code wiki / _hdl_build / nx_tenancy_gate.nx
`nx_tenancy_gate.nx` source

↩ module page · 830 lines · 40469 B
1// nx_tenancy_gate.nx -- SOVEREIGN tenancy-orthogonality gate ORGAN (ports nx_tenancy_orthogonality_gate.sh
2// + nx_tenancy_gate_alert.sh out of bash -- operator law: sovereign all the way up and down, no shell loops).
3// Enforces the three-plane model (alpha=private dogfood | product=own domain | client=isolated, billable):
4// orthogonality is DATA-isolation (realms/keys/stores), never port-exclusivity. Reads the LIVE SSOTs each
5// cycle, checks INV-1..9, classifies findings against the acknowledged debt baseline (GREEN with known debt
6// baselined; RED the instant NEW sprawl appears), serves the full report on 127.0.0.1:18094 (seqlock shared
7// page + forked server -- the proven /status pattern; NO tsv, NO files as the interface), and appends NEW
8// violations to tenancy_alerts.log. Invariants:
9//   INV-1  every served host (proxy_routes+sites) declares a plane in tenancy_planes.conf
10//   INV-3  every RUNNING nx_mgmt_api sits on a DECLARED shards.conf mgmt port (no orphan store-sharer)
11//   INV-4  client shards use their OWN keys+store (never the shared control opaque_keys/opaque_store)
12//   INV-5  a confirmed product is not a bare path on an alpha domain (products graduate to own domains)
13//   INV-6  every property_registry domain routed to :8443 has a cert row in certs/sni_certs.manifest
14//   INV-7  every manifest cert+key file exists and is non-empty
15//   INV-8  every sites.conf vhost has a domain_lifecycle.reg row (the monitored-domain list)
16//   INV-9  LIVE-EDGE EVIDENCE via the sovereign HTTPS client (fork+exec nx_https_get_cli.elf, loopback
17//          endpoint, SNI from the URL): stage!=production MUST serve the coming-soon marker (else = an
18//          unapproved go-live LEAK); stage=production must NOT (else = launch STUCK). Fetch-failure is its
19//          own finding (fetchfail), never mistaken for a leak -- an improvement over the bash gate, which
20//          could read an empty failed fetch as "no marker" = false leak. Skipped while the edge is down
21//          (selfheal owns that alarm).
22// BOUNDED-VSZ discipline: every buffer is allocated ONCE before the loop; the hot loop performs ZERO mmap.
23// license_tier: ORIGINAL   module: nishi-core.ops.tenancy_gate
24import "nx_syscalls.nx"
25import "nx_health_probe.nx"    // hp_probe_tls / HP_SERVING (edge-up check), hp_sockaddr (server)
26
27const TG_HOME:    *u8 = "/volume1/homes/elderwesto/nishihost" as *u8
28const TG_PLANES:  *u8 = "/volume1/homes/elderwesto/nishihost/tenancy_planes.conf" as *u8
29const TG_ROUTES:  *u8 = "/volume1/homes/elderwesto/nishihost/proxy_routes.conf" as *u8
30const TG_SHARDS:  *u8 = "/volume1/homes/elderwesto/nishihost/shards.conf" as *u8
31const TG_SITES:   *u8 = "/volume1/homes/elderwesto/nishihost/sites.conf" as *u8
32const TG_PRODS:   *u8 = "/volume1/homes/elderwesto/nishihost/tenancy_products.list" as *u8
33const TG_PROPREG: *u8 = "/volume1/homes/elderwesto/nishihost/property_registry.conf" as *u8
34const TG_MANIF:   *u8 = "/volume1/homes/elderwesto/nishihost/certs/sni_certs.manifest" as *u8
35const TG_LREG:    *u8 = "/volume1/homes/elderwesto/nishihost/domain_lifecycle.reg" as *u8
36const TG_BASE:    *u8 = "/volume1/homes/elderwesto/nishihost/tenancy_debt_baseline.txt" as *u8
37const TG_ALERTS:  *u8 = "/volume1/homes/elderwesto/nishihost/tenancy_alerts.log" as *u8
38const TG_CLI:     *u8 = "./nx_https_get_cli.elf" as *u8
39const TG_FETCH:   *u8 = "/volume1/homes/elderwesto/nishihost/_scratch/tg_fetch.out" as *u8
40const TG_PORT:      i64 = 18094
41const TG_CYCLE_SEC: i64 = 120
42const TG_SHSZ:      i64 = 16384
43const TG_FBUF:      i64 = 65536
44const TG_FETCHCAP:  i64 = 131072
45const TG_FETCH_TMO_MS: i64 = 20000
46
47func tg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
48func tg_p(s: *u8) -> i64 { sys_write(1, s, tg_slen(s)); return 0 }
49func tg_decw(v: i64, out: *u8) -> i64 {
  var o: i64 = 0
  var m: i64 = v
  if m < 0 { out[0] = 45 as u8; o = 1; m = 0 - m }
  if m == 0 { out[o] = 48 as u8; return o + 1 }
  var nd: i64 = 1
  var mm: i64 = m
  while mm >= 10 { nd = nd + 1; mm = mm / 10 }
  var i: i64 = nd - 1
  while m > 0 { out[o + i] = (48 + (m % 10)) as u8; m = m / 10; i = i - 1 }
  return o + nd
60}
61func tg_sappend(dst: *u8, w: i64, s: *u8) -> i64 {
  var i: i64 = 0
  var o: i64 = w
  while s[i] != (0 as u8) { dst[o] = s[i]; o = o + 1; i = i + 1 }
  return o
66}
67func tg_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
72}
73func tg_atoi(s: *u8) -> i64 {
  var v: i64 = 0; var i: i64 = 0; var go: i64 = 1
