipped-special [3]=content bytes
457// out_ecount receives this directory's entry count (0 => an empty dir; git cannot track one, so the
458// PARENT omits it, keeping a stock-git round-trip diff clean).
459func sgp_walk(path: *u8, plen: i64, pack: *u8, pst: *i64, depth: i64, out_sha32: *u8, out_ecount: *i64, stats: *i64, allshas: *u8, hshas: *u8, htab: *i64) -> i64 {
  out_ecount[0] = 0
  if depth > SGP_MAX_DEPTH { return 0 - 3 }
  path[plen] = 0 as u8
  let dfd: i64 = sys_openat_rd(path)
  if dfd < 0 { return 0 - 4 }
  let arena: *u8 = sys_mmap(SGP_NAMEARENA)
  let noff: *i64 = sys_mmap(SGP_MAX_ENT * 8) as *i64
  let nlen: *i64 = sys_mmap(SGP_MAX_ENT * 8) as *i64
  let isdir: *i64 = sys_mmap(SGP_MAX_ENT * 8) as *i64
  let isexe: *i64 = sys_mmap(SGP_MAX_ENT * 8) as *i64
  let idx: *i64 = sys_mmap(SGP_MAX_ENT * 8) as *i64
  let aux: *i64 = sys_mmap(SGP_MAX_ENT * 8) as *i64
  let shas: *u8 = sys_mmap(SGP_MAX_ENT * 32)
  let dbuf: *u8 = sys_mmap(SGP_MAGIC_131072)
  let stbuf: *u8 = sys_mmap(160)
  let szp: *i64 = sys_mmap(16) as *i64
  let ecb: *i64 = sys_mmap(16) as *i64
  var nent: i64 = 0
  var apos: i64 = 0
  var err: i64 = 0
  var go: i64 = 1
  while go == 1 {
      let nr: i64 = sys_getdents64(dfd, dbuf, SGP_MAGIC_131072)
      if nr <= 0 { go = 0 } else {
          var off: i64 = 0
          while off < nr {
              let rec: *u8 = (dbuf as i64 + off) as *u8
              let nm: *u8 = dirent_name(rec)
              var skip: i64 = 0
              if err != 0 { skip = 1 }
              if sgp_isdots(nm) == 1 { skip = 1 }
              if sgp_streq(nm, ".git" as *u8) == 1 { skip = 1 }
              if skip == 0 { if sgp_is_ignored(nm, pst) == 1 {
                  skip = 1
                  pst[9] = pst[9] + 1
                  sgp_we("SKIP-IGNORED " as *u8); sgp_we(nm); sgp_we("\n" as *u8)
              } }
              if skip == 0 { if sgp_is_secret(nm) == 1 {
                  skip = 1
                  stats[4] = stats[4] + 1
                  sgp_we("SKIP-SECRET " as *u8); sgp_we(nm); sgp_we("\n" as *u8)
              } }
              if skip == 0 {
                  let nl: i64 = sgp_slen(nm)
                  if nent >= SGP_MAX_ENT { err = 0 - 5 } else {
                  if apos + nl + 2 >= SGP_NAMEARENA { err = 0 - 6 } else {
                  if plen + nl + 2 >= SGP_PATHBUF { err = 0 - 7 } else {
                      let cl: i64 = sgp_join(path, plen, nm)
                      var keep: i64 = 0
                      var kdir: i64 = 0
                      var kexe: i64 = 0
                      let csha: *u8 = (shas as i64 + nent * 32) as *u8
                      if sys_fstatat(path, stbuf) < 0 { stats[2] = stats[2] + 1 } else {
                          let mode: i64 = sgp_u32(stbuf, 24)
                          let fmt: i64 = mode & SGP_MAGIC_61440
                          if fmt == SGP_MAGIC_16384 {
                              let rr: i64 = sgp_walk(path, cl, pack, pst, depth + 1, csha, ecb, stats, allshas, hshas, htab)
                              if rr != 0 { err = rr } else {
                                  if ecb[0] > 0 { keep = 1; kdir = 1; stats[1] = stats[1] + 1 }
                              }
                          } else {
                              if fmt == SGP_MAGIC_32768 {
                                  let content: *u8 = sgp_read_file(path, szp)
                                  if (content as i64) == 0 { err = 0 - 8 } else {
                                      let clen: i64 = szp[0]
                                      if clen > SGP_MAX_FILE { err = 0 - 9 } else {
                                          sg_oid_raw("blob" as *u8, content, clen, csha)
                                          if sgp_emit(pack, pst, 3, content, clen, csha, allshas, hshas, htab) != 0 { err = 0 - 10 } else {
                                              keep = 1
                                              if (mode & 73) != 0 { kexe = 1 }
                                              stats[0] = stats[0] + 1
                                              stats[3] = stats[3] + clen
                                          }
                                      }
                                      sys_munmap(content, szp[0] + 16)
                                  }
                              } else { stats[2] = stats[2] + 1 }
                          }
                      }
                      if keep == 1 {
                          noff[nent] = apos
                          nlen[nent] = nl
                          var k: i64 = 0
                          while k < nl { arena[apos + k] = nm[k]; k = k + 1 }
