nx_tools_api_canonical_candidate_t182.nx source

1import "nx_jobclaim_lib.nx" 2// nx_tools_api.nx -- R0 of the sovereign AGENT-FACING API: expose the nx_tool_registry over HTTP. 3// TWO surfaces from ONE registry (the ecosystem's capability SSOT), benchmark = MCP, and BEYOND it: 4// GET /api/tools -> {"tools":[{name,description,invoke,status}]} -- SUPERSET: every tool advertises its 5// gate-`status` (proven/not), a provenance field MCP's tools/list has no concept of. 6// POST /mcp -> JSON-RPC 2.0 (initialize + tools/list) -- MCP-COMPATIBLE so ANY MCP client (Claude 7// included) discovers Nishi's tools with zero adapter. 8// PURE FUNCTION ta_handle_pfx(prefix, req, req_n, out) -> out_n (bytes in, bytes out, NO socket) so the gate 9// drives it in-process (nx_tools_api_gate), exactly like ma_handle. Composes nx_tool_registry (data) + nx_tabrec 10// (tr_field, transitive). No new transport -- wired behind the sovereign edge at deploy. license_tier: ORIGINAL 11import "nx_mcp_envelope.nx" 12import "_hdl_build/nx_json_lib.nx" 13import "nx_tool_registry.nx" // tool registry and transitive table records 14import "nx_cap_token.nx" // capt_verify / CAPT_OK -- capability-scoped invocation (R2: the beyond-MCP security exceed) 15import "nx_tool_exec_allow.nx" // tea_run / TEA_OK -- R2 EXECUTION: real tools/call runs a vetted GREEN organ (+ transitive nx_tool_run) 16import "nx_tool_http_backend.nx" // thb_dispatch / THB_OK -- 2nd execution kind: a registered HTTP backend (search/doc) fetched in-process over loopback 17import "sha256.nx" // sha256_digest -- PKCE S256 code-challenge verification (OAuth 2.1 AS) 18import "nx_toolcall_idem_lib.nx" // ti_classify / ti_record -- params._idem Idempotency-Key on tools/call (DI4, 2026-09-05) 19const TA_MAGIC_65536: i64 = 65536 20// seq1301 (2026-07-30): sync tools/call capture cap. DERIVED: worst-case ta_json_esc expansion is 6x 21// (\uXXXX per control byte), jb response buffer = 1MiB => cap = 160KiB keeps 6x escape at 960KiB < jb. 22// The old 64KiB cap clipped organ stdout SILENTLY (an 80KiB source read came back as exactly 65536 23// bytes, no marker -- nearly shipped a truncated daemon). Truncation is now ALSO flagged in _meta. 24const TA_CAPTURE_CAP: i64 = 163840 25const TA_MAGIC_8192: i64 = 8192 26const TA_MAGIC_1048576: i64 = 1048576 27const TA_MAGIC_9999999999: i64 = 9999999999 28const TA_MAGIC_2048: i64 = 2048 29const TA_MAGIC_4096: i64 = 4096 30const TA_MAGIC_1469598: i64 = 1469598 31const TA_MAGIC_16384: i64 = 16384 32const TA_MAGIC_4294967295: i64 = 4294967295 33const TA_MAGIC_3600: i64 = 3600 34const TA_MAGIC_88161: i64 = 88161 35 36const TA_TOOLPFX: *u8 = "knowledge/toolreg-" as *u8 // production registry prefix (mirrors TOOL_PREFIX) 37const TA_MCP_PAGE: i64 = 64 // MCP tools/list page size (cursor pagination); clients walk nextCursor. 38 // 8 made a ~500-tool roster cost ~63 round-trips per session initialize -- 39 // with any per-request store cost that compounds into minutes (2026-07-30 40 // outage). 64 keeps a page well under the 1MiB response buffer. 41const TA_ALL_LIMIT: i64 = 100000 // /api/tools emits ALL tools (effectively-unbounded page) 42// HMAC secret for capability tokens. WARN: PLACEHOLDER for the gate + first increment -- production MUST source this 43// from the sovereign vault (nx_vault), NEVER a compiled constant (a baked secret is forgeable by anyone reading the binary). 44const TA_CAP_SECRET: *u8 = "nishi-tools-cap-hmac-secret-v1-REPLACE-FROM-VAULT" as *u8 45// PROD secret: raw bytes in this keyfile (relative to the server CWD = the NAS nishihost dir), 0600, provisioned once. 46// Loaded per tools/call; falls back to the constant above ONLY when absent (dev / in-process gates). This retires the 47// baked secret in production while keeping the gates deterministic. 48const TA_CAP_KEYFILE: *u8 = "tools_cap_secret.key" as *u8 49 50// ---- byte helpers (self-contained) ------------------------------------------------------------------ 51func ta_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 52func ta_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i } 53// async-job file landing (rung 24): O_CREAT|O_TRUNC write, full-drain loop. 54// ---- INVOCATION LEDGER (2026-08-04, debt 1785878018) ------------------------------------------ 55// THE DEFECT THIS CLOSES: nx_catalog / nx_wirecensus grade an organ's INVOKED axis from 56// knowledge/status/actlog.jrnl -- but nothing ever wrote a tools/call there. Only organs that 57// self-log, plus harvest ingests, appeared. MEASURED: nx_agreebound_gate, nx_writebench and 58// nx_writebench_gate were each driven over the LIVE /mcp surface (HTTP 200, full output, 59// _meta.exit_code 0) and all three still graded REGISTERED-DARK(S4) "NEVER RUN", while nx_catalog 60// itself had ZERO rows despite many runs. So the banked headline "768 registered / 274 invoked / 61// 183 DARK" was measuring SELF-LOGGING ADOPTION, and an MCP-only tool could never be cleared -- 62// the guard reported a gap that no amount of using the tools could close. 63// ★★★★★A DETECTOR'S COVERAGE IS TWO SETS: WHAT IT MATCHES AND WHERE IT LOOKS. This one looked in a 64// log its own subject never wrote to. The daemon that dispatches the call is the only place that 65// KNOWS a call happened, so the record belongs here. 66// 67// NEVER-BRICK / never-degrade: append-only, best-effort, fail-silent. A missing dir, a full disk or 68// a refused open must NEVER affect the tool result -- logging observes the call, it does not gate 69// it. Row shape matches the existing journal: epoch \t actor \t tool \t verb \t status \t note. 70// (ta_actlog itself is defined below ta_catb/ta_catn, which it uses.) 71 72func ta_job_put(path: *u8, buf: *u8, n: i64) -> i64 { 73 if n < 0 { return 0 - 1 } 74 let fd: i64 = sys_openat_wr(path, 420) 75 if fd < 0 { return fd } 76 var w: i64 = 0 77 while w < n { 78 let r: i64 = sys_write(fd, ((buf as i64) + w) as *u8, n - w) 79 if r != TR_EINTR { 80 if r <= 0 { 81 sys_close(fd) 82 if r < 0 { return r } 83 return 0 - 1 84 } 85 w = w + r 86 } 87 } 88 let closed: i64 = sys_close(fd) 89 if closed < 0 { return closed } 90 return 0 91} 92// Publish the completion marker only after output and marker writes succeed. 93// This orders visible evidence; it does not establish power-loss durability. 94func ta_job_publish(output_path: *u8, output: *u8, output_n: i64, temp_path: *u8, marker: *u8, marker_n: i64, claim_path: *u8) -> i64 { 95 let output_rc: i64 = ta_job_put(output_path, output, output_n) 96 if output_rc != 0 { return output_rc } 97 let marker_rc: i64 = ta_job_put(temp_path, marker, marker_n) 98 if marker_rc != 0 { return marker_rc } 99 return sys_renameat(temp_path, claim_path) 100} 101 102func ta_catb(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n } 103func ta_catn(d: *u8, o: i64, v: i64) -> i64 { 104 // Keep magnitude nonpositive: the signed minimum has no positive counterpart. 105 var m: i64 = v 106 var w: i64 = o 107 if m < 0 { d[w] = 45 as u8; w = w+1 } 108 if m > 0 { m = 0-m } 109 let first: i64 = w 110 if m == 0 { d[w] = 48 as u8; return w+1 } 111 while m < 0 { 112 d[w] = (48-(m%10)) as u8 113 w = w+1 114 m = m/10 115 } 116 var left: i64 = first 117 var right: i64 = w-1 118 while left < right { 119 let digit: u8 = d[left] 120 d[left] = d[right] 121 d[right] = digit 122 left = left+1 123 right = right-1 124 } 125 return w 126} 127// LATENCY TELEMETRY (2026-08-07). This row already recorded WHAT ran and WHETHER it worked, but 128// never HOW LONG -- and the 503 class is entirely a latency problem: the edge closes the window at 129// 15s (NX_SD2_BACKEND_TIMEOUT_S) and the sync lane is budgeted at 14s, so a call that outruns it is 130// a 503 whose work may still have LANDED. The async lane fixes that, but its membership was a hand 131// written list of tools somebody noticed failing -- you cannot route by latency you never measured. 