  while go == 1 { let c: i64 = s[i] as i64; if c < 48 { go = 0 } else { if c > 57 { go = 0 } else { v = v * 10 + (c - 48); i = i + 1 } } }
  return v
77}
78// substring search: needle (NUL-term) in hay[0..hlen)
79func tg_contains(hay: *u8, hlen: i64, needle: *u8) -> i64 {
  let nlen: i64 = tg_slen(needle)
  if nlen == 0 { return 1 }
  if hlen < nlen { return 0 }
  var s: i64 = 0
  let last: i64 = hlen - nlen
  while s <= last {
      var m: i64 = 0
      var eq: i64 = 1
      while m < nlen { if hay[s + m] != needle[m] { eq = 0; m = nlen } m = m + 1 }
      if eq == 1 { return 1 }
      s = s + 1
  }
  return 0
93}
94func tg_next_line(buf: *u8, pos: i64, end: i64) -> i64 {
  var p: i64 = pos
  var go: i64 = 1
  while go == 1 { if p >= end { go = 0 } else { if (buf[p] as i64) == 10 { p = p + 1; go = 0 } else { p = p + 1 } } }
  return p
99}
100func tg_line_end(buf: *u8, pos: i64, end: i64) -> i64 {
  var p: i64 = pos
  while p < end { if (buf[p] as i64) == 10 { return p } p = p + 1 }
  return end
104}
105// whitespace-separated field #idx (0-based) of buf[ls..le) -> out (NUL-term). Space AND tab are
106// separators, runs collapse (covers both the ws-cols and the TAB-cols SSOT formats). Returns len.
107func tg_wsfield(buf: *u8, ls: i64, le: i64, idx: i64, out: *u8, cap: i64) -> i64 {
  var p: i64 = ls
  var fi: i64 = 0
  var go: i64 = 1
  while go == 1 {
      // skip separator run
      var sk: i64 = 1
      while sk == 1 { if p >= le { sk = 0 } else { let c: i64 = buf[p] as i64; if c == 32 { p = p + 1 } else { if c == 9 { p = p + 1 } else { if c == 13 { p = p + 1 } else { sk = 0 } } } } }
      if p >= le { out[0] = 0 as u8; return 0 }
      // token [p..q)
      var q: i64 = p
      var tk: i64 = 1
      while tk == 1 { if q >= le { tk = 0 } else { let c2: i64 = buf[q] as i64; if c2 == 32 { tk = 0 } else { if c2 == 9 { tk = 0 } else { if c2 == 13 { tk = 0 } else { q = q + 1 } } } } }
      if fi == idx {
          var o: i64 = 0
          var k: i64 = p
          while k < q { if o < cap - 1 { out[o] = buf[k]; o = o + 1 } k = k + 1 }
          out[o] = 0 as u8
          return o
      }
      fi = fi + 1
      p = q
      if p >= le { go = 0 }
  }
  out[0] = 0 as u8
  return 0
133}
134// TAB-only field #idx of buf[ls..le) -> out. shards.conf is strict TSV whose fields may CONTAIN
135// spaces (the library realm is literally `Nishi Wiki`), so the whitespace splitter would shift its
136// columns -- TSV rows must use THIS. Trailing CR stripped. Returns len.
137func tg_tabfield(buf: *u8, ls: i64, le: i64, idx: i64, out: *u8, cap: i64) -> i64 {
  var p: i64 = ls
  var fi: i64 = 0
  while fi < idx {
      var sk: i64 = 1
      while sk == 1 {
          if p >= le { out[0] = 0 as u8; return 0 }
          if (buf[p] as i64) == 9 { sk = 0 }
          p = p + 1
      }
      fi = fi + 1
  }
  var o: i64 = 0
  while p < le {
      let c: i64 = buf[p] as i64
      if c == 9 { p = le }
      else { if c == 13 { p = p + 1 }
      else {
          if o < cap - 1 { out[o] = buf[p]; o = o + 1 }
          p = p + 1
      } }
  }
  out[o] = 0 as u8
  return o
161}
162// bounded whole-file read into a caller buffer (NEVER sys_read_file -- the 4 GiB-cap leak class)
163func tg_read(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  let n: i64 = sys_read(fd, buf, cap - 1)
  sys_close(fd)
  if n < 0 { return 0 }
  return n
170}
171// packed NUL-separated list ops: entries appended as <bytes>NUL; list[llen]=extra NUL terminator kept by caller
172func tg_list_add(list: *u8, llen: i64, s: *u8) -> i64 {
  var o: i64 = llen
  var i: i64 = 0
  while s[i] != (0 as u8) { list[o] = s[i]; o = o + 1; i = i + 1 }
  list[o] = 0 as u8
  o = o + 1
  list[o] = 0 as u8
  return o
180}
181func tg_in_list(list: *u8, s: *u8) -> i64 {
  var p: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if list[p] == (0 as u8) { return 0 }
      if tg_streq((((list as i64) + p)) as *u8, s) == 1 { return 1 }
      while list[p] != (0 as u8) { p = p + 1 }
      p = p + 1
  }
  return 0
191}
192// non-empty file check (INV-7): open + read 1 byte
193func tg_file_nonempty(path: *u8, tmp: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 }
  let n: i64 = sys_read(fd, tmp, 1)
  sys_close(fd)
  if n > 0 { return 1 }
  return 0
200}
201// append a candidate line "KEY\tMSG\n" (deduped by KEY) into cand; returns new w
202func tg_cand(cand: *u8, w: i64, key: *u8, msg: *u8) -> i64 {
  if tg_contains(cand, w, key) == 1 { return w }
  if w > 14000 { return w }
  var o: i64 = tg_sappend(cand, w, key)
  cand[o] = 9 as u8
  o = o + 1
  o = tg_sappend(cand, o, msg)
  cand[o] = 10 as u8
  return o + 1
211}
212
213// ---- INV-9 evidence fetch: fork+exec the sovereign HTTPS client, stdout -> TG_FETCH, bounded wait.