                          arena[apos + nl] = 0 as u8
                          apos = apos + nl + 1
                          isdir[nent] = kdir
                          isexe[nent] = kexe
                          nent = nent + 1
                      }
                  } } }
              }
              off = off + dirent_reclen(rec)
          }
      }
  }
  sys_close(dfd)
  if err == 0 {
      var i: i64 = 0
      while i < nent { idx[i] = i; i = i + 1 }
      sgp_msort(arena, noff, nlen, isdir, idx, aux, nent)
      var tcap: i64 = 128
      i = 0
      while i < nent { tcap = tcap + nlen[i] + 48; i = i + 1 }
      let tree: *u8 = sys_mmap(tcap)
      var to: i64 = 0
      i = 0
      while i < nent {
          let e: i64 = idx[i]
          let nmp: *u8 = (arena as i64 + noff[e]) as *u8
          var modestr: *u8 = "100644" as *u8
          if isdir[e] == 1 { modestr = "40000" as *u8 } else { if isexe[e] == 1 { modestr = "100755" as *u8 } }
          let rawp: *u8 = (shas as i64 + e * 32) as *u8
          to = sg_tree_entry(tree, to, modestr, nmp, rawp)
          i = i + 1
      }
      sg_oid_raw("tree" as *u8, tree, to, out_sha32)
      if sgp_emit(pack, pst, 2, tree, to, out_sha32, allshas, hshas, htab) != 0 { err = 0 - 10 }
      sys_munmap(tree, tcap)
      out_ecount[0] = nent
  }
  sys_munmap(arena, SGP_NAMEARENA)
  sys_munmap(noff as *u8, SGP_MAX_ENT * 8)
  sys_munmap(nlen as *u8, SGP_MAX_ENT * 8)
  sys_munmap(isdir as *u8, SGP_MAX_ENT * 8)
  sys_munmap(isexe as *u8, SGP_MAX_ENT * 8)
  sys_munmap(idx as *u8, SGP_MAX_ENT * 8)
  sys_munmap(aux as *u8, SGP_MAX_ENT * 8)
  sys_munmap(shas, SGP_MAX_ENT * 32)
  sys_munmap(dbuf, SGP_MAGIC_131072)
  sys_munmap(stbuf, 160)
  sys_munmap(szp as *u8, 16)
  sys_munmap(ecb as *u8, 16)
  return err
594}
595
596// ---- loopback HTTP transport (the daemon is wall-only: 127.0.0.1 by construction) ----
597func sgp_connect(port: i64) -> i64 {
  let fd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
  if fd < 0 { return 0 - 1 }
  let sa: *u8 = sys_mmap(16)
  var i: i64 = 0
  while i < 16 { sa[i] = 0 as u8; i = i + 1 }
  sa[0] = 2 as u8
  sa[2] = ((port >> 8) & 255) as u8
  sa[3] = (port & 255) as u8
  sa[4] = 127 as u8; sa[5] = 0 as u8; sa[6] = 0 as u8; sa[7] = 1 as u8
  let cr: i64 = nx_connect_bounded(fd, sa, 16, NX_CONN_DEFAULT_MS)
  sys_munmap(sa, 16)
  if cr < 0 { sys_close(fd); return 0 - 2 }
  return fd
611}
612func sgp_write_all(fd: i64, buf: *u8, n: i64) -> i64 {
  var off: i64 = 0
  var bad: i64 = 0
  while off < n {
      let w: i64 = sys_write(fd, (buf as i64 + off) as *u8, n - off)
      if w <= 0 { off = n; bad = 1 } else { off = off + w }
  }
  return bad
620}
621func sgp_drain(fd: i64, buf: *u8, cap: i64) -> i64 {
  var off: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if off >= cap { go = 0 } else {
          let r: i64 = sys_read(fd, (buf as i64 + off) as *u8, cap - off)
          if r <= 0 { go = 0 } else { off = off + r }
      }
  }
  return off
631}
632// build an HTTP/1.1 request; capstr (may be 0) rides as X-Nishi-Cap (the API wire form the login gate accepts)
633func sgp_build_req(out: *u8, method: *u8, path: *u8, host: *u8, capstr: *u8, ct: *u8, body: *u8, blen: i64) -> i64 {
  var o: i64 = sgp_cat(out, 0, method)
  out[o] = 32 as u8; o = o + 1
  o = sgp_cat(out, o, path)
  o = sgp_cat(out, o, " HTTP/1.1\r\nHost: " as *u8)
  o = sgp_cat(out, o, host)
  o = sgp_cat(out, o, "\r\n" as *u8)
  if (capstr as i64) != 0 {
      o = sgp_cat(out, o, "X-Nishi-Cap: " as *u8)
      o = sgp_cat(out, o, capstr)
      o = sgp_cat(out, o, "\r\n" as *u8)
  }
  if blen > 0 {
      o = sgp_cat(out, o, "Content-Type: " as *u8)
      o = sgp_cat(out, o, ct)
      o = sgp_cat(out, o, "\r\nContent-Length: " as *u8)
      o = sgp_dec(out, o, blen)
      o = sgp_cat(out, o, "\r\n" as *u8)
  }
  o = sgp_cat(out, o, "Connection: close\r\n\r\n" as *u8)
  var i: i64 = 0
  while i < blen { out[o + i] = body[i]; i = i + 1 }
  return o + blen
656}
657func sgp_http(port: i64, req: *u8, reqlen: i64, out: *u8, outcap: i64) -> i64 {
  let fd: i64 = sgp_connect(port)
  if fd < 0 { return 0 - 1 }
  if sgp_write_all(fd, req, reqlen) != 0 { sys_close(fd); return 0 - 2 }
  let n: i64 = sgp_drain(fd, out, outcap)
  sys_close(fd)
  return n
664}
665
666// ---- TLS transport (rung 2): identical request bytes, sovereign TLS-1.3 ----
667// Mirrors the PROVEN nx_mgmt_client send/drain (nx_mgmt_client.nx:220-299): fragment the request into
668// <=16KB records (RFC 8446 max plaintext 2^14 -- a single oversized record is protocol-invalid and was
669// the historic transport rc=-2 root), then decrypt-drain until the peer closes.