132// dur_ms is TOTAL HANDLER TIME from the moment authority is granted, because that is the quantity 133// the edge window actually applies; exec time alone would understate it. 134// APPENDED at the end of the free-text tail, so tab-splitting readers and key= scanners both keep 135// working unchanged (rule 19). 136// ONE row writer. `extra` is a NUL-terminated suffix of ` key=value` fields appended BEFORE the newline -- 137// ADDITIVE: the seven positional fields are byte-identical, so every existing reader (nx_actlog, 138// nx_toolatency, the harvest beat) parses exactly what it parsed before; a reader that wants the new 139// fields greps them by name. Added 2026-08-23 for the sync-promoted row (job=, reply_ms=; debt 1787505278). 140const TA_LOG_I64_WIDTH: i64 = 20 141const TA_LOG_I64_MAX: i64 = 9223372036854775807 142func ta_log_size_add(a: i64, b: i64) -> i64 { 143 if a < 0 { return 0-1 } 144 if b < 0 { return 0-1 } 145 if a > TA_LOG_I64_MAX-b { return 0-1 } 146 return a+b 147} 148// One append implementation for legacy calls and additive observations; no second store. 149func ta_journal_write_fd(fd: i64, row: *u8, n: i64) -> i64 { 150 if fd < 0 { return 0-1 } 151 if n < 0 { return 0-1 } 152 if (row as i64) <= 0 { return 0-1 } 153 var done: i64 = 0 154 while done < n { 155 let wrote: i64 = sys_write(fd, ((row as i64)+done) as *u8, n-done) 156 if wrote <= 0 { if wrote < 0 { return wrote }; return 0-1 } 157 done = done+wrote 158 } 159 return 0 160} 161func ta_journal_append(path: *u8, row: *u8, n: i64) -> i64 { 162 if n < 0 { return 0-1 } 163 if (row as i64) <= 0 { return 0-1 } 164 var fd: i64 = 0-1 165 if (path as i64) > 0 { fd = sys_openat_append(path, 420) } else { 166 fd = sys_openat_append("knowledge/status/actlog.jrnl" as *u8, 420) 167 if fd < 0 { fd = sys_openat_append("/volume1/homes/elderwesto/nishihost/knowledge/status/actlog.jrnl" as *u8, 420) } 168 } 169 if fd < 0 { return fd } 170 let written: i64 = ta_journal_write_fd(fd, row, n) 171 let closed: i64 = sys_close(fd) 172 if written < 0 { return written } 173 return closed 174} 175func ta_actlog_x_to(path: *u8, tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64, extra: *u8) -> i64 { 176 if tlen < 0 { return 0-1 } 177 if (tool as i64) <= 0 { return 0-1 } 178 if (lane as i64) <= 0 { return 0-1 } 179 if (status as i64) <= 0 { return 0-1 } 180 if (extra as i64) <= 0 { return 0-1 } 181 let literals: *u8 = "\tmcp\t\tcall\t\ttools/call lane= exit= bytes= dur_ms=\n" as *u8 182 var cap: i64 = ta_log_size_add(4*TA_LOG_I64_WIDTH+1, ta_slen(literals)) 183 cap = ta_log_size_add(cap, ta_slen(lane)) 184 cap = ta_log_size_add(cap, ta_slen(status)) 185 cap = ta_log_size_add(cap, ta_slen(extra)) 186 cap = ta_log_size_add(cap, tlen) 187 if cap < 0 { return 0-1 } 188 let ln: *u8 = sys_mmap(cap) 189 if (ln as i64) <= 0 { return 0-1 } 190 var o: i64 = ta_catn(ln, 0, sys_now_realtime_sec()) 191 o = ta_cat(ln, o, "\tmcp\t" as *u8) 192 o = ta_catb(ln, o, tool, tlen) 193 o = ta_cat(ln, o, "\tcall\t" as *u8) 194 o = ta_cat(ln, o, status) 195 o = ta_cat(ln, o, "\ttools/call lane=" as *u8) 196 o = ta_cat(ln, o, lane) 197 o = ta_cat(ln, o, " exit=" as *u8) 198 o = ta_catn(ln, o, ec) 199 o = ta_cat(ln, o, " bytes=" as *u8) 200 o = ta_catn(ln, o, bytes) 201 o = ta_cat(ln, o, " dur_ms=" as *u8) 202 o = ta_catn(ln, o, dur_ms) 203 o = ta_cat(ln, o, extra) 204 o = ta_cat(ln, o, "\n" as *u8) 205 let result: i64 = ta_journal_append(path, ln, o) 206 sys_munmap(ln, cap) 207 return result 208} 209func ta_actlog_x(tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64, extra: *u8) -> i64 { 210 return ta_actlog_x_to(0 as *u8, tool, tlen, lane, status, ec, bytes, dur_ms, extra) 211} 212func ta_actlog(tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64) -> i64 { 213 return ta_actlog_x(tool, tlen, lane, status, ec, bytes, dur_ms, "" as *u8) 214} 215 216func ta_put1(d: *u8, o: i64, a: i64) -> i64 { d[o] = a as u8; return o + 1 } 217func ta_put2(d: *u8, o: i64, a: i64, b: i64) -> i64 { d[o] = a as u8; d[o + 1] = b as u8; return o + 2 } 218func ta_hexd(v: i64) -> i64 { if v < 10 { return 48 + v } return 87 + v } // 0-9 then a-f 219 220// ---- cap-signing secret: ONE resolver (DRY across tools/call + cap issue/revoke + the status probe) ---------- 221// Resolve the HMAC signing secret EXACTLY as the server does everywhere: prefer the vault-provisioned keyfile 222// (production), else fall back to the dev/gate placeholder constant. `keyfile` is explicit so a gate can drive it 223// against a temp path without touching the server CWD; ta_load_cap_secret pins the production TA_CAP_KEYFILE. 224func ta_load_cap_secret_from(keyfile: *u8, outlen: *i64) -> *u8 { 225 let ksz: *i64 = sys_mmap(16) as *i64 226 let kf: *u8 = sys_read_file(keyfile, ksz) 227 if (kf as i64) != 0 { if ksz[0] > 0 { outlen[0] = ksz[0]; return kf } } 228 let pn: i64 = ta_slen(TA_CAP_SECRET) // hoist the call OUT of the array store (nx_cc: call-in-array-store -> corrupt/SEGV) 229 outlen[0] = pn 230 return TA_CAP_SECRET 231} 232// ---- DEGRADED-MODE ANNOUNCE (debt 1787255203, 2026-08-20) --------------------------------------- 233// THE FALLBACK ABOVE IS NOT THE BUG AND MUST NOT BE REMOVED. It is deliberate, declared and 234// load-bearing: five consumers sign with the baked constant, and nx_tools_api_exec_gate REQUIRES the 235// unprovisioned state BY ITS OWN DESIGN -- it asserts insecure_placeholder and REFUSES exit 3 if a real 236// keyfile is present, a never-brick guard added after its fixture replaced the production allowlist for 237// 2h20m. Deleting the fallback would break the capability gate suite and re-arm that incident. 238// THE BUG IS THAT ENTERING THE DEGRADED MODE WAS SILENT AT RUNTIME: no log, no warn, no marker, on the 239// per-tools/call hot path in PRODUCTION, with GET /api/cap/status -- a poll somebody has to remember to 240// make -- as the only witness. The asymmetry is what makes that urgent rather than merely untidy: 241// fail-CLOSED announces itself the instant it happens; fail-OPEN is silent BY CONSTRUCTION, so its only 242// signal is the compensating control -- and on 2026-08-20 that control (the */5 cap-plane probe) was 243// itself down and had been for hours. 244// **** MAKE THE MODE AN EVENT, NOT A STATE SOMEBODY HAS TO GO AND ASK ABOUT. **** 245// 246// WHY A LATCH AND NOT A LINE PER CALL: this sits on the per-tools/call path. A line per verification 247// would flood the journal under load and -- worse -- would make the signal something every reader learns 248// to filter, which is the same silence with extra bytes. The latch makes the steady-state cost ONE 249// INTEGER COMPARE, and emits only on the FIRST resolution in this process and on every genuine 250// TRANSITION in EITHER direction. A recovery is as much an event as a degradation, and a detector that 251// only ever reports the bad half cannot tell you the fault cleared. 