214// Child builds url/argv in ITS OWN memory post-fork (the proven ds_launch lesson). Returns 0 ok, -1 fail.
215func tg_fetch(dom: *u8) -> i64 {
  let pid: i64 = sys_fork()
  if pid == 0 {
      sys_chdir(TG_HOME)                             // CLI loads data/mozilla_certdata.txt from CWD
      let ofd: i64 = sys_openat_wr(TG_FETCH, 420)
      if ofd < 0 { sys_exit(125) }
      sys_dup3(ofd, 1, 0)
      sys_dup3(ofd, 2, 0)    // CLI handshake diagnostics go to stderr -- capture them too, or they
                             // leak into the ORGAN's stdout file and grow it unbounded per cycle
      let url: *u8 = sys_mmap(512)
      var w: i64 = 0
      w = tg_sappend(url, w, "https://" as *u8)
      w = tg_sappend(url, w, dom)
      w = tg_sappend(url, w, "/" as *u8)
      url[w] = 0 as u8
      let argv: *i64 = sys_mmap(8 * 8) as *i64
      argv[0] = (TG_CLI) as i64
      argv[1] = url as i64
      argv[2] = ("127.0.0.1:8443" as *u8) as i64
      argv[3] = 0
      let envp: *i64 = sys_mmap(8 * 4) as *i64
      envp[0] = ("PATH=/usr/bin:/bin:/usr/local/bin" as *u8) as i64
      envp[1] = ("HOME=/volume1/homes/elderwesto" as *u8) as i64
      envp[2] = 0
      sys_execve_clean(TG_CLI, argv, envp)
      sys_exit(127)
  }
  if pid < 0 { return 0 - 1 }
  // bounded wait: WNOHANG poll, then kill on timeout (a hung fetch must never stall the gate cycle)
  let st: *i64 = sys_mmap(8) as *i64
  var waited: i64 = 0
  var done: i64 = 0
  while done == 0 {
      let r: i64 = sys_wait4(pid, st, 1)
      if r == pid { done = 1 }
      else {
          if waited >= TG_FETCH_TMO_MS { nx_kill(pid, 9); sys_wait4(pid, st, 0); done = 1; sys_munmap(st as *u8, 8); return 0 - 1 }
          sys_sleep_ms(200)
          waited = waited + 200
      }
  }
  sys_munmap(st as *u8, 8)
  return 0
258}
259
260// ---- report server child on 127.0.0.1:TG_PORT (seqlock shared page; exact Content-Length = CL-LAW) ----
261func tg_server(shm: *u8) -> i64 {
  let shq: *i64 = shm as *i64
  let lfd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
  if lfd < 0 { sys_exit(3) }
  let one: *i64 = sys_mmap(8) as *i64
  one[0] = 1
  sys_setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, one as *u8, 4)
  let sa: *u8 = sys_mmap(16)
  hp_sockaddr(sa, TG_PORT, 127, 0, 0, 1)
  if sys_bind(lfd, sa, 16) < 0 { sys_exit(4) }
  sys_listen(lfd, 16)
  let req: *u8 = sys_mmap(2048)
  let body: *u8 = sys_mmap(TG_SHSZ)
  let out: *u8 = sys_mmap(TG_SHSZ + 256)
  var run: i64 = 1
  while run == 1 {
      let afd: i64 = sys_accept(lfd)
      if afd >= 0 {
          sys_set_socket_timeout(afd, 3)
          sys_read(afd, req, 2047)
          var blen: i64 = 0
          var got: i64 = 0
          var tries: i64 = 0
          while got == 0 {
              let s1: i64 = shq[0]
              if (s1 % 2) == 0 {
                  var bl: i64 = shq[1]
                  if bl > TG_SHSZ - 16 { bl = TG_SHSZ - 16 }
                  if bl < 0 { bl = 0 }
                  var ci: i64 = 0
                  while ci < bl { body[ci] = shm[16 + ci]; ci = ci + 1 }
                  if shq[0] == s1 { blen = bl; got = 1 }
              }
              tries = tries + 1
              if tries > 10000 { got = 1 }
          }
          var w: i64 = 0
          w = tg_sappend(out, w, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nConnection: close\r\nContent-Length: " as *u8)
          w = w + tg_decw(blen, (((out as i64) + w)) as *u8)
          out[w] = 13 as u8; w = w + 1
          out[w] = 10 as u8; w = w + 1
          out[w] = 13 as u8; w = w + 1
          out[w] = 10 as u8; w = w + 1
          var bi: i64 = 0
          while bi < blen { out[w] = body[bi]; w = w + 1; bi = bi + 1 }
          sys_write(afd, out, w)
          sys_close(afd)
      }
  }
  return 0
311}
312
313func main() -> i64 {
  tg_p("nx_tenancy_gate: LIVE -- sovereign INV-1..9 orthogonality gate (report :18094, alerts append; no bash, no tsv)\n" as *u8)
  let shm: *u8 = sys_mmap_shared(TG_SHSZ)
  let shq: *i64 = shm as *i64
  shq[0] = 0
  shq[1] = 0
  let sspid: i64 = sys_fork()
  if sspid == 0 { tg_server(shm); sys_exit(0) }
  // ---- hoisted buffers (the hot loop performs ZERO mmap) ----
  let planes: *u8 = sys_mmap(TG_FBUF)
  let routes: *u8 = sys_mmap(TG_FBUF)
  let shards: *u8 = sys_mmap(TG_FBUF)
  let sites:  *u8 = sys_mmap(TG_FBUF)
  let prods:  *u8 = sys_mmap(8192)
  let preg:   *u8 = sys_mmap(TG_FBUF)
  let manif:  *u8 = sys_mmap(TG_FBUF)
  let lreg:   *u8 = sys_mmap(16384)
  let base:   *u8 = sys_mmap(TG_FBUF)
  let alpha:  *u8 = sys_mmap(4096)
  let client: *u8 = sys_mmap(4096)
  let cand:   *u8 = sys_mmap(TG_SHSZ)
  let rep:    *u8 = sys_mmap(TG_SHSZ)
  let fetchb: *u8 = sys_mmap(TG_FETCHCAP)
  let marker: *u8 = sys_mmap(64)
  let f0:     *u8 = sys_mmap(512)
  let f1:     *u8 = sys_mmap(512)
  let f2:     *u8 = sys_mmap(512)
  let f3:     *u8 = sys_mmap(512)
  let keyb:   *u8 = sys_mmap(600)
  let msgb:   *u8 = sys_mmap(900)
  let dbuf:   *u8 = sys_mmap(65536)