670func sgp_tls_send_drain(s: *Tls13ClientSession, fd: i64, req: *u8, req_len: i64, out: *u8, out_cap: i64) -> i64 {
  if s.state != NX_TLS13_CSESSION_STATE_CONNECTED { return 0 - 1 }
  let rec_buf: *u8 = sys_mmap(SGP_MAGIC_16384 + 64)
  var snd_off: i64 = 0
  var more: i64 = 1
  var senderr: i64 = 0
  while more == 1 { more = 0
      var frag: i64 = req_len - snd_off
      if frag > SGP_MAGIC_16384 { frag = SGP_MAGIC_16384 }
      let header_out: *u8 = rec_buf
      let ct_out: *u8 = ((rec_buf as i64) + NX_TLS13_RECORD_HEADER_LEN) as *u8
      let tag_out: *u8 = ((rec_buf as i64) + NX_TLS13_RECORD_HEADER_LEN + frag + 1) as *u8
      let enc_v: i64 = nx_tls13_record_encrypt_v2(s.cipher_suite, s.client_app_traffic_key, s.client_app_iv, s.client_app_seq, ((req as i64) + snd_off) as *u8, frag, NX_TLS13_CT_APPLICATION_DATA, 0, header_out, ct_out, tag_out)
      s.client_app_seq = s.client_app_seq + 1
      if enc_v != NX_TLS13_REC_VERDICT_OK { senderr = 0 - 2 } else {
          let total: i64 = NX_TLS13_RECORD_HEADER_LEN + frag + 1 + NX_TLS13_RECORD_TAG_LEN
          if sgp_write_all(fd, rec_buf, total) != 0 { senderr = 0 - 3 } else {
              snd_off = snd_off + frag
              if snd_off < req_len { more = 1 }
          }
      }
  }
  sys_munmap(rec_buf, SGP_MAGIC_16384 + 64)
  if senderr != 0 { return senderr }
  var acc: i64 = 0
  let rec_in: *u8 = sys_mmap(SGP_MAGIC_16645)
  let plain: *u8 = sys_mmap(SGP_MAGIC_16645)
  let cttype: *i64 = sys_mmap(16) as *i64
  let ptlen: *i64 = sys_mmap(16) as *i64
  var go: i64 = 1
  while go == 1 {
      if acc >= out_cap { go = 0 } else {
          let rin: i64 = nx_tls13_read_record_from_fd(fd, rec_in, SGP_MAGIC_16645)
          if rin < 0 { go = 0 } else {
              let ctlen: i64 = rin - NX_TLS13_RECORD_HEADER_LEN - NX_TLS13_RECORD_TAG_LEN
              let rin_ct: *u8 = ((rec_in as i64) + NX_TLS13_RECORD_HEADER_LEN) as *u8
              let rin_tag: *u8 = ((rec_in as i64) + rin - NX_TLS13_RECORD_TAG_LEN) as *u8
              let dv: i64 = nx_tls13_record_decrypt_v2(s.cipher_suite, s.server_app_traffic_key, s.server_app_iv, s.server_app_seq, rec_in, rin_ct, ctlen, rin_tag, plain, cttype, ptlen)
              s.server_app_seq = s.server_app_seq + 1
              if dv != NX_TLS13_REC_VERDICT_OK { go = 0 } else {
                  if cttype[0] == NX_TLS13_CT_ALERT { go = 0 } else {
                      if cttype[0] == NX_TLS13_CT_APPLICATION_DATA {
                          let tc: i64 = ptlen[0]
                          if acc + tc > out_cap { go = 0 } else {
                              var i: i64 = 0
                              while i < tc { out[acc + i] = plain[i]; i = i + 1 }
                              acc = acc + tc
                          }
                      }
                  }
              }
          }
      }
  }
  sys_munmap(rec_in, SGP_MAGIC_16645)
  sys_munmap(plain, SGP_MAGIC_16645)
  sys_munmap(cttype as *u8, 16)
  sys_munmap(ptlen as *u8, 16)
  return acc
729}
730// connect + validated TLS-1.3 handshake to `url`'s host:port, send req, drain the response
731func sgp_https(store: *TrustStore, url: *u8, req: *u8, reqlen: i64, out: *u8, outcap: i64) -> i64 {
  let url_p: *NxUrl = nx_url_new()
  let target_raw: *u8 = sys_mmap(64)
  let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
  target.url = url_p
  target.port = 0
  if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { return 0 - 10 }
  let now: i64 = sys_now_realtime_sec()
  let fd_p: *i64 = sys_mmap(16) as *i64
  if nx_https_url_connect(target, url, now, fd_p) != NX_HTTPS_CONNECT_OK { return 0 - 11 }