252// 253// WHY ITS OWN JOURNAL AND NOT actlog.jrnl: actlog is the INVOCATION LEDGER that nx_catalog grades the 254// INVOKED axis from. Writing config-health rows into it would silently move a measurement plane that 255// other organs publish numbers off. ONE SUBJECT PER ROW, AND THE WRITER OWNS ITS OWN FILE. 256// 257// FAIL-SILENT, ALWAYS, same contract as ta_actlog: a refused open, a full disk or a missing directory 258// must NEVER affect a verification. Announcing OBSERVES the mode, it does not gate it. stderr is written 259// FIRST so the daemon log carries the event even when the journal cannot be opened at all. 260static ta_capmode: *i64 261const TA_CAPMODE_SLOTS: i64 = 16 262const TA_CAPMODE_UNSEEN: i64 = 0 263const TA_CAPMODE_PROV: i64 = 1 264const TA_CAPMODE_PLACE: i64 = 2 265const TA_CAPMODE_MODE: i64 = 420 266const TA_CAPMODE_LINE: i64 = 512 267const TA_CAPMODE_JRNL: *u8 = "knowledge/status/capmode.jrnl" as *u8 268 269func ta_capmode_announce(mode: i64) -> i64 { 270 if (ta_capmode as i64) == 0 { 271 ta_capmode = sys_mmap(TA_CAPMODE_SLOTS) as *i64 272 ta_capmode[0] = TA_CAPMODE_UNSEEN 273 } 274 if ta_capmode[0] == mode { return 0 } 275 let prev: i64 = ta_capmode[0] 276 ta_capmode[0] = mode 277 let ln: *u8 = sys_mmap(TA_CAPMODE_LINE) 278 var o: i64 = ta_catn(ln, 0, sys_now_realtime_sec()) 279 o = ta_cat(ln, o, "\tnx_tools_api\tcap-secret\t" as *u8) 280 if mode == TA_CAPMODE_PLACE { 281 o = ta_cat(ln, o, "DEGRADED\tcapability tokens are being verified with the BAKED PLACEHOLDER constant, which is forgeable by anyone who can read the binary -- provision " as *u8) 282 o = ta_cat(ln, o, TA_CAP_KEYFILE) 283 o = ta_cat(ln, o, " (0600, server CWD) to retire it" as *u8) 284 } else { 285 o = ta_cat(ln, o, "PROVISIONED\tcapability tokens are being verified with the keyfile-sourced secret" as *u8) 286 } 287 o = ta_cat(ln, o, " prev=" as *u8) 288 o = ta_catn(ln, o, prev) 289 o = ta_cat(ln, o, "\n" as *u8) 290 sys_write(2, ln, o) 291 let fd: i64 = sys_openat_append(TA_CAPMODE_JRNL, TA_CAPMODE_MODE) 292 if fd >= 0 { 293 var w: i64 = 0 294 while w < o { 295 let r: i64 = sys_write(fd, ((ln as i64) + w) as *u8, o - w) 296 if r <= 0 { w = o } else { w = w + r } 297 } 298 sys_close(fd) 299 } 300 sys_munmap(ln, TA_CAPMODE_LINE) 301 return 1 302} 303 304// THE PRODUCTION ENTRY POINT, AND THE ONLY ONE THAT ANNOUNCES. ta_load_cap_secret_from stays a PURE 305// resolver so a gate can drive a temp keyfile, and so GET /api/cap/status (which reaches it through 306// ta_cap_provisioned_from) can PROBE the mode without flipping the latch. That separation is what stops 307// the */5 liveness probe from announcing about itself once every five minutes, forever. 308func ta_load_cap_secret(outlen: *i64) -> *u8 { 309 let s: *u8 = ta_load_cap_secret_from(TA_CAP_KEYFILE, outlen) 310 // hoist the const pointer to a local before comparing (nx_cc: touching a CONST directly is the 311 // documented footgun ta_cap_provisioned_from already works around three lines below). 312 let plc: *u8 = TA_CAP_SECRET 313 if (s as i64) == (plc as i64) { ta_capmode_announce(TA_CAPMODE_PLACE) } else { ta_capmode_announce(TA_CAPMODE_PROV) } 314 return s 315} 316 317 318// 1 if a REAL secret is loaded (a non-empty keyfile whose bytes are NOT the forgeable baked placeholder), else 0. 319// Reveals only a boolean config-health fact -- NEVER the secret. Also catches the footgun of a keyfile that literally 320// contains the placeholder string. 321func ta_cap_provisioned_from(keyfile: *u8) -> i64 { 322 let sl: *i64 = sys_mmap(16) as *i64 323 let s: *u8 = ta_load_cap_secret_from(keyfile, sl) 324 let plc: *u8 = TA_CAP_SECRET // hoist the const ptr to a local before indexing (nx_cc: CONST[i] indexing is broken) 325 let pn: i64 = ta_slen(plc) 326 if sl[0] != pn { return 1 } 327 var i: i64 = 0 328 while i < pn { if s[i] != plc[i] { return 1 } i = i + 1 } 329 return 0 330} 331func ta_cap_provisioned() -> i64 { return ta_cap_provisioned_from(TA_CAP_KEYFILE) } 332 333// a[0..an) equals NUL-terminated b ? (exact) -- used for method/path slice compares. 334func ta_streq_n(a: *u8, an: i64, b: *u8) -> i64 { 335 var i: i64 = 0 336 while i < an { if b[i] == (0 as u8) { return 0 } if a[i] != b[i] { return 0 } i = i + 1 } 337 if b[i] != (0 as u8) { return 0 } 338 return 1 339} 340 341// append s[0..n) into d at o as a JSON-safe string body (RFC 8259: escape " \ and control chars). Returns new o. 342// THE defensive boundary: a description carrying a raw '"' would corrupt the JSON otherwise (silent corruption). 343func ta_json_esc(d: *u8, o: i64, s: *u8, n: i64) -> i64 { 344 var i: i64 = 0 345 while i < n { 346 let c: i64 = (s[i] as i64) & 0xff 347 if c == 34 { o = ta_put2(d, o, 92, 34) } 348 else { if c == 92 { o = ta_put2(d, o, 92, 92) } 349 else { if c == 10 { o = ta_put2(d, o, 92, 110) } 350 else { if c == 13 { o = ta_put2(d, o, 92, 114) } 351 else { if c == 9 { o = ta_put2(d, o, 92, 116) } 352 else { if c < 32 { 353 o = ta_put2(d, o, 92, 117); o = ta_put2(d, o, 48, 48) 354 o = ta_put1(d, o, ta_hexd((c >> 4) & 0xf)); o = ta_put1(d, o, ta_hexd(c & 0xf)) 355 } else { o = ta_put1(d, o, c) } } } } } } 356 i = i + 1 357 } 358 return o 359} 360 361// first offset of NUL-term `needle` in hay[0..hn), or -1. 362func ta_indexof(hay: *u8, hn: i64, needle: *u8) -> i64 { 363 let nl: i64 = ta_slen(needle) 364 if nl == 0 { return 0 } 365 var i: i64 = 0 366 while i + nl <= hn { 367 var m: i64 = 1; var j: i64 = 0 368 while j < nl { if hay[i + j] != needle[j] { m = 0 } j = j + 1 } 369 if m == 1 { return i } 370 i = i + 1 371 } 372 return 0 - 1 373} 374 375// ---- HTTP request shredding ------------------------------------------------------------------------- 376// body offset = just past the CRLFCRLF header terminator (req_n if none -> empty body). 377func ta_body_off(req: *u8, req_n: i64) -> i64 { 378 var i: i64 = 0 379 while i + 3 < req_n { 380 if req[i] == (13 as u8) { if req[i + 1] == (10 as u8) { if req[i + 2] == (13 as u8) { if req[i + 3] == (10 as u8) { return i + 4 } } } } 381 i = i + 1 382 } 383 return req_n 384} 385// parse request line "METHOD SP PATH SP VERSION": mo[0/1]=method off/len, po[0/1]=path off/len. 1 ok / 0 malformed. 386func ta_reqline(req: *u8, req_n: i64, mo: *i64, po: *i64) -> i64 { 387 var i: i64 = 0 388 var sp1: i64 = 0 - 1 389 while i < req_n { if sp1 < 0 { if req[i] == (32 as u8) { sp1 = i } } i = i + 1 } 390 if sp1 < 0 { return 0 } 391 mo[0] = 0; mo[1] = sp1 392 let k: i64 = sp1 + 1 393 var sp2: i64 = 0 - 1 394 i = k 395 while i < req_n { if sp2 < 0 { if req[i] == (32 as u8) { sp2 = i } } i = i + 1 } 396 po[0] = k 397 if sp2 < 0 { po[1] = req_n - k } else { po[1] = sp2 - k } 398 return 1 399} 400 401// ---- JSON body field pluck (single-responsibility, fail-closed) ------------------------------------- 402// string VALUE content of "<keyq>":"content" -> out2[0]=off,out2[1]=len; 1 found / 0 absent. keyq includes quotes. 403func ta_json_str(body: *u8, n: i64, keyq: *u8, out2: *i64) -> i64 { 404 let p: i64 = ta_indexof(body, n, keyq) 405 if p < 0 { return 0 } 406 var i: i64 = p + ta_slen(keyq) 407 var q1: i64 = 0 - 1 408 while i < n { if q1 < 0 { if body[i] == (34 as u8) { q1 = i } } i = i + 1 } 409 if q1 < 0 { return 0 } 410 var q2: i64 = 0 - 1 411 i = q1 + 1 412 while i < n { if q2 < 0 { if body[i] == (34 as u8) { q2 = i } } i = i + 1 } 413 if q2 < 0 { return 0 } 414 out2[0] = q1 + 1; out2[1] = q2 - (q1 + 1) 415 return 1 416} 417// RAW value token after "<keyq>": (number OR quoted string, echoed verbatim for JSON-RPC id). 1 found / 0 absent. 418func ta_json_raw(body: *u8, n: i64, keyq: *u8, out2: *i64) -> i64 { 419 let p: i64 = ta_indexof(body, n, keyq) 420 if p < 0 { return 0 } 421 var i: i64 = p + ta_slen(keyq) 422 var col: i64 = 0 - 1 423 while i < n { if col < 0 { if body[i] == (58 as u8) { col = i } } i = i + 1 } 424 if col < 0 { return 0 } 425 var s: i64 = col + 1 426 var go: i64 = 1 427 while go == 1 { if s >= n { go = 0 } else { let c: i64 = body[s] as i64; if c == 32 { s = s + 1 } else { if c == 9 { s = s + 1 } else { go = 0 } } } } 428 var e: i64 = s 429 var go2: i64 = 1 430 while go2 == 1 { 431 if e >= n { go2 = 0 } else { 432 let c: i64 = body[e] as i64 433 if c == 44 { go2 = 0 } else { if c == 125 { go2 = 0 } else { if c == 32 { go2 = 0 } else { if c == 13 { go2 = 0 } else { if c == 10 { go2 = 0 } else { e = e + 1 } } } } } 434 } 435 } 436 out2[0] = s; out2[1] = e - s 437 return 1 438} 439// string-ARRAY value: parse "<keyq>":[ "s0","s1",... ] -> write each element (JSON-unescaped, NUL-terminated) 440// into the bump buffer `scratch` (capacity scap) and store its pointer (as i64) in out[base+k]. Returns the count 441// k (>=0); 0 for an absent or empty array; -1 refuses malformed or over-capacity input. 