  let cpath:  *u8 = sys_mmap(64)
  let cbuf:   *u8 = sys_mmap(4096)
  let rst:    *i64 = sys_mmap(8) as *i64
  let prevc:  *u8 = sys_mmap(TG_SHSZ)
  var prevw:  i64 = 0 - 1                 // -1 = no previous cycle (first RED always alerts)
  // coming-soon marker built without a quote-in-literal: badge + '"' + >Coming soon<
  var mw: i64 = 0
  mw = tg_sappend(marker, mw, "badge" as *u8)
  marker[mw] = 34 as u8
  mw = mw + 1
  mw = tg_sappend(marker, mw, ">Coming soon<" as *u8)
  marker[mw] = 0 as u8
  var cyc: i64 = 0
  var forever: i64 = 1
  while forever == 1 {
      // reap (the fetch children are waited synchronously; this catches the server child if it dies)
      var reap: i64 = 1
      while reap == 1 { if sys_wait4(0 - 1, rst, 1) > 0 { reap = 1 } else { reap = 0 } }
      cyc = cyc + 1
      let pl: i64 = tg_read(TG_PLANES, planes, TG_FBUF)
      let rl: i64 = tg_read(TG_ROUTES, routes, TG_FBUF)
      let sl: i64 = tg_read(TG_SHARDS, shards, TG_FBUF)
      let il: i64 = tg_read(TG_SITES, sites, TG_FBUF)
      let dl: i64 = tg_read(TG_PRODS, prods, 8192)
      let gl: i64 = tg_read(TG_PROPREG, preg, TG_FBUF)
      let ml: i64 = tg_read(TG_MANIF, manif, TG_FBUF)
      let ll: i64 = tg_read(TG_LREG, lreg, 16384)
      let bl: i64 = tg_read(TG_BASE, base, TG_FBUF)
      var cw: i64 = 0
      // ---- plane lists ----
      alpha[0] = 0 as u8
      client[0] = 0 as u8
      var al: i64 = 0
      var cl: i64 = 0
      var pos: i64 = 0
      while pos < pl {
          if (planes[pos] as i64) == 35 { pos = tg_next_line(planes, pos, pl) }
          else { if (planes[pos] as i64) == 10 { pos = pos + 1 }
          else {
              let le: i64 = tg_line_end(planes, pos, pl)
              tg_wsfield(planes, pos, le, 0, f0, 512)
              tg_wsfield(planes, pos, le, 1, f1, 512)
              if tg_streq(f1, "alpha" as *u8) == 1 { al = tg_list_add(alpha, al, f0) }
              if tg_streq(f1, "client" as *u8) == 1 { cl = tg_list_add(client, cl, f0) }
              pos = tg_next_line(planes, pos, pl)
          } }
      }
      // ---- INV-1: served hosts (routes col0 + sites col0, minus "*") must have a plane row ----
      var src: i64 = 0
      while src < 2 {
          var sbp: *u8 = routes
          var sbl: i64 = rl
          if src == 1 { sbp = sites; sbl = il }
          pos = 0
          while pos < sbl {
              if (sbp[pos] as i64) == 35 { pos = tg_next_line(sbp, pos, sbl) }
              else { if (sbp[pos] as i64) == 10 { pos = pos + 1 }
              else {
                  let le2: i64 = tg_line_end(sbp, pos, sbl)
                  let hn: i64 = tg_wsfield(sbp, pos, le2, 0, f0, 512)
                  if hn > 0 { if tg_streq(f0, "*" as *u8) == 0 {
                      // planes col0 lookup
                      var found: i64 = 0
                      var pp: i64 = 0
                      while pp < pl {
                          if (planes[pp] as i64) != 35 { if (planes[pp] as i64) != 10 {
                              let ple: i64 = tg_line_end(planes, pp, pl)
                              tg_wsfield(planes, pp, ple, 0, f1, 512)
                              if tg_streq(f0, f1) == 1 { found = 1; pp = pl }
                          } }
                          if found == 0 { pp = tg_next_line(planes, pp, pl) }
                      }
                      if found == 0 {
                          var kw: i64 = 0
                          kw = tg_sappend(keyb, kw, "INV1|" as *u8)
                          kw = tg_sappend(keyb, kw, f0)
                          keyb[kw] = 0 as u8
                          var mw2: i64 = 0
                          mw2 = tg_sappend(msgb, mw2, "served host " as *u8)
                          mw2 = tg_sappend(msgb, mw2, f0)
                          mw2 = tg_sappend(msgb, mw2, " has NO declared plane" as *u8)
                          msgb[mw2] = 0 as u8
                          cw = tg_cand(cand, cw, keyb, msgb)
                      }
                  } }
                  pos = tg_next_line(sbp, pos, sbl)
              } }
          }
          src = src + 1
      }
      // ---- INV-3: every running nx_mgmt_api must sit on a declared mgmt shard port ----
      let dfd: i64 = sys_openat_rd("/proc\x00" as *u8)
      if dfd >= 0 {
          var reading: i64 = 1
          while reading == 1 {
              let dn: i64 = sys_getdents64(dfd, dbuf, 65536)
              if dn <= 0 { reading = 0 }
              else {
                  var off: i64 = 0
                  while off < dn {
                      let recp: *u8 = (((dbuf as i64) + off)) as *u8
                      let reclen: i64 = dirent_reclen(recp)
                      let nm: *u8 = dirent_name(recp)
                      if nm[0] >= (48 as u8) { if nm[0] <= (57 as u8) {
                          var pi: i64 = 0
                          let pre: *u8 = "/proc/" as *u8
                          while pre[pi] != (0 as u8) { cpath[pi] = pre[pi]; pi = pi + 1 }