  let fd: i64 = fd_p[0]
  let host: *u8 = ((url as i64) + target.url.host_off) as *u8
  let hlen: i64 = target.url.host_len
  let cr: *u8 = sys_mmap(32)
  let priv: *u8 = sys_mmap(32)
  nx_csprng_fill(cr, 32)                       // fresh ephemerals -> forward secrecy per push
  nx_csprng_fill(priv, 32)
  let vc: *TlsValidationContext = sys_mmap(128) as *TlsValidationContext
  vc.store = store
  vc.sni_host = host
  vc.sni_host_len = hlen
  vc.now_epoch = now
  let sr: i64 = nx_tls13_client_session_run(fd, host, hlen, cr, priv, vc)
  if sr <= 0 { sys_close(fd); return 0 - 12 }
  let session: *Tls13ClientSession = sr as *Tls13ClientSession
  let n: i64 = sgp_tls_send_drain(session, fd, req, reqlen, out, outcap)
  sys_close(fd)
  return n
759}
760// one dispatcher, two transports: mode 0 = loopback plain TCP, mode 1 = sovereign TLS to urlbase+path
761func sgp_xfer_once(mode: i64, port: i64, store: *TrustStore, urlbase: *u8, path: *u8, req: *u8, reqlen: i64, out: *u8, outcap: i64) -> i64 {
  if mode == 0 { return sgp_http(port, req, reqlen, out, outcap) }
  let url: *u8 = sys_mmap(SGP_MAGIC_2048)
  var u: i64 = sgp_cat(url, 0, urlbase)
  u = sgp_cat(url, u, path)
  url[u] = 0 as u8
  let n: i64 = sgp_https(store, url, req, reqlen, out, outcap)
  sys_munmap(url, SGP_MAGIC_2048)
  return n
770}
771// BOUNDED RETRY on TRANSPORT failure only (rc<=0 = we never got a response). An unattended 30-min ark
772// beat must survive the known flake classes (transient TLS handshake/cert-verify, the DSM co-squat).
773// SAFE for BOTH calls: the advert is an idempotent read, and a receive-pack retry replays the SAME
774// (old,new,ref) command -- the server writes the same ref value, so a lost response cannot double-apply.
775// A SERVER answer (any bytes) is never retried -- protocol/auth rejections must surface, not be masked.
776func sgp_xfer(mode: i64, port: i64, store: *TrustStore, urlbase: *u8, path: *u8, req: *u8, reqlen: i64, out: *u8, outcap: i64) -> i64 {
  var attempt: i64 = 0
  var n: i64 = 0 - 1
  var go: i64 = 1
  while go == 1 {
      n = sgp_xfer_once(mode, port, store, urlbase, path, req, reqlen, out, outcap)
      if n > 0 { go = 0 } else {
          attempt = attempt + 1
          if attempt >= 3 { go = 0 } else {
              sgp_we("RETRY transport rc=" as *u8)
              let b: *u8 = sys_mmap(32)
              var x: i64 = 0 - n
              var i: i64 = 31
              if x == 0 { b[i] = 48 as u8; i = i - 1 }
              while x > 0 { b[i] = (48 + x % 10) as u8; x = x / 10; i = i - 1 }
              sys_write(2, (b as i64 + i + 1) as *u8, 31 - i)
              sys_munmap(b, 32)
              sgp_we(" (transient; the response never arrived) attempt " as *u8)
              let c: *u8 = sys_mmap(8)
              c[0] = (48 + attempt) as u8
              sys_write(2, c, 1)
              sys_munmap(c, 8)
              sgp_we("/3\n" as *u8)
          }
      }
  }
  return n
803}
804// bounded diagnostic dump (never reads past what the peer actually sent)
805func sgp_dump(buf: *u8, n: i64, want: i64) -> i64 {
  var m: i64 = want
  if n < m { m = n }
  if m > 0 { sys_write(1, buf, m) }
  return 0
810}
811// substring search
812func sgp_find(hay: *u8, hn: i64, needle: *u8) -> i64 {
  let m: i64 = sgp_slen(needle)
  if m == 0 { return 0 }
  var i: i64 = 0
  while i + m <= hn {
      var k: i64 = 0
      while k < m { if hay[i + k] != needle[k] { k = m + 9 } else { k = k + 1 } }
      if k == m { return i }
      i = i + 1
  }
  return 0 - 1
823}
824// find "<64hex> refs/heads/<ref>" in a receive-pack advert; writes the 64 hex to out64. 1 = found.