442// JSON escapes and raw UTF-8 preserve native argv bytes, excluding embedded NUL. 443// Existing field lookup retained; a present argv must be a complete string-only array. 444// Returns -1 on malformed Unicode/JSON, NUL, argument count or scratch overflow. 445// The caller must refuse execution on failure; no partial argv is a successful result. 446func ta_json_str_array(body: *u8, n: i64, keyq: *u8, out: *i64, base: i64, maxn: i64, scratch: *u8, scap: i64) -> i64 { 447 if base < 0 { return 0 - 1 }; if maxn < 0 { return 0 - 1 }; if scap <= 0 { return 0 - 1 } 448 let p: i64 = ta_indexof(body, n, keyq) 449 if p < 0 { return 0 } 450 var i: i64 = jx_skip_ws(body, n, p + ta_slen(keyq)) 451 if i >= n { return 0 - 1 }; if body[i] != (58 as u8) { return 0 - 1 } 452 i = jx_skip_ws(body, n, i + 1) 453 if i >= n { return 0 - 1 }; if body[i] != (91 as u8) { return 0 - 1 } 454 i = jx_skip_ws(body, n, i + 1) 455 if i >= n { return 0 - 1 } 456 if body[i] == (93 as u8) { return 0 } 457 var k: i64 = 0; var w: i64 = 0 458 while i < n { 459 if body[i] != (34 as u8) { return 0 - 1 } 460 if k >= maxn { return 0 - 1 } 461 if w >= scap { return 0 - 1 } 462 let dst: *u8 = ((scratch as i64) + w) as *u8 463 let end: i64 = jx_copy_str_argv(body, n, i + 1, dst, scap - w) 464 if end < 0 { return 0 - 1 } 465 let used: i64 = jx_len(dst) + 1 466 out[base + k] = dst as i64 467 w = w + used; k = k + 1 468 i = jx_skip_ws(body, n, end) 469 if i >= n { return 0 - 1 } 470 if body[i] == (93 as u8) { return k } 471 if body[i] != (44 as u8) { return 0 - 1 } 472 i = jx_skip_ws(body, n, i + 1) 473 // A closing bracket here is a trailing comma, so the next iteration refuses it. 474 } 475 return 0 - 1 476} 477 478// ---- response assembly (all JSON) ------------------------------------------------------------------- 479func ta_emit(out: *u8, status: *u8, body: *u8, body_n: i64) -> i64 { 480 var o: i64 = ta_cat(out, 0, status) 481 o = ta_cat(out, o, "\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8) 482 o = ta_catn(out, o, body_n) 483 o = ta_cat(out, o, "\r\n\r\n" as *u8) 484 o = ta_catb(out, o, body, body_n) 485 return o 486} 487func ta_emit_lit(out: *u8, status: *u8, lit: *u8) -> i64 { return ta_emit(out, status, lit, ta_slen(lit)) } 488 489// ---- R1 rich MCP tool schemas (data-driven, benchmark = MCP 2025-06-18 tools spec) -------------------- 490// Per-tool title + annotations (readOnly/destructive/idempotent/openWorld safety hints) + outputSchema + the 491// TYPED argv CONTRACT, sourced from a TAB-separated config so vetting a tool's profile is a data edit (rule 11), 492// not a code change. 493// Row: <name>\t<title>\t<ro>\t<destr>\t<idem>\t<openworld>\t<output-desc>[\t<argv-contract>] 494// col8 argv-contract (07-17, the tool-schema SOTA gap): the tool's exact argv grammar (verbs/args), emitted as 495// the inputSchema argv description so an agent reads the CONTRACT from tools/list instead of a generic blurb. 496// Absent col8 -> the generic argv description (back-compat). Conf is read per call = contract edits are LIVE. 497// UNKNOWN tool (no row) -> MCP-safe defaults: NOT read-only, POSSIBLY destructive, NOT idempotent, open-world 498// (so an agent treats an un-annotated tool as the cautious case). '#' comment + blank lines ignored. 499const TA_SCHEMACONF: *u8 = "knowledge/tool_schemas.conf" as *u8 // server CWD-relative (like tool_allowlist.conf) 500// DERIVED argv contracts (nx_toolgrammar), the col8 FALLBACK. Separate file on purpose: tool_schemas.conf 501// is a SHARED, hand-authored registry and a derived value must never overwrite a human's. Precedence is 502// authored col8 > derived grammar > generic placeholder. Read per request, so a re-harvest is LIVE. 503const TA_GRAMMARCONF: *u8 = "knowledge/tool_grammar.conf" as *u8 504// DERIVED MCP safety annotations (nx_toolflags). Applied ONLY to rows whose output-desc marks them 505// registration-synthesized -- i.e. whose quad was the hardcoded constant ma_schema_append_row writes and 506// never a measurement. MEASURED: 694 of 869 tools (79.9%) published that constant as if it were a fact, 507// so a read-only dashboard shipped as destructiveHint=true and agents refused safe reads. 508const TA_FLAGSCONF: *u8 = "knowledge/tool_flags.conf" as *u8 509// Atomic job-id reservation: the same O_CREAT|O_EXCL claim dl_lock (nx_dispatch_lease) uses. Values 510// PROVEN on this host by nx_exclprobe (first=fd3, second=-17 EEXIST) before being shipped here. 511const TA_SYS_OPENAT: i64 = 257 512const TA_AT_FDCWD: i64 = 0 - 100 513const TA_OEXCL: i64 = 193 // O_CREAT(0x40)|O_EXCL(0x80)|O_WRONLY(0x1) 514const TA_CLAIMMODE: i64 = 420 // 0644 515 516func ta_bool_json(v: i64) -> *u8 { if v == 1 { return "true" as *u8 } return "false" as *u8 } 517 518// idx-th TAB-field of line buf[ls,le) -> out2[0]=off,out2[1]=len; 1 if present, 0 if fewer fields. 519func ta_tsv_field(buf: *u8, ls: i64, le: i64, idx: i64, out2: *i64) -> i64 { 520 var fi: i64 = 0 521 var s: i64 = ls 522 var i: i64 = ls 523 while i <= le { 524 var sep: i64 = 0 525 if i == le { sep = 1 } else { if buf[i] == (9 as u8) { sep = 1 } } 526 if sep == 1 { 527 if fi == idx { out2[0] = s; out2[1] = i - s; return 1 } 528 fi = fi + 1 529 s = i + 1 530 } 531 i = i + 1 532 } 533 return 0 534} 535 536// emit ,"title":.. ,"annotations":{..} ,"outputSchema":{..} for `name` from `conf`. Testable (_from); the 537// production wrapper pins TA_SCHEMACONF. Always emits annotations (defaults if no row) so every MCP tool carries 538// safety hints. Appends to body at offset bin; returns the new offset. 539func ta_emit_mcp_schema_from(conf: *u8, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { 540 let szp0: *i64 = sys_mmap(16) as *i64 541 let buf0: *u8 = sys_read_file(conf, szp0) 542 var n0: i64 = 0 543 if (buf0 as i64) != 0 { n0 = szp0[0] } 544 return ta_emit_mcp_schema_buf(buf0, n0, name, nlen, body, bin) 545} 546// Buffer-based core: the schema conf is read ONCE PER REQUEST by the caller, not once per TOOL. 547// At page size 64 a per-tool re-read meant 64 x ~125KB file reads for a single tools/list -- the 548// dominant per-page cost once the toolreg plane was compacted (2026-07-30). 549// DERIVED-grammar lookup: <name>\t<grammar> rows emitted by nx_toolgrammar from each organ's OWN source 550// header. Consulted ONLY when tool_schemas.conf declares no col8, so an AUTHORED contract always wins and 551// a derived one can never overwrite a human's. MEASURED 2026-08-06: 749 of 869 tools (86.2%) had no col8 552// at all and served the generic "positional CLI args" placeholder; the harvest supplies 378 real ones. 553func ta_grammar_lookup(gbuf: *u8, gbn: i64, name: *u8, nlen: i64, out2: *i64) -> i64 { 554 if (gbuf as i64) == 0 { return 0 } 555 var ls: i64 = 0 556 var i: i64 = 0 557 while i <= gbn { 558 var eol: i64 = 0 559 if i == gbn { eol = 1 } else { if gbuf[i] == (10 as u8) { eol = 1 } } 560 if eol == 1 { 561 let le: i64 = i 562 if le > ls { if gbuf[ls] != (35 as u8) { 563 let f0: *i64 = sys_mmap(16) as *i64 564 if ta_tsv_field(gbuf, ls, le, 0, f0) == 1 { 565 if f0[1] == nlen { 566 var m: i64 = 1 567 var c: i64 = 0 568 while c < nlen { if gbuf[f0[0] + c] != name[c] { m = 0 } c = c + 1 } 569 if m == 1 { 570 let ff: *i64 = sys_mmap(16) as *i64 571 if ta_tsv_field(gbuf, ls, le, 1, ff) == 1 { if ff[1] > 0 { out2[0] = ff[0]; out2[1] = ff[1]; return 1 } } 572 return 0 573 } 574 } 575 } 576 } } 577 ls = i + 1 578 } 579 i = i + 1 580 } 581 return 0 582} 583// Does the schema row's output-desc carry the registration-synthesized marker? If so its safety quad is a 584// CONSTANT, not a measurement, and a derived quad may replace it. Any other row is human- or backfill- 585// authored and is left ALONE -- a derived value must never overwrite an authored one. 586func ta_od_has(buf: *u8, od_s: i64, od_l: i64, needle: *u8) -> i64 { 587 let m: i64 = ta_slen(needle) 588 if od_l < m { return 0 } 589 var i: i64 = 0 590 while i + m <= od_l { 591 var j: i64 = 0 592 var hit: i64 = 1 593 while j < m { if buf[od_s + i + j] != needle[j] { hit = 0; j = m } else { j = j + 1 } } 594 if hit == 1 { return 1 } 595 i = i + 1 596 } 597 return 0 598} 599// TWO shapes carry a FABRICATED quad, and both must be overridable: 600// (a) "(registered via /api/tools/register)" -- ma_schema_append_row's hardcoded 0/1/0/1. 