                          var qi: i64 = 0
                          while nm[qi] != (0 as u8) { cpath[pi] = nm[qi]; pi = pi + 1; qi = qi + 1 }
                          let suf: *u8 = "/cmdline" as *u8
                          var si: i64 = 0
                          while suf[si] != (0 as u8) { cpath[pi] = suf[si]; pi = pi + 1; si = si + 1 }
                          cpath[pi] = 0 as u8
                          let cfd: i64 = sys_openat_rd(cpath)
                          if cfd >= 0 {
                              let cn: i64 = sys_read(cfd, cbuf, 4095)
                              sys_close(cfd)
                              if cn > 0 {
                                  var ci2: i64 = 0
                                  while ci2 < cn { if (cbuf[ci2] as i64) == 0 { cbuf[ci2] = 32 as u8 } ci2 = ci2 + 1 }
                                  cbuf[cn] = 0 as u8
                                  if tg_contains(cbuf, cn, "nx_mgmt_api" as *u8) == 1 {
                                      // port = first digit-run after the binary token
                                      var dpos: i64 = 0
                                      var port: i64 = 0
                                      var scan2: i64 = 1
                                      while scan2 == 1 {
                                          if dpos >= cn { scan2 = 0 }
                                          else {
                                              let ch: i64 = cbuf[dpos] as i64
                                              if ch >= 48 { if ch <= 57 { port = tg_atoi((((cbuf as i64) + dpos)) as *u8); scan2 = 0 } }
                                              dpos = dpos + 1
                                          }
                                      }
                                      if port > 0 {
                                          // declared? shards rows col2=="mgmt" col3==port
                                          var dec: i64 = 0
                                          var sp: i64 = 0
                                          while sp < sl {
                                              if (shards[sp] as i64) != 35 { if (shards[sp] as i64) != 10 {
                                                  let sle: i64 = tg_line_end(shards, sp, sl)
                                                  tg_tabfield(shards, sp, sle, 2, f1, 512)
                                                  tg_tabfield(shards, sp, sle, 3, f2, 512)
                                                  if tg_streq(f1, "mgmt" as *u8) == 1 { if tg_atoi(f2) == port { dec = 1; sp = sl } }
                                              } }
                                              if dec == 0 { sp = tg_next_line(shards, sp, sl) }
                                          }
                                          if dec == 0 {
                                              var kw3: i64 = 0
                                              kw3 = tg_sappend(keyb, kw3, "INV3|mgmt_api:" as *u8)
                                              kw3 = kw3 + tg_decw(port, (((keyb as i64) + kw3)) as *u8)
                                              keyb[kw3] = 0 as u8
                                              var mw3: i64 = 0
                                              mw3 = tg_sappend(msgb, mw3, "running nx_mgmt_api on an UNDECLARED shard port (orphan store-sharer) :" as *u8)
                                              mw3 = mw3 + tg_decw(port, (((msgb as i64) + mw3)) as *u8)
                                              msgb[mw3] = 0 as u8
                                              cw = tg_cand(cand, cw, keyb, msgb)
                                          }
                                      }
                                  }
                              }
                          }
                      } }
                      off = off + reclen
                  }
              }
          }
          sys_close(dfd)
      }
      // ---- INV-4: client shards must not use the shared control opaque_keys/opaque_store ----
      pos = 0
      while pos < sl {
          if (shards[pos] as i64) == 35 { pos = tg_next_line(shards, pos, sl) }
          else { if (shards[pos] as i64) == 10 { pos = pos + 1 }
          else {
              let le4: i64 = tg_line_end(shards, pos, sl)
              tg_tabfield(shards, pos, le4, 0, f0, 512)
              tg_tabfield(shards, pos, le4, 1, f1, 512)
              tg_tabfield(shards, pos, le4, 5, f2, 512)
              tg_tabfield(shards, pos, le4, 6, f3, 512)
              if tg_in_list(client, f1) == 1 {
                  var bad: i64 = 0
                  if tg_contains(f2, tg_slen(f2), "opaque_keys" as *u8) == 1 { bad = 1 }
                  if tg_contains(f3, tg_slen(f3), "opaque_store" as *u8) == 1 { bad = 1 }
                  if bad == 1 {
                      var kw4: i64 = 0
                      kw4 = tg_sappend(keyb, kw4, "INV4|" as *u8)
                      kw4 = tg_sappend(keyb, kw4, f0)