825func sgp_find_ref(buf: *u8, n: i64, refpath: *u8, out64: *u8) -> i64 {
  let needle: *u8 = sys_mmap(320)
  var o: i64 = sgp_cat(needle, 0, " " as *u8)
  o = sgp_cat(needle, o, refpath)
  needle[o] = 0 as u8
  let nl: i64 = o
  var found: i64 = 0
  var i: i64 = 0
  while i + nl <= n {
      var k: i64 = 0
      while k < nl { if buf[i + k] != needle[k] { k = nl + 9 } else { k = k + 1 } }
      if k == nl {
          if i >= 64 {
              let after: i64 = buf[i + nl] as i64
              var okend: i64 = 0
              if after == 0 { okend = 1 }
              if after == 10 { okend = 1 }
              if okend == 1 {
                  var j: i64 = 0
                  while j < 64 { out64[j] = buf[i - 64 + j]; j = j + 1 }
                  out64[64] = 0 as u8
                  found = 1
                  i = n
              }
          }
      }
      i = i + 1
  }
  sys_munmap(needle, 320)
  return found
855}
856
857func main(argc: i64, argv: *i64) -> i64 {
  if argc < 3 {
      sgp_w("usage: nx_sovgit_push <srcdir> <repo> [<port>|<host>:<port>] [ref] [capfile] [message]\n" as *u8)
      sgp_w("  target '18691' = loopback plain TCP (on-box) | 'nishifamily.com:8443' = sovereign TLS-1.3\n" as *u8)
      sgp_w("  ENVELOPE entries/dir<=20000 namebytes/dir<=2MiB depth<=32 file<=64MiB pack<=128MiB\n" as *u8)
      sgp_w("  skips .git + symlinks/special (counted); transport=loopback 127.0.0.1:<port> (default 18691)\n" as *u8)
      return 2
  }
  let srcdir: *u8 = argv[1] as *u8
  let repo: *u8 = argv[2] as *u8
  // target: "<port>" = loopback plain TCP (on-box) | "<host>:<port>" = sovereign TLS through the edge
  var port: i64 = SGP_MAGIC_18691
  var mode: i64 = 0
  let hostbuf: *u8 = sys_mmap(320)
  var hb: i64 = sgp_cat(hostbuf, 0, "nishi-git" as *u8)
  hostbuf[hb] = 0 as u8
  if argc > 3 {
      let t: *u8 = argv[3] as *u8
      var ci: i64 = 0 - 1
      var ti: i64 = 0
      while t[ti] != (0 as u8) { if t[ti] == (58 as u8) { ci = ti } ti = ti + 1 }
      if ci < 0 { port = sgp_atoi(t) } else {
          mode = 1
          var k: i64 = 0
          while k < ci { hostbuf[k] = t[k]; k = k + 1 }
          hostbuf[ci] = 0 as u8
          port = sgp_atoi((t as i64 + ci + 1) as *u8)
      }
  }
  var store: *TrustStore = 0 as *TrustStore
  let urlbase: *u8 = sys_mmap(512)
  urlbase[0] = 0 as u8
  if mode == 1 {
      let tr: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, SGP_MAGIC_4194304)
      if tr <= 0 { sgp_w("PUSH-FAIL trust-store load (run from the nxc2 dir) verdict=RED\n" as *u8); sys_exit(10); return 10 }
      store = tr as *TrustStore
      var ub: i64 = sgp_cat(urlbase, 0, "https://" as *u8)
      ub = sgp_cat(urlbase, ub, hostbuf)
      urlbase[ub] = 58 as u8; ub = ub + 1
      ub = sgp_dec(urlbase, ub, port)
      urlbase[ub] = 0 as u8
  }
  var ref: *u8 = "master" as *u8
  if argc > 4 { ref = argv[4] as *u8 }
  var capstr: *u8 = 0 as *u8
  if argc > 5 {
      let cszp: *i64 = sys_mmap(16) as *i64
      let cb: *u8 = sgp_read_file(argv[5] as *u8, cszp)
      if (cb as i64) != 0 {
          var cn: i64 = cszp[0]
          while cn > 0 {
              let lc: i64 = cb[cn - 1] as i64
              if lc == 10 { cn = cn - 1 } else { if lc == 13 { cn = cn - 1 } else { cn = 0 - cn } }
          }
          if cn < 0 { cn = 0 - cn }
          cb[cn] = 0 as u8
          if cn > 0 { capstr = cb }
      }
  }