601// (b) "auto-derived from source header by nx_schema_backfill" -- that organ's OLD path, whose own 602// header records the evidence: "of the 389 rows this organ has auto-derived, 389 carry the 603// identical quad 0 1 0 1 -- zero exceptions", i.e. it was never looked up either. 604// The organ's NEW path stamps "safety flags STATIC-DERIVED from the source's own syscalls"; that IS a 605// measurement and is left ALONE. Distinguishing (b) from the new path by its own marker is the only 606// honest way to tell a constant from a value that merely looks like one. 607func ta_od_is_regstub(buf: *u8, od_s: i64, od_l: i64) -> i64 { 608 if ta_od_has(buf, od_s, od_l, "safety flags STATIC-DERIVED" as *u8) == 1 { return 0 } 609 if ta_od_has(buf, od_s, od_l, "(registered via /api/tools/register)" as *u8) == 1 { return 1 } 610 if ta_od_has(buf, od_s, od_l, "auto-derived from source header by nx_schema_backfill" as *u8) == 1 { return 1 } 611 return 0 612} 613// <name>\t<ro>\t<destr>\t<idem>\t<open> -> out4[0..3]. 1 found / 0 absent. 614func ta_flags_lookup(fbuf: *u8, fbn: i64, name: *u8, nlen: i64, out4: *i64) -> i64 { 615 if (fbuf as i64) == 0 { return 0 } 616 var ls: i64 = 0 617 var i: i64 = 0 618 while i <= fbn { 619 var eol: i64 = 0 620 if i == fbn { eol = 1 } else { if fbuf[i] == (10 as u8) { eol = 1 } } 621 if eol == 1 { 622 let le: i64 = i 623 if le > ls { if fbuf[ls] != (35 as u8) { 624 let f0: *i64 = sys_mmap(16) as *i64 625 if ta_tsv_field(fbuf, ls, le, 0, f0) == 1 { 626 if f0[1] == nlen { 627 var m: i64 = 1 628 var c: i64 = 0 629 while c < nlen { if fbuf[f0[0] + c] != name[c] { m = 0 } c = c + 1 } 630 if m == 1 { 631 var k: i64 = 0 632 var okall: i64 = 1 633 while k < 4 { 634 if ta_tsv_field(fbuf, ls, le, k + 1, f0) == 1 { 635 if fbuf[f0[0]] == (49 as u8) { out4[k] = 1 } else { out4[k] = 0 } 636 } else { okall = 0 } 637 k = k + 1 638 } 639 return okall 640 } 641 } 642 } 643 } } 644 ls = i + 1 645 } 646 i = i + 1 647 } 648 return 0 649} 650func ta_emit_mcp_schema_buf2(buf: *u8, bufn: i64, gbuf: *u8, gbn: i64, fbuf: *u8, fbn: i64, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { 651 var b: i64 = bin 652 var ro: i64 = 0; var de: i64 = 1; var idp: i64 = 0; var ow: i64 = 1 // MCP-safe defaults for an unknown tool 653 var has_title: i64 = 0; var tt_s: i64 = 0; var tt_l: i64 = 0 654 var has_out: i64 = 0; var od_s: i64 = 0; var od_l: i64 = 0 655 var has_av: i64 = 0; var av_s: i64 = 0; var av_l: i64 = 0 // col8: typed argv contract 656 if (buf as i64) != 0 { 657 let n: i64 = bufn 658 var ls: i64 = 0; var i: i64 = 0; var done: i64 = 0 659 while i <= n { 660 var eol: i64 = 0 661 if i == n { eol = 1 } else { if buf[i] == (10 as u8) { eol = 1 } } 662 if eol == 1 { 663 if done == 0 { 664 let le: i64 = i 665 if le > ls { if buf[ls] != (35 as u8) { 666 let f0: *i64 = sys_mmap(16) as *i64 667 if ta_tsv_field(buf, ls, le, 0, f0) == 1 { 668 if f0[1] == nlen { 669 var m: i64 = 1; var c: i64 = 0 670 while c < nlen { if buf[f0[0] + c] != name[c] { m = 0 } c = c + 1 } 671 if m == 1 { 672 let ff: *i64 = sys_mmap(16) as *i64 673 if ta_tsv_field(buf, ls, le, 1, ff) == 1 { has_title = 1; tt_s = ff[0]; tt_l = ff[1] } 674 if ta_tsv_field(buf, ls, le, 2, ff) == 1 { if buf[ff[0]] == (49 as u8) { ro = 1 } else { ro = 0 } } 675 if ta_tsv_field(buf, ls, le, 3, ff) == 1 { if buf[ff[0]] == (49 as u8) { de = 1 } else { de = 0 } } 676 if ta_tsv_field(buf, ls, le, 4, ff) == 1 { if buf[ff[0]] == (49 as u8) { idp = 1 } else { idp = 0 } } 677 if ta_tsv_field(buf, ls, le, 5, ff) == 1 { if buf[ff[0]] == (49 as u8) { ow = 1 } else { ow = 0 } } 678 if ta_tsv_field(buf, ls, le, 6, ff) == 1 { has_out = 1; od_s = ff[0]; od_l = ff[1] } 679 if ta_tsv_field(buf, ls, le, 7, ff) == 1 { if ff[1] > 0 { has_av = 1; av_s = ff[0]; av_l = ff[1] } } 680 done = 1 681 } 682 } 683 } 684 } } 685 } 686 ls = i + 1 687 } 688 i = i + 1 689 } 690 } 691 // inputSchema: argv array typed by the tool's own contract (col8) when declared; generic otherwise. 692 b = ta_cat(body, b, ",\"inputSchema\":{\"type\":\"object\",\"properties\":{\"argv\":{\"type\":\"array\",\"items\":{\"type\":\"string\"},\"description\":\"" as *u8) 693 if has_av == 1 { 694 b = ta_json_esc(body, b, ((buf as i64) + av_s) as *u8, av_l) 695 } else { 696 var gemit: i64 = 0 697 if gbn > 0 { 698 let g2: *i64 = sys_mmap(16) as *i64 699 if ta_grammar_lookup(gbuf, gbn, name, nlen, g2) == 1 { 700 b = ta_json_esc(body, b, ((gbuf as i64) + g2[0]) as *u8, g2[1]) 701 gemit = 1 702 } 703 } 704 if gemit == 0 { b = ta_cat(body, b, "positional CLI args passed to the organ (argv[1..])" as *u8) } 705 } 706 b = ta_cat(body, b, "\"}}}" as *u8) 707 if has_title == 1 { 708 b = ta_cat(body, b, ",\"title\":\"" as *u8) 709 b = ta_json_esc(body, b, ((buf as i64) + tt_s) as *u8, tt_l) 710 b = ta_cat(body, b, "\"" as *u8) 711 } 712 // A CONSTANT WEARING THE SHAPE OF A MEASUREMENT IS WORSE THAN A BLANK. If this row's flags came from 713 // the register API's hardcoded quad, prefer the DERIVED quad (nx_toolflags: the organ's own syscalls 714 // plus one level of its import closure). Authored and backfill-derived rows are never touched. 715 if fbn > 0 { 716 if has_out == 1 { 717 if ta_od_is_regstub(buf, od_s, od_l) == 1 { 718 let q4: *i64 = sys_mmap(64) as *i64 719 if ta_flags_lookup(fbuf, fbn, name, nlen, q4) == 1 { 720 ro = q4[0] 721 de = q4[1] 722 idp = q4[2] 723 ow = q4[3] 724 } 725 } 726 } 727 } 728 b = ta_cat(body, b, ",\"annotations\":{\"readOnlyHint\":" as *u8) 729 b = ta_cat(body, b, ta_bool_json(ro)) 730 b = ta_cat(body, b, ",\"destructiveHint\":" as *u8) 731 b = ta_cat(body, b, ta_bool_json(de)) 732 b = ta_cat(body, b, ",\"idempotentHint\":" as *u8) 733 b = ta_cat(body, b, ta_bool_json(idp)) 734 b = ta_cat(body, b, ",\"openWorldHint\":" as *u8) 735 b = ta_cat(body, b, ta_bool_json(ow)) 736 b = ta_cat(body, b, "}" as *u8) 737 if has_out == 1 { 738 b = ta_cat(body, b, ",\"outputSchema\":{\"type\":\"object\",\"description\":\"" as *u8) 739 b = ta_json_esc(body, b, ((buf as i64) + od_s) as *u8, od_l) 740 b = ta_cat(body, b, "\"}" as *u8) 741 } 742 return b 743} 744// Back-compat presenter: callers with no grammar buffer (the gate's fixture path) keep the old signature 745// and get exactly the previous behaviour -- the generic argv description. Only the live registry walk in 746// ta_emit_tools passes a real grammar buffer, so gate fixtures stay hermetic. 747func ta_emit_mcp_schema_buf(buf: *u8, bufn: i64, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { 748 return ta_emit_mcp_schema_buf2(buf, bufn, 0 as *u8, 0, 0 as *u8, 0, name, nlen, body, bin) 749} 750func ta_emit_mcp_schema(name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { return ta_emit_mcp_schema_from(TA_SCHEMACONF, name, nlen, body, bin) } 751 752// ---- the registry -> JSON tools array (shared by REST + MCP; mcp=1 emits inputSchema, mcp=0 emits invoke/status) -- 753func ta_emit_field(body: *u8, b: i64, rec: *u8, rl: i64, idx: i64) -> i64 { 754 let f2: *i64 = sys_mmap(16) as *i64 755 if tr_field(rec, 0, rl, idx, f2) == 1 { return ta_json_esc(body, b, ((rec as i64) + f2[0]) as *u8, f2[1]) } 756 return b 757} 758// ---- DISCOVERABILITY: description falls back to the schema title ------------------------------------ 759// MEASURED 2026-08-06 over the live tools/list, all 14 pages: of 869 registered tools, 663 (76.3%) carry 760// "<name> output (registered via /api/tools/register)" as their MCP `description`. That string is a 761// REGISTRATION-TIME PLACEHOLDER, not prose: ma_schema_append_row (nx_mgmt_api.nx) writes the registrant's 762// real one-liner into schema col2 (`title`) and SYNTHESISES col7. `description` is the one field every MCP 763// client -- and every LLM choosing a tool -- actually reads, so the estate published a stub to its most-read 764// surface while the real text sat one column away. 587 of those 663 (88.5%) have a usable title already. 