                      keyb[kw4] = 0 as u8
                      var mw4: i64 = 0
                      mw4 = tg_sappend(msgb, mw4, "client shard " as *u8)
                      mw4 = tg_sappend(msgb, mw4, f0)
                      mw4 = tg_sappend(msgb, mw4, " uses the SHARED control store -- must be isolated" as *u8)
                      msgb[mw4] = 0 as u8
                      cw = tg_cand(cand, cw, keyb, msgb)
                  }
              }
              pos = tg_next_line(shards, pos, sl)
          } }
      }
      // ---- INV-5: a confirmed product must not be a bare path on an alpha domain ----
      pos = 0
      while pos < dl {
          if (prods[pos] as i64) == 35 { pos = tg_next_line(prods, pos, dl) }
          else { if (prods[pos] as i64) == 10 { pos = pos + 1 }
          else {
              let le5: i64 = tg_line_end(prods, pos, dl)
              let pn: i64 = tg_wsfield(prods, pos, le5, 0, f0, 512)
              if pn > 0 {
                  // route rows: col0 in alpha && col1 == "/"+prod
                  f1[0] = 47 as u8
                  var pj: i64 = 0
                  while f0[pj] != (0 as u8) { f1[pj + 1] = f0[pj]; pj = pj + 1 }
                  f1[pj + 1] = 0 as u8
                  var rp: i64 = 0
                  while rp < rl {
                      if (routes[rp] as i64) != 35 { if (routes[rp] as i64) != 10 {
                          let rle: i64 = tg_line_end(routes, rp, rl)
                          tg_wsfield(routes, rp, rle, 0, f2, 512)
                          tg_wsfield(routes, rp, rle, 1, f3, 512)
                          if tg_in_list(alpha, f2) == 1 { if tg_streq(f3, f1) == 1 {
                              var kw5: i64 = 0
                              kw5 = tg_sappend(keyb, kw5, "INV5|" as *u8)
                              kw5 = tg_sappend(keyb, kw5, f2)
                              kw5 = tg_sappend(keyb, kw5, f1)
                              keyb[kw5] = 0 as u8
                              var mw5: i64 = 0
                              mw5 = tg_sappend(msgb, mw5, "product " as *u8)
                              mw5 = tg_sappend(msgb, mw5, f1)
                              mw5 = tg_sappend(msgb, mw5, " is a bare path on alpha domain " as *u8)
                              mw5 = tg_sappend(msgb, mw5, f2)
                              mw5 = tg_sappend(msgb, mw5, " -- graduate to own domain" as *u8)
                              msgb[mw5] = 0 as u8
                              cw = tg_cand(cand, cw, keyb, msgb)
                          } }
                      } }
                      rp = tg_next_line(routes, rp, rl)
                  }
              }
              pos = tg_next_line(prods, pos, dl)
          } }
      }
      // ---- INV-6: every :8443-routed property_registry domain has a cert-manifest row ----
      pos = 0
      while pos < gl {
          if (preg[pos] as i64) == 35 { pos = tg_next_line(preg, pos, gl) }
          else { if (preg[pos] as i64) == 10 { pos = pos + 1 }
          else {
              let le6: i64 = tg_line_end(preg, pos, gl)
              tg_wsfield(preg, pos, le6, 0, f0, 512)
              tg_wsfield(preg, pos, le6, 1, f1, 512)
              if tg_streq(f1, "8443" as *u8) == 1 {
                  var mfound: i64 = 0
                  var mp: i64 = 0
                  while mp < ml {
                      if (manif[mp] as i64) != 35 { if (manif[mp] as i64) != 10 {
                          let mle: i64 = tg_line_end(manif, mp, ml)
                          tg_wsfield(manif, mp, mle, 0, f2, 512)
                          if tg_streq(f0, f2) == 1 { mfound = 1; mp = ml }
                      } }
                      if mfound == 0 { mp = tg_next_line(manif, mp, ml) }
                  }
                  if mfound == 0 {
                      var kw6: i64 = 0
                      kw6 = tg_sappend(keyb, kw6, "INV6|" as *u8)
                      kw6 = tg_sappend(keyb, kw6, f0)
                      keyb[kw6] = 0 as u8
                      var mw6: i64 = 0
                      mw6 = tg_sappend(msgb, mw6, "routed to :8443 but NO cert-manifest row (edge serves default cert): " as *u8)
                      mw6 = tg_sappend(msgb, mw6, f0)
                      msgb[mw6] = 0 as u8
                      cw = tg_cand(cand, cw, keyb, msgb)
                  }
              }
              pos = tg_next_line(preg, pos, gl)
          } }
      }
      // ---- INV-7: manifest cert+key files exist and are non-empty ----
      pos = 0
      while pos < ml {
          if (manif[pos] as i64) == 35 { pos = tg_next_line(manif, pos, ml) }
          else { if (manif[pos] as i64) == 10 { pos = pos + 1 }
          else {
              let le7: i64 = tg_line_end(manif, pos, ml)
              let dn7: i64 = tg_wsfield(manif, pos, le7, 0, f0, 512)
              let cn7: i64 = tg_wsfield(manif, pos, le7, 1, f1, 512)
              let kn7: i64 = tg_wsfield(manif, pos, le7, 2, f2, 512)