  var msg: *u8 = "nishi sovereign snapshot" as *u8
  if argc > 6 { msg = argv[6] as *u8 }
918
  let refpath: *u8 = sys_mmap(320)
  var rpo: i64 = sgp_cat(refpath, 0, "refs/heads/" as *u8)
  rpo = sgp_cat(refpath, rpo, ref)
  refpath[rpo] = 0 as u8
923
  sgp_w("SOVGIT-PUSH src=" as *u8); sgp_w(srcdir)
  sgp_w(" repo=" as *u8); sgp_w(repo)
  sgp_w(" ref=" as *u8); sgp_w(refpath)
  if mode == 1 { sgp_w(" transport=TLS host=" as *u8); sgp_w(hostbuf) } else { sgp_w(" transport=loopback" as *u8) }
  sgp_w(" port=" as *u8); sgp_wn(port); sgp_w("\n" as *u8)
929
  // ---- 1. receive-pack advert -> the old ref value (parent) ----
  let resp: *u8 = sys_mmap(SGP_RESP)
  let req0: *u8 = sys_mmap(SGP_MAGIC_8192)
  let apath: *u8 = sys_mmap(SGP_MAGIC_1024)
  var ao: i64 = sgp_cat(apath, 0, "/git/" as *u8)
  ao = sgp_cat(apath, ao, repo)
  ao = sgp_cat(apath, ao, "/info/refs?service=git-receive-pack" as *u8)
  apath[ao] = 0 as u8
  let r0len: i64 = sgp_build_req(req0, "GET" as *u8, apath, hostbuf, capstr, "" as *u8, 0 as *u8, 0)
  let an: i64 = sgp_xfer(mode, port, store, urlbase, apath, req0, r0len, resp, SGP_RESP)
  if an <= 0 { sgp_w("PUSH-FAIL advert transport rc=" as *u8); sgp_wn(an); sgp_w(" verdict=RED\n" as *u8); sys_exit(3); return 3 }
  if sgp_find(resp, an, "200 OK" as *u8) < 0 {
      sgp_w("PUSH-FAIL advert status (auth? repo?) verdict=RED\n" as *u8)
      sgp_dump(resp, an, 200)
      sgp_w("\n" as *u8)
      sys_exit(4); return 4
  }
  let oldsha: *u8 = sys_mmap(80)
  let hasold: i64 = sgp_find_ref(resp, an, refpath, oldsha)
  if hasold == 0 { var z: i64 = 0; while z < 64 { oldsha[z] = 48 as u8; z = z + 1 } oldsha[64] = 0 as u8 }
  sgp_w("  old=" as *u8); sgp_w(oldsha); sgp_w("\n" as *u8)
951
  // ---- 2. snapshot the tree into a packfile ----
  let pack: *u8 = sys_mmap(SGP_PACK_CAP)
  let pst: *i64 = sys_mmap(128) as *i64
  sgp_pack_begin(pack, pst)
  let ibuf: *u8 = sys_mmap(SGP_MAGIC_65536)
  sgp_load_ignore(srcdir, ibuf, SGP_MAGIC_65536, pst)
  if pst[8] > 0 { sgp_w("  .sovgitignore: " as *u8); sgp_wn(pst[8]); sgp_w(" patterns\n" as *u8) }
  let stats: *i64 = sys_mmap(64) as *i64
  stats[0] = 0; stats[1] = 0; stats[2] = 0; stats[3] = 0; stats[4] = 0
  // ---- proven-have cache: skip objects the remote is CONFIRMED to hold (else full pack) ----
  let allshas: *u8 = sys_mmap(SGP_MAX_OBJ * 32)
  let hshas: *u8 = sys_mmap(SGP_MAX_OBJ * 32)
  let htab: *i64 = sys_mmap(SGP_HS_SIZE * 8) as *i64
  pst[3] = 0                       // objects recorded this snapshot
  pst[5] = 0                       // hash-table size (0 = no have-set => full pack)
  pst[6] = 0                       // objects skipped as provably-present
  let hpath: *u8 = sys_mmap(SGP_MAGIC_1024)
  sgp_havepath(hpath, repo, refpath)
  var haven: i64 = 0
  if hasold == 1 {
      let hszp: *i64 = sys_mmap(16) as *i64
      let hbuf: *u8 = sgp_read_file(hpath, hszp)
      if (hbuf as i64) != 0 {
          let hn: i64 = hszp[0]
          if hn >= 32 {
              let chex: *u8 = sys_mmap(80)
              sg_hex(hbuf, chex)
              chex[64] = 0 as u8
              if sgp_streq(chex, oldsha) == 1 {         // the advert CONFIRMS this snapshot landed
                  var cnt: i64 = (hn - 32) / 32
                  if cnt > SGP_MAX_OBJ { cnt = SGP_MAX_OBJ }
                  var ci: i64 = 0
                  while ci < cnt * 32 { hshas[ci] = hbuf[32 + ci]; ci = ci + 1 }
                  haven = cnt