765// The information was never missing; it was MISFILED. Preferring the title here fixes all 663 at read time 766// with no data migration and no destructive write. The writer fix is separate (debt 1786056847). 767// Honest limit: this is a READ-side repair. It does not improve a tool whose title is ALSO absent. 768func ta_desc_is_stub(rec: *u8, rl: i64, name: *u8, nlen: i64) -> i64 { 769 let f2: *i64 = sys_mmap(16) as *i64 770 if tr_field(rec, 0, rl, 1, f2) != 1 { return 0 } 771 let ds: i64 = f2[0] 772 let dl: i64 = f2[1] 773 let sfx: *u8 = " output (" as *u8 774 let sl: i64 = ta_slen(sfx) 775 if dl < nlen + sl { return 0 } 776 var i: i64 = 0 777 while i < nlen { if rec[ds + i] != name[i] { return 0 } i = i + 1 } 778 var j: i64 = 0 779 while j < sl { if rec[ds + nlen + j] != sfx[j] { return 0 } j = j + 1 } 780 return 1 781} 782 783// col1 (title) of `name`'s row in the schema-conf buffer -> out2 = (off,len). 1 found / 0 absent. 784// Same row-scan shape as ta_emit_mcp_schema_buf; '#' comments and blank lines ignored. 785func ta_schema_title_buf(buf: *u8, bufn: i64, name: *u8, nlen: i64, out2: *i64) -> i64 { 786 if (buf as i64) == 0 { return 0 } 787 var ls: i64 = 0 788 var i: i64 = 0 789 while i <= bufn { 790 var eol: i64 = 0 791 if i == bufn { eol = 1 } else { if buf[i] == (10 as u8) { eol = 1 } } 792 if eol == 1 { 793 let le: i64 = i 794 if le > ls { if buf[ls] != (35 as u8) { 795 let f0: *i64 = sys_mmap(16) as *i64 796 if ta_tsv_field(buf, ls, le, 0, f0) == 1 { 797 if f0[1] == nlen { 798 var m: i64 = 1 799 var c: i64 = 0 800 while c < nlen { if buf[f0[0] + c] != name[c] { m = 0 } c = c + 1 } 801 if m == 1 { 802 let ff: *i64 = sys_mmap(16) as *i64 803 if ta_tsv_field(buf, ls, le, 1, ff) == 1 { if ff[1] > 0 { out2[0] = ff[0]; out2[1] = ff[1]; return 1 } } 804 return 0 805 } 806 } 807 } 808 } } 809 ls = i + 1 810 } 811 i = i + 1 812 } 813 return 0 814} 815 816func ta_emit_tools(prefix: *u8, body: *u8, bin: i64, mcp: i64, offset: i64, limit: i64, out_more: *i64) -> i64 { 817 var b: i64 = bin 818 var tidx: i64 = 0 // pagination: index across ALL tools; emit only [offset, offset+limit); flag out_more if beyond 819 // SIZE-TO-NEED. This is the live "what tools exist" surface, and the 64 KiB 820 // ceiling it replaces was already ~1/3 consumed at ~1,072 registered tools. 821 // Past that ceiling reg_index refused with -1, which this function fed into a 822 // pagination walk -- so the tool list would have gone EMPTY, and an empty tool 823 // list is indistinguishable from a healthy registry with nothing in it. 824 let idxbox: *i64 = sys_mmap(16) as *i64 825 let il: i64 = tool_list_pfx(prefix, idxbox) 826 let idxbuf: *u8 = idxbox[0] as *u8 827 var scb: *u8 = 0 as *u8 828 var scn: i64 = 0 829 // Loaded for BOTH surfaces now (was mcp==1 only): the REST tools array needs the schema title as well, 830 // because `description` now falls back to it whenever the registry row carries the registration stub. 831 let sszp: *i64 = sys_mmap(16) as *i64 832 scb = sys_read_file(TA_SCHEMACONF, sszp) 833 if (scb as i64) != 0 { scn = sszp[0] } 834 // read ONCE per request, never once per tool: a per-tool re-read cost 64 x ~125KB on one tools/list page 835 var gcb: *u8 = 0 as *u8 836 var gcn: i64 = 0 837 let gszp: *i64 = sys_mmap(16) as *i64 838 gcb = sys_read_file(TA_GRAMMARCONF, gszp) 839 if (gcb as i64) != 0 { gcn = gszp[0] } 840 var fcb: *u8 = 0 as *u8 841 var fcn: i64 = 0 842 let fszp: *i64 = sys_mmap(16) as *i64 843 fcb = sys_read_file(TA_FLAGSCONF, fszp) 844 if (fcb as i64) != 0 { fcn = fszp[0] } 845 let namez: *u8 = sys_mmap(512) 846 let po: *i64 = sys_mmap(16) as *i64 847 let lo: *i64 = sys_mmap(16) as *i64 848 var ls: i64 = 0 849 var i: i64 = 0 850 var first: i64 = 1 851 while i <= il { 852 var eol: i64 = 0 853 if i == il { eol = 1 } else { if idxbuf[i] == (10 as u8) { eol = 1 } } 854 if eol == 1 { 855 let nl: i64 = i - ls 856 if nl > 0 { 857 var c: i64 = 0 858 while c < nl { namez[c] = idxbuf[ls + c]; c = c + 1 } 859 namez[nl] = 0 as u8 860 if tool_get_pfx(prefix, namez, po, lo) == 1 { 861 if tidx >= offset { if tidx < offset + limit { 862 let rec: *u8 = po[0] as *u8 863 let rl: i64 = lo[0] 864 if first == 0 { b = ta_cat(body, b, "," as *u8) } 865 first = 0 866 b = ta_cat(body, b, "{\"name\":\"" as *u8) 867 b = ta_emit_field(body, b, rec, rl, 0) 868 b = ta_cat(body, b, "\",\"description\":\"" as *u8) 869 // Prefer the schema title when the registry carries the registration-time stub. 870 var demit: i64 = 0 871 if scn > 0 { 872 if ta_desc_is_stub(rec, rl, namez, nl) == 1 { 873 let t2: *i64 = sys_mmap(16) as *i64 874 if ta_schema_title_buf(scb, scn, namez, nl, t2) == 1 { 875 b = ta_json_esc(body, b, ((scb as i64) + t2[0]) as *u8, t2[1]) 876 demit = 1 877 } 878 } 879 } 880 if demit == 0 { b = ta_emit_field(body, b, rec, rl, 1) } 881 if mcp == 1 { 882 b = ta_cat(body, b, "\"" as *u8) 883 b = ta_emit_mcp_schema_buf2(scb, scn, gcb, gcn, fcb, fcn, namez, nl, body, b) // all three confs read once per request above 884 b = ta_cat(body, b, "}" as *u8) 885 } else { 886 b = ta_cat(body, b, "\",\"invoke\":\"" as *u8) 887 b = ta_emit_field(body, b, rec, rl, 2) 888 b = ta_cat(body, b, "\",\"status\":\"" as *u8) 889 b = ta_emit_field(body, b, rec, rl, 3) 890 b = ta_cat(body, b, "\"}" as *u8) 891 } 892 } else { if (out_more as i64) != 0 { out_more[0] = 1 } } } 893 tidx = tidx + 1 894 } 895 } 896 ls = i + 1 897 } 898 i = i + 1 899 } 900 return b 901} 902 903// ---- route handlers --------------------------------------------------------------------------------- 904func ta_index(out: *u8) -> i64 { 905 let body: *u8 = "{\"api\":\"nishi-tools\",\"version\":1,\"surfaces\":{\"rest\":\"GET /api/tools\",\"mcp\":\"POST /mcp (JSON-RPC 2.0: initialize, tools/list)\"},\"beyond_mcp\":\"each tool carries a gate-status MCP tools/list has no field for\"}" as *u8 906 return ta_emit_lit(out, "HTTP/1.1 200 OK" as *u8, body) 907} 908func ta_emit_page(out: *u8, html: *u8, n: i64) -> i64 { 909 var o: i64 = ta_cat(out, 0, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: " as *u8) 910 o = ta_catn(out, o, n) 911 o = ta_cat(out, o, "\r\n\r\n" as *u8) 912 o = ta_catb(out, o, html, n) 913 return o 914} 915// GET /tools -- a self-contained HUMAN page (NO double-quotes in the HTML so it is a clean NishiLang literal): it 916// fetches /api/tools client-side + renders one card per tool (XSS-escaped). THE login-level UI surface for the 917// capability ([[feedback-tools-must-surface-in-ui]]). 918func ta_html_tools(out: *u8) -> i64 { 919 let h: *u8 = sys_mmap(TA_MAGIC_8192) 920 var o: i64 = 0 921 o = ta_cat(h, o, "<!DOCTYPE html><meta charset=utf-8><meta name=viewport content='width=device-width,initial-scale=1'><title>Nishi Tools</title>" as *u8) 922 o = ta_cat(h, o, "<style>body{font-family:-apple-system,Segoe UI,sans-serif;max-width:900px;margin:4vh auto;padding:0 20px;color:#1c1c1e}h1{font-size:1.4rem;margin-bottom:.2rem}.sub{color:#666;margin:.1rem 0 1.1rem}.card{border:1px solid #e2e2e6;border-radius:10px;padding:12px 16px;margin:12px 0;background:#fbfbfd}.card h3{margin:.1rem 0 .3rem;font-family:ui-monospace,monospace}.inv{font-family:ui-monospace,monospace;font-size:.82rem;color:#555;background:#f2f2f7;padding:6px 8px;border-radius:6px;margin:.4rem 0;overflow-x:auto}.badge{display:inline-block;font-size:.72rem;padding:2px 8px;border-radius:99px;background:#e6f5ec;color:#0a6;font-weight:600}code{font-family:ui-monospace,monospace}.mcp{background:#eef;border:1px solid #dde;border-radius:8px;padding:10px 14px;font-size:.86rem;margin:1rem 0}</style>" as *u8) 923 o = ta_cat(h, o, "<h1>Nishi Tools</h1><p class=sub>Sovereign agent-facing registry &mdash; MCP-compatible + superset.