              if dn7 > 0 { if cn7 > 0 {
                  if tg_file_nonempty(f1, f3) == 0 {
                      var kw7: i64 = 0
                      kw7 = tg_sappend(keyb, kw7, "INV7|" as *u8)
                      kw7 = tg_sappend(keyb, kw7, f0)
                      keyb[kw7] = 0 as u8
                      var mw7: i64 = 0
                      mw7 = tg_sappend(msgb, mw7, "manifest cert file MISSING/empty for " as *u8)
                      mw7 = tg_sappend(msgb, mw7, f0)
                      msgb[mw7] = 0 as u8
                      cw = tg_cand(cand, cw, keyb, msgb)
                  }
                  if kn7 > 0 { if tg_file_nonempty(f2, f3) == 0 {
                      var kw7b: i64 = 0
                      kw7b = tg_sappend(keyb, kw7b, "INV7|" as *u8)
                      kw7b = tg_sappend(keyb, kw7b, f0)
                      kw7b = tg_sappend(keyb, kw7b, "-key" as *u8)
                      keyb[kw7b] = 0 as u8
                      var mw7b: i64 = 0
                      mw7b = tg_sappend(msgb, mw7b, "manifest key file MISSING/empty for " as *u8)
                      mw7b = tg_sappend(msgb, mw7b, f0)
                      msgb[mw7b] = 0 as u8
                      cw = tg_cand(cand, cw, keyb, msgb)
                  } }
              } }
              pos = tg_next_line(manif, pos, ml)
          } }
      }
      // ---- INV-8: every served vhost (sites col0) has a lifecycle row ----
      pos = 0
      while pos < il {
          if (sites[pos] as i64) == 35 { pos = tg_next_line(sites, pos, il) }
          else { if (sites[pos] as i64) == 10 { pos = pos + 1 }
          else {
              let le8: i64 = tg_line_end(sites, pos, il)
              let hn8: i64 = tg_wsfield(sites, pos, le8, 0, f0, 512)
              if hn8 > 0 { if tg_streq(f0, "*" as *u8) == 0 {
                  var lfound: i64 = 0
                  var lp: i64 = 0
                  while lp < ll {
                      if (lreg[lp] as i64) != 35 { if (lreg[lp] as i64) != 10 {
                          let lle: i64 = tg_line_end(lreg, lp, ll)
                          tg_wsfield(lreg, lp, lle, 0, f1, 512)
                          if tg_streq(f0, f1) == 1 { lfound = 1; lp = ll }
                      } }
                      if lfound == 0 { lp = tg_next_line(lreg, lp, ll) }
                  }
                  if lfound == 0 {
                      var kw8: i64 = 0
                      kw8 = tg_sappend(keyb, kw8, "INV8|" as *u8)
                      kw8 = tg_sappend(keyb, kw8, f0)
                      keyb[kw8] = 0 as u8
                      var mw8: i64 = 0
                      mw8 = tg_sappend(msgb, mw8, "served vhost has NO lifecycle row (stage unknown): " as *u8)
                      mw8 = tg_sappend(msgb, mw8, f0)
                      msgb[mw8] = 0 as u8
                      cw = tg_cand(cand, cw, keyb, msgb)
                  }
              } }
              pos = tg_next_line(sites, pos, il)
          } }
      }
      // ---- INV-9: live-edge stage evidence (skip when the edge is down; selfheal owns that alarm) ----
      var edge_up: i64 = 0
      if hp_probe_tls(8443, 3) == HP_SERVING { edge_up = 1 }
      if edge_up == 1 {
          pos = 0
          while pos < ll {
              if (lreg[pos] as i64) == 35 { pos = tg_next_line(lreg, pos, ll) }
              else { if (lreg[pos] as i64) == 10 { pos = pos + 1 }
              else {
                  let le9: i64 = tg_line_end(lreg, pos, ll)
                  let dn9: i64 = tg_wsfield(lreg, pos, le9, 0, f0, 512)
                  tg_wsfield(lreg, pos, le9, 1, f1, 512)
                  if dn9 > 0 {
                      let frc: i64 = tg_fetch(f0)
                      var flen: i64 = 0
                      if frc == 0 { flen = tg_read(TG_FETCH, fetchb, TG_FETCHCAP) }
                      if flen <= 0 {
                          var kw9f: i64 = 0
                          kw9f = tg_sappend(keyb, kw9f, "INV9|" as *u8)
                          kw9f = tg_sappend(keyb, kw9f, f0)
                          kw9f = tg_sappend(keyb, kw9f, "-fetchfail" as *u8)
                          keyb[kw9f] = 0 as u8
                          var mw9f: i64 = 0
                          mw9f = tg_sappend(msgb, mw9f, "stage evidence fetch FAILED for " as *u8)
                          mw9f = tg_sappend(msgb, mw9f, f0)
                          mw9f = tg_sappend(msgb, mw9f, " (cannot verify stage; NOT treated as a leak)" as *u8)
                          msgb[mw9f] = 0 as u8
                          cw = tg_cand(cand, cw, keyb, msgb)
                      }
                      else {
                          let has_mark: i64 = tg_contains(fetchb, flen, marker)
                          let is_prod: i64 = tg_streq(f1, "production" as *u8)
                          if is_prod == 1 { if has_mark == 1 {
                              var kw9s: i64 = 0
                              kw9s = tg_sappend(keyb, kw9s, "INV9|" as *u8)