              }
              sys_munmap(chex, 80)
          }
          sys_munmap(hbuf, hn + 16)
      }
      sys_munmap(hszp as *u8, 16)
  }
  if haven > 0 {
      sgp_hs_build(hshas, haven, htab, SGP_HS_SIZE)
      pst[5] = SGP_HS_SIZE
      sgp_w("  incremental: remote CONFIRMED to hold " as *u8); sgp_wn(haven); sgp_w(" objects (delta pack)\n" as *u8)
  } else { sgp_w("  incremental: no confirmed have-set for this ref (FULL pack, fail-safe)\n" as *u8) }
  let pathbuf: *u8 = sys_mmap(SGP_PATHBUF)
  var pl: i64 = sgp_cat(pathbuf, 0, srcdir)
  while pl > 1 { if pathbuf[pl - 1] == (47 as u8) { pl = pl - 1 } else { pl = 0 - pl } }
  if pl < 0 { pl = 0 - pl }
  pathbuf[pl] = 0 as u8
  let troot: *u8 = sys_mmap(40)
  let ecb: *i64 = sys_mmap(16) as *i64
  let wr: i64 = sgp_walk(pathbuf, pl, pack, pst, 0, troot, ecb, stats, allshas, hshas, htab)
  if wr != 0 {
      sgp_w("PUSH-FAIL walk rc=" as *u8); sgp_wn(wr)
      sgp_w(" (-3 depth -4 opendir -5 entries/dir -6 namebytes -7 pathlen -8 read -9 filesize -10 pack-envelope)" as *u8)
      sgp_w(" verdict=RED\n" as *u8)
      sys_exit(5); return 5
  }
  let trhex: *u8 = sys_mmap(80)
  sg_hex(troot, trhex)
  trhex[64] = 0 as u8
1015
  // ---- 3. the commit (parent = advertised old ref => additive history) ----
  let cbody: *u8 = sys_mmap(SGP_MAGIC_4096)
  var co: i64 = sgp_cat(cbody, 0, "tree " as *u8)
  co = sgp_cat(cbody, co, trhex)
  cbody[co] = 10 as u8; co = co + 1
  if hasold == 1 {
      co = sgp_cat(cbody, co, "parent " as *u8)
      co = sgp_cat(cbody, co, oldsha)
      cbody[co] = 10 as u8; co = co + 1
  }
  let now: i64 = sys_now_realtime_sec()
  co = sgp_cat(cbody, co, "author nishi-sovgit <ark@nishi> " as *u8)
  co = sgp_dec(cbody, co, now)
  co = sgp_cat(cbody, co, " +0000\n" as *u8)
  co = sgp_cat(cbody, co, "committer nishi-sovgit <ark@nishi> " as *u8)
  co = sgp_dec(cbody, co, now)
  co = sgp_cat(cbody, co, " +0000\n\n" as *u8)
  co = sgp_cat(cbody, co, msg)
  cbody[co] = 10 as u8; co = co + 1
  let craw: *u8 = sys_mmap(40)
  sg_oid_raw("commit" as *u8, cbody, co, craw)
  let newsha: *u8 = sys_mmap(80)
  sg_hex(craw, newsha)
  newsha[64] = 0 as u8
  if sgp_emit(pack, pst, 1, cbody, co, craw, allshas, hshas, htab) != 0 {
      sgp_w("PUSH-FAIL pack/object envelope exceeded verdict=RED\n" as *u8); sys_exit(6); return 6
  }
  let packlen: i64 = sgp_pack_end(pack, pst)
  sgp_w("  snapshot files=" as *u8); sgp_wn(stats[0])
  sgp_w(" dirs=" as *u8); sgp_wn(stats[1])
  sgp_w(" skipped=" as *u8); sgp_wn(stats[2])
  sgp_w(" secrets-excluded=" as *u8); sgp_wn(stats[4])
  sgp_w(" ignored=" as *u8); sgp_wn(pst[9])
  sgp_w(" bytes=" as *u8); sgp_wn(stats[3])
  sgp_w(" snapshot-objects=" as *u8); sgp_wn(pst[3])
  sgp_w(" packed=" as *u8); sgp_wn(pst[1])
  sgp_w(" skipped-present=" as *u8); sgp_wn(pst[6])
  sgp_w(" pack=" as *u8); sgp_wn(packlen); sgp_w("\n" as *u8)
  sgp_w("  tree=" as *u8); sgp_w(trhex); sgp_w("\n" as *u8)
  sgp_w("  new=" as *u8); sgp_w(newsha); sgp_w("\n" as *u8)
1056
  // ---- 4. receive-pack: pkt-line ref-update + flush + pack ----
  let body: *u8 = sys_mmap(SGP_PACK_CAP + SGP_MAGIC_65536)
  let cmd: *u8 = sys_mmap(SGP_MAGIC_1024)
  var mo: i64 = sgp_cat(cmd, 0, oldsha)
  cmd[mo] = 32 as u8; mo = mo + 1
  mo = sgp_cat(cmd, mo, newsha)
  cmd[mo] = 32 as u8; mo = mo + 1
  mo = sgp_cat(cmd, mo, refpath)
  cmd[mo] = 0 as u8; mo = mo + 1