</p><div class=mcp><b>MCP endpoint:</b> <code>POST /mcp</code> (JSON-RPC 2.0: <code>initialize</code>, <code>tools/list</code>) &mdash; any MCP client connects with zero adapter. &nbsp;<b>REST:</b> <code>GET /api/tools</code>. &nbsp;<b>Beyond MCP:</b> every tool carries a gate-<code>status</code>.</div><div id=t>loading&hellip;</div>" as *u8) 924 o = ta_cat(h, o, "<script>function esc(s){return String(s).split('&').join('&amp;').split('<').join('&lt;').split('>').join('&gt;')}fetch('/api/tools').then(function(r){return r.json()}).then(function(j){var a=j.tools||[],b='';for(var i=0;i<a.length;i++){var t=a[i];b+='<div class=card><h3>'+esc(t.name)+' <span class=badge>'+esc(t.status||'')+'</span></h3><div>'+esc(t.description||'')+'</div><div class=inv>'+esc(t.invoke||'')+'</div></div>'}document.getElementById('t').innerHTML=b||'<i>no tools registered</i>'}).catch(function(){document.getElementById('t').innerHTML='<i>failed to load /api/tools</i>'})</script>" as *u8) 925 return ta_emit_page(out, h, o) 926} 927func ta_tools(prefix: *u8, out: *u8) -> i64 { 928 let jb: *u8 = sys_mmap(TA_MAGIC_1048576) 929 var b: i64 = ta_cat(jb, 0, "{\"api\":\"nishi-tools\",\"version\":1,\"tools\":[" as *u8) 930 b = ta_emit_tools(prefix, jb, b, 0, 0, TA_ALL_LIMIT, 0 as *i64) 931 b = ta_cat(jb, b, "]}" as *u8) 932 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 933} 934// extract an HTTP header value into out2 (off,len). `key` includes the trailing colon, e.g. "X-Nishi-Cap:". 935// Searches only the header region (before the CRLFCRLF), trims leading spaces, stops at CR/LF. 1 found / 0 absent. 936func ta_header(req: *u8, req_n: i64, key: *u8, out2: *i64) -> i64 { 937 let hend: i64 = ta_body_off(req, req_n) 938 let p: i64 = ta_indexof(req, hend, key) 939 if p < 0 { return 0 } 940 var vs: i64 = p + ta_slen(key) 941 var go: i64 = 1 942 while go == 1 { if vs < hend { if req[vs] == (0x20 as u8) { vs = vs + 1 } else { go = 0 } } else { go = 0 } } 943 var ve: i64 = vs 944 var go2: i64 = 1 945 while go2 == 1 { if ve < hend { let c: i64 = req[ve] as i64; if c == 13 { go2 = 0 } else { if c == 10 { go2 = 0 } else { ve = ve + 1 } } } else { go2 = 0 } } 946 out2[0] = vs; out2[1] = ve - vs 947 return 1 948} 949 950// ---- ALTERNATE PRESENTER: the capability on the REQUEST-LINE QUERY STRING (?cap=<token>) ------------------ 951// WHY THIS EXISTS (measured 2026-07-30; debt seq1235). An MCP client that does not deliver its configured 952// X-Nishi-Cap header leaves EVERY tools/call denied for a WHOLE SESSION. The deny is indistinguishable from 953// -- this tool does not exist -- so the session falls back to raw ssh/PowerShell and never revisits: that is 954// 5,776 of 13,003 measured tool calls (44pct). Custom request headers are the most commonly dropped part of an 955// HTTP client's config; the URL is the ONE thing every client provably sends, because it is how the request 956// reached us at all. Binding the cap to the URL makes a session-starts-denied state impossible BY CONSTRUCTION 957// instead of by remembering to restart a client so a header re-loads. 958// SAME OBJECT-CAPABILITY, different presenter: the token is still HMAC-verified, expiry-checked, revocation- 959// checked and least-authority below. This changes WHERE the token is read from, never WHETHER it is proven -- 960// exactly the relationship the Authorization: Bearer presenter already has to the native header. 961// PRECEDENCE IS LOWEST ON PURPOSE (see ta_mcp_call): an explicit per-call _cap always wins, so the URL carries 962// the session BASELINE (least authority) and a deliberate escalation still overrides it. 963// Present ONLY a read/least-authority cap this way: URLs are logged by proxies far more readily than headers. 964// Key match is EXACT (len 3 + c,a,p) so a lookalike param like recap= or capx= can never authorize. 965func ta_query_cap(req: *u8, req_n: i64, out2: *i64) -> i64 { 966 let mo: *i64 = sys_mmap(16) as *i64 967 let po: *i64 = sys_mmap(16) as *i64 968 if ta_reqline(req, req_n, mo, po) == 0 { return 0 } 969 let poff: i64 = po[0] 970 let plen: i64 = po[1] 971 var qi: i64 = 0 972 var qs: i64 = 0 - 1 973 while qi < plen { if qs < 0 { if req[poff + qi] == (63 as u8) { qs = qi + 1 } } qi = qi + 1 } 974 if qs < 0 { return 0 } 975 // walk k=v pairs separated by '&'; accept the FIRST pair whose key is exactly cap (len 3). 976 var s: i64 = qs 977 while s < plen { 978 var e: i64 = s 979 var go: i64 = 1 980 while go == 1 { if e >= plen { go = 0 } else { if req[poff + e] == (38 as u8) { go = 0 } else { e = e + 1 } } } 981 var eq: i64 = 0 - 1 982 var k: i64 = s 983 while k < e { if eq < 0 { if req[poff + k] == (61 as u8) { eq = k } } k = k + 1 } 984 if eq - s == 3 { 985 if req[poff + s] == (99 as u8) { if req[poff + s + 1] == (97 as u8) { if req[poff + s + 2] == (112 as u8) { 986 if e - eq - 1 > 0 { out2[0] = poff + eq + 1; out2[1] = e - eq - 1; return 1 } 987 } } } 988 } 989 s = e + 1 990 } 991 return 0 992} 993// Liveness marker for the query-string presenter: returns 1 so a gate can assert the presenter is COMPILED IN 994// rather than merely declared. Asserted by nx_tools_api_gate T14. 995func ta_query_cap_available() -> i64 { 996 return 1 997} 998 999// R2: capability-scoped tools/call. Requires an X-Nishi-Cap capability token that GRANTS the requested tool (authority- 1000// in-the-token, verified with NO ambient identity -> confused-deputy is structurally impossible, unlike MCP's OAuth 1001// scopes). No capability, or one that doesn't grant this tool, or a forged/expired one -> JSON-RPC -32001. On success: 1002// ---- REVOCATION denylist: kill a leaked capability BEFORE its expiry (completes issue->delegate->verify->REVOKE) ---- 1003const TA_REVOKED_LIST: *u8 = "cap_revoked.list" as *u8 // newline-separated decimal nonces, relative to the server CWD 1004func ta_openat_append(path: *u8) -> i64 { return __syscall(257, AT_FDCWD, path, 0x441, 0x1a4, 0, 0) } // O_WRONLY|O_CREAT|O_APPEND, 0644 1005func ta_nonce_revoked(nonce: i64) -> i64 { 1006 if nonce < 0 { return 0 } 1007 let szp: *i64 = sys_mmap(16) as *i64 1008 let buf: *u8 = sys_read_file(TA_REVOKED_LIST, szp) 1009 if (buf as i64) == 0 { return 0 } 1010 let n: i64 = szp[0] 1011 let dec: *u8 = sys_mmap(32); let dl: i64 = ta_catn(dec, 0, nonce) 1012 var s: i64 = 0; var i: i64 = 0 1013 while i <= n { 1014 var eol: i64 = 0 1015 if i == n { eol = 1 } else { if buf[i] == (0x0a as u8) { eol = 1 } } 1016 if eol == 1 { 1017 if i - s == dl { var m: i64 = 1; var c: i64 = 0; while c < dl { if buf[s + c] != dec[c] { m = 0 } c = c + 1 } if m == 1 { return 1 } } 1018 s = i + 1 1019 } 1020 i = i + 1 1021 } 1022 return 0 1023} 1024func ta_append_revoked(nonce: i64) -> i64 { 1025 let dec: *u8 = sys_mmap(48); var dl: i64 = ta_catn(dec, 0, nonce); dec[dl] = 0x0a as u8; dl = dl + 1 1026 let fd: i64 = ta_openat_append(TA_REVOKED_LIST) 1027 if fd < 0 { return 0 - 1 } 1028 sys_write(fd, dec, dl); sys_close(fd) 1029 return 0 1030} 1031 1032// a SAFE STUB result (increment 1 proves the AUTHORIZATION; real tool execution is a separate guarded surface). Appends 1033// the ",result"/",error" tail to jb and returns the new offset. 