                              kw9s = tg_sappend(keyb, kw9s, f0)
                              kw9s = tg_sappend(keyb, kw9s, "-stuck" as *u8)
                              keyb[kw9s] = 0 as u8
                              var mw9s: i64 = 0
                              mw9s = tg_sappend(msgb, mw9s, "production domain still SERVES coming-soon (launch did not take): " as *u8)
                              mw9s = tg_sappend(msgb, mw9s, f0)
                              msgb[mw9s] = 0 as u8
                              cw = tg_cand(cand, cw, keyb, msgb)
                          } }
                          if is_prod == 0 { if has_mark == 0 {
                              var kw9l: i64 = 0
                              kw9l = tg_sappend(keyb, kw9l, "INV9|" as *u8)
                              kw9l = tg_sappend(keyb, kw9l, f0)
                              kw9l = tg_sappend(keyb, kw9l, "-leak" as *u8)
                              keyb[kw9l] = 0 as u8
                              var mw9l: i64 = 0
                              mw9l = tg_sappend(msgb, mw9l, "stage!=production domain serves NON-coming-soon content publicly (unapproved go-live leak): " as *u8)
                              mw9l = tg_sappend(msgb, mw9l, f0)
                              msgb[mw9l] = 0 as u8
                              cw = tg_cand(cand, cw, keyb, msgb)
                          } }
                      }
                  }
                  pos = tg_next_line(lreg, pos, ll)
              } }
          }
      }
      // ---- classify vs baseline + build the report ----
      var new_n: i64 = 0
      var debt_n: i64 = 0
      var rw: i64 = 0
      rw = tg_sappend(rep, rw, "nx_tenancy_gate cycle=" as *u8)
      rw = rw + tg_decw(cyc, (((rep as i64) + rw)) as *u8)
      rw = tg_sappend(rep, rw, " edge=" as *u8)
      if edge_up == 1 { rw = tg_sappend(rep, rw, "SERVING" as *u8) } else { rw = tg_sappend(rep, rw, "DOWN(inv9-skipped)" as *u8) }
      rep[rw] = 10 as u8
      rw = rw + 1
      var body_start: i64 = rw
      pos = 0
      while pos < cw {
          let cle: i64 = tg_line_end(cand, pos, cw)
          // key = up to TAB
          var kp: i64 = pos
          var ko: i64 = 0
          while kp < cle { if (cand[kp] as i64) == 9 { kp = cle } else { keyb[ko] = cand[kp]; ko = ko + 1; kp = kp + 1 } }
          keyb[ko] = 0 as u8
          let known: i64 = tg_contains(base, bl, keyb)
          if rw < TG_SHSZ - 1024 {
              if known == 1 { rw = tg_sappend(rep, rw, "[debt] " as *u8); debt_n = debt_n + 1 }
              else { rw = tg_sappend(rep, rw, "[NEW ] " as *u8); new_n = new_n + 1 }
              var bp: i64 = pos
              while bp < cle { rep[rw] = cand[bp]; rw = rw + 1; bp = bp + 1 }
              rep[rw] = 10 as u8
              rw = rw + 1
          }
          pos = tg_next_line(cand, pos, cw)
      }
      // verdict line FIRST would be nicer, but the header carries counts: append summary+verdict at end
      rw = tg_sappend(rep, rw, "summary: debt=" as *u8)
      rw = rw + tg_decw(debt_n, (((rep as i64) + rw)) as *u8)
      rw = tg_sappend(rep, rw, " new=" as *u8)
      rw = rw + tg_decw(new_n, (((rep as i64) + rw)) as *u8)
      rw = tg_sappend(rep, rw, " VERDICT=" as *u8)
      if new_n == 0 { rw = tg_sappend(rep, rw, "GREEN" as *u8) } else { rw = tg_sappend(rep, rw, "RED" as *u8) }
      rep[rw] = 10 as u8
      rw = rw + 1
      // seqlock publish
      shq[0] = shq[0] + 1
      var pj2: i64 = 0
      while pj2 < rw { shm[16 + pj2] = rep[pj2]; pj2 = pj2 + 1 }
      shq[1] = rw
      shq[0] = shq[0] + 1
      // alert append on NEW (same file the bash alert used; append-only). DEDUPED: a persistent
      // unchanged RED alerts ONCE, not every cycle (the bash version re-appended every 60s = 1440
      // lines/day of the same regression). Any CHANGE in the finding set while new>0 re-alerts.
      var same_as_prev: i64 = 0
      if cw == prevw {
          var mi2: i64 = 0
          same_as_prev = 1
          while mi2 < cw { if cand[mi2] != prevc[mi2] { same_as_prev = 0; mi2 = cw } mi2 = mi2 + 1 }
      }
      var pc: i64 = 0
      while pc < cw { prevc[pc] = cand[pc]; pc = pc + 1 }
      prevw = cw
      if new_n > 0 { if same_as_prev == 0 {
          let afd: i64 = sys_openat_append(TG_ALERTS, 420)
          if afd >= 0 {
              var aw: i64 = rw
              aw = tg_sappend(rep, aw, "ts=" as *u8)
              aw = aw + tg_decw(sys_now_realtime_sec(), (((rep as i64) + aw)) as *u8)
              aw = tg_sappend(rep, aw, " TENANCY-REGRESSION new=" as *u8)
              aw = aw + tg_decw(new_n, (((rep as i64) + aw)) as *u8)
              aw = tg_sappend(rep, aw, " (report: 127.0.0.1:18094)" as *u8)
              rep[aw] = 10 as u8
              aw = aw + 1
              sys_write(afd, (((rep as i64) + rw)) as *u8, aw - rw)
              sys_close(afd)
          }
      } }
      sys_sleep_ms(TG_CYCLE_SEC * 1000)
  }
  return 0
830}
nx_tenancy_gate.nx source

`nx_tenancy_gate.nx` source