  mo = sgp_cat(cmd, mo, "report-status object-format=sha256 agent=nishi-sovgit-push/1" as *u8)
  cmd[mo] = 10 as u8; mo = mo + 1
  // pkt-line: 4 hex length (payload + 4) then payload
  let tl: i64 = mo + 4
  var bo: i64 = 0
  var hx: i64 = 0
  while hx < 4 {
      let nib: i64 = (tl >> ((3 - hx) * 4)) & 15
      var ch: i64 = 48 + nib
      if nib > 9 { ch = 87 + nib }
      body[bo] = ch as u8; bo = bo + 1
      hx = hx + 1
  }
  var ci: i64 = 0
  while ci < mo { body[bo] = cmd[ci]; bo = bo + 1; ci = ci + 1 }
  body[bo] = 48 as u8; body[bo + 1] = 48 as u8; body[bo + 2] = 48 as u8; body[bo + 3] = 48 as u8
  bo = bo + 4
  var pi: i64 = 0
  while pi < packlen { body[bo + pi] = pack[pi]; pi = pi + 1 }
  bo = bo + packlen
1086
  // refuse-before-send: never learn the edge's limit by taking the public web surface down
  if mode == 1 { if bo > SGP_EDGE_SAFE {
      sgp_w("PUSH-REFUSED body=" as *u8); sgp_wn(bo)
      sgp_w("B exceeds the MEASURED edge-safe cap " as *u8); sgp_wn(SGP_EDGE_SAFE)
      sgp_w("B (seq334: oversized POSTs crash-loop sites.elf and down every site).\n" as *u8)
      sgp_w("  push a SMALLER SCOPE (fewer files per push -- incremental packs make batching cheap)," as *u8)
      sgp_w(" or run on-box against loopback where no edge is in the path. verdict=RED\n" as *u8)
      sys_exit(11); return 11
  } }
  let ppath: *u8 = sys_mmap(SGP_MAGIC_1024)
  var po: i64 = sgp_cat(ppath, 0, "/git/" as *u8)
  po = sgp_cat(ppath, po, repo)
  po = sgp_cat(ppath, po, "/git-receive-pack" as *u8)
  ppath[po] = 0 as u8
  let req1: *u8 = sys_mmap(SGP_PACK_CAP + SGP_MAGIC_131072)
  let r1len: i64 = sgp_build_req(req1, "POST" as *u8, ppath, hostbuf, capstr, "application/x-git-receive-pack-request" as *u8, body, bo)
  let pn: i64 = sgp_xfer(mode, port, store, urlbase, ppath, req1, r1len, resp, SGP_RESP)
  if pn <= 0 { sgp_w("PUSH-FAIL receive-pack transport rc=" as *u8); sgp_wn(pn); sgp_w(" verdict=RED\n" as *u8); sys_exit(7); return 7 }
1105
  // ---- 5. report-status ----
  var okline: *u8 = sys_mmap(320)
  var oo: i64 = sgp_cat(okline, 0, "ok " as *u8)
  oo = sgp_cat(okline, oo, refpath)
  okline[oo] = 0 as u8
  let unpackok: i64 = sgp_find(resp, pn, "unpack ok" as *u8)
  let refok: i64 = sgp_find(resp, pn, okline)
  if unpackok < 0 {
      sgp_w("PUSH-FAIL server reported unpack failure verdict=RED\n" as *u8)
      sgp_dump(resp, pn, 400); sgp_w("\n" as *u8)
      sys_exit(8); return 8
  }
  if refok < 0 {
      sgp_w("PUSH-FAIL ref not updated (ng) verdict=RED\n" as *u8)
      sgp_dump(resp, pn, 400); sgp_w("\n" as *u8)
      sys_exit(9); return 9
  }
  // The ref ADVANCED, so the remote now provably holds every object of this snapshot -- persist the
  // have-set so the next beat sends only what changed. Written ONLY after a confirmed ok, never before.
  sys_mkdir("knowledge/sovgit_have" as *u8, 0x1ed)
  let hfd: i64 = sys_openat_wr(hpath, 0x1a4)
  if hfd >= 0 {
      sys_write(hfd, craw, 32)
      sys_write(hfd, allshas, pst[3] * 32)
      sys_close(hfd)
  } else { sgp_we("WARN could not persist have-set (next push falls back to a full pack)\n" as *u8) }
  sgp_w("SOVGIT-PUSH OK verdict=GREEN ref=" as *u8); sgp_w(refpath)
  sgp_w(" " as *u8); sgp_w(oldsha)
  sgp_w(" -> " as *u8); sgp_w(newsha)
  sgp_w(" objects=" as *u8); sgp_wn(pst[1])
  sgp_w(" pack=" as *u8); sgp_wn(packlen)
  sgp_w(" ZERO-GIT-BINARY\n" as *u8)
  return 0
1139}
nx_sovgit_push.nx source

`nx_sovgit_push.nx` source