1034// seq1293: exact-line membership test (CR-tolerant) for async_only_tools.conf -- substring matching 1035// would let "nx_fs" shadow "nx_fs_write", so lines must match the WHOLE tool name. 1036func ta_name_in_lines(buf: *u8, n: i64, nm: *u8, nl: i64) -> i64 { 1037 var i: i64 = 0 1038 while i < n { 1039 var e: i64 = i 1040 var s: i64 = 1 1041 while s == 1 { if e >= n { s = 0 } else { if buf[e] == (10 as u8) { s = 0 } else { e = e + 1 } } } 1042 var le: i64 = e 1043 if le > i { if buf[le-1] == (13 as u8) { le = le - 1 } } 1044 if le - i == nl { 1045 var j: i64 = 0 1046 var ok: i64 = 1 1047 while j < nl { if buf[i+j] != nm[j] { ok = 0; j = nl } else { j = j + 1 } } 1048 if ok == 1 { return 1 } 1049 } 1050 i = e + 1 1051 } 1052 return 0 1053} 1054// PER-VERB ASYNC ROUTING (2026-08-06). async_only_tools.conf lines may now be EITHER 1055// <tool> -- the whole tool is forced onto the job lane (existing behaviour, unchanged) 1056// <tool> <verb> -- ONLY that verb is forced; every other verb stays synchronous 1057// WHY THE VERB AND NOT THE TOOL. MEASURED 2026-08-06: `nx_debt add` costs ~0.6s CPU but 23-40s WALL 1058// (0.113 user + 0.515 sys of a 40.026s run; later probes 23s and 25s -- variable, so contention, not a 1059// fixed backoff). Every measured value outruns the edge window, so the response is dropped and the row 1060// NEVER LANDS, while the caller sees a 503 and believes the plane is down. Several findings were lost 1061// that way before it was measured. But `nx_debt find` answers in milliseconds: listing the whole tool 1062// would buy the write back by making EVERY READ a two-step poll -- paying for the fix with the common 1063// case, which is the same trade the fabricated-annotation default made. 1064// ★ THE LATENCY IS A PROPERTY OF THE VERB, SO THE ROUTING MUST BE TOO. 1065// Exact whole-line matching is preserved (a substring rule would let "nx_fs" shadow "nx_fs_write"), and 1066// an absent/empty conf is still byte-identical prior behaviour. 1067func ta_async_match(buf: *u8, n: i64, nm: *u8, nl: i64, av: *i64, ac: i64) -> i64 { 1068 if ta_name_in_lines(buf, n, nm, nl) == 1 { return 1 } 1069 if ac < 1 { return 0 } 1070 // av[0] is RESERVED for the resolved ELF path (filled later by tea_run_argv); the caller's first 1071 // argument is av[1]. Reading av[0] here silently matched nothing -- the conf line was correct, the 1072 // binary was correct, and the routing simply never fired. 1073 // ★ AN ARGV WHOSE SLOT 0 IS RESERVED IS NOT THE ARGV YOU ASSUME -- READ THE BUILDER, NOT THE NAME. 1074 let v: *u8 = av[1] as *u8 1075 if (v as i64) == 0 { return 0 } 1076 var vl: i64 = 0 1077 while v[vl] != (0 as u8) { vl = vl + 1 } 1078 if vl == 0 { return 0 } 1079 let want: i64 = nl + 1 + vl 1080 var i: i64 = 0 1081 while i < n { 1082 var e: i64 = i 1083 var s: i64 = 1 1084 while s == 1 { if e >= n { s = 0 } else { if buf[e] == (10 as u8) { s = 0 } else { e = e + 1 } } } 1085 var le: i64 = e 1086 if le > i { if buf[le-1] == (13 as u8) { le = le - 1 } } 1087 if le - i == want { 1088 var ok: i64 = 1 1089 var j: i64 = 0 1090 while j < nl { if buf[i+j] != nm[j] { ok = 0; j = nl } else { j = j + 1 } } 1091 if ok == 1 { if buf[i+nl] != (32 as u8) { ok = 0 } } 1092 if ok == 1 { 1093 var k: i64 = 0 1094 while k < vl { if buf[i+nl+1+k] != v[k] { ok = 0; k = vl } else { k = k + 1 } } 1095 } 1096 if ok == 1 { return 1 } 1097 } 1098 i = e + 1 1099 } 1100 return 0 1101} 1102// ---- DEFERRED PROMOTION BOOKKEEPING (LANE K 2026-08-23, debt 1787505278) -------------------------------- 1103// THE DEFECT: the TR_PROMOTE reply ("JOB-STARTED id=...") was BUILT only after mkdir + claim + fork + wait4 1104// + actlog, and SENT by the serve loop later still. On a saturated array that bookkeeping overshot the 1105// promote decision -- measured lane=sync-promoted dur_ms p50 16410 / p90 26612 / p99 41422 against a 1106// 14000 ms decision inside a 15000 ms edge window, so 574 permil of promoted calls replied AFTER the edge 1107// had already synthesised a 503: the "raw 503 that had actually landed" class every seat hits. 1108// THE FIX is ORDER, not budget (the Envoy rule: announce cheaply BEFORE the expensive work). The reply 1109// needs ONLY the reserved job id, so ta_mcp_call reserves the claim (the id must be real), parks what the 1110// drainer needs in these process-local statics, and RETURNS the reply at once. A caller that OWNS A 1111// SOCKET calls ta_defer_enable() before ta_handle and ta_promote_finish() after the reply bytes are on the 1112// wire; finish forks the drainer, reaps the middle child and writes the actlog row -- the SAME code that 1113// used to run inline, now ONE function (ta_promote_bookkeep) on both paths. A caller that did not opt in 1114// (a pure-bytes gate driving ta_handle) keeps the old inline ordering byte-for-byte: the deferral is a 1115// contract the serve loop signs, never an assumption about the caller. Fork-per-request makes the statics 1116// per-request by construction; the inline (backpressure) path resets ta_pp_pending in finish. 1117static ta_defer_ok: i64 1118static ta_pp_pending: i64 1119static ta_pp_nmp: i64 1120static ta_pp_nml: i64 1121static ta_pp_jid: i64 1122static ta_pp_jpath: i64 1123static ta_pp_jout: i64 1124static ta_pp_jtmp: i64 1125static ta_pp_xout: i64 1126static ta_pp_precap: i64 1127static ta_pp_wrfd: i64 1128static ta_pp_t0: i64 1129static ta_pp_tdecide: i64 1130const TA_REPLY_MS_UNOBSERVED: i64 = 0 - 1 // inline path: the reply has not been written when the row is stamped 1131 1132func ta_defer_enable() -> i64 { ta_defer_ok = 1; return 0 } 1133func ta_promote_pending() -> i64 { return ta_pp_pending } 1134 1135// the drainer + the row, verbatim from the former inline block. reply_ms < 0 = unobserved (inline path). 1136func ta_promote_bookkeep(nmp: *u8, nml: i64, jidp: i64, jpathp: *u8, joutp: *u8, jtmpp: *u8, xout: *u8, precap: i64, wrfd0: i64, t0: i64, reply_ms: i64) -> i64 { 1137 let pcont: i64 = sys_fork() 1138 if pcont == 0 { 1139 var fdc2: i64 = 3 1140 while fdc2 < 256 { if fdc2 != wrfd0 { sys_close(fdc2) } fdc2 = fdc2 + 1 } 1141 nx_setsid() 1142 let cc2: i64 = sys_fork() 1143 if cc2 != 0 { sys_exit(0) } 1144 let tt_capture_begin: i64 = ta_timing_now_us() 1145 let jbuf: *u8 = sys_mmap(TA_MAGIC_1048576) 1146 var jn: i64 = 0 1147 while jn < precap { if jn < TA_MAGIC_1048576 { jbuf[jn] = xout[jn] } jn = jn + 1 } 1148 var drun: i64 = 1 1149 while drun == 1 { 1150 if jn >= TA_MAGIC_1048576 { drun = 0 } else { 1151 let dr: i64 = sys_read(wrfd0, ((jbuf as i64) + jn) as *u8, TA_MAGIC_1048576 - jn) 1152 if dr > 0 { jn = jn + dr } else { drun = 0 } 1153 } 1154 } 1155 let tt_capture_end: i64 = ta_timing_now_us() 1156 if jn >= TA_MAGIC_1048576 { 1157 let tm: *u8 = "\n[NX-JOB CAPTURE-TRUNCATED at 1048576 bytes -- output incomplete]\n" as *u8 1158 var tl: i64 = 0; while tm[tl] != (0 as u8) { tl = tl + 1 } 1159 var cw: i64 = 0; while cw < tl { if jn - tl + cw >= 0 { jbuf[jn - tl + cw] = tm[cw] } cw = cw + 1 } 1160 } 1161 let dbuf2: *u8 = sys_mmap(256) 1162 // exit=PROMOTED-UNREAPED is HONEST: the drainer is the worker's sibling (the request 1163 // child forked both), so it can drain the pipe to EOF but cannot wait4 the worker -- 1164 // init reaps it. A promoted call trades an exit code for an answer that otherwise does 1165 // not exist at all, and the record says which it is rather than fabricating a 0. 1166 var db2: i64 = ta_cat(dbuf2, 0, "state=DONE rc=0 exit=PROMOTED-UNREAPED bytes=" as *u8) 1167 db2 = ta_catn(dbuf2, db2, jn); dbuf2[db2] = 10 as u8; db2 = db2 + 1 1168 let tt_publish_begin: i64 = ta_timing_now_us() 1169 let published: i64 = ta_job_publish(joutp, jbuf, jn, jtmpp, dbuf2, db2, jpathp) 1170 let tt_publish_end: i64 = ta_timing_now_us() 1171 ta_timing_emit(nmp, nml, "sync-promoted", "promoted_capture_return_unreaped", jidp, tt_capture_begin, tt_capture_end, 0-1, jn) 1172 ta_timing_emit(nmp, nml, "sync-promoted", "job_publish_return_unreaped", jidp, tt_publish_begin, tt_publish_end, published, jn) 1173 if published != 0 { 1174 ta_actlog(nmp, nml, "sync-promoted", "evidence-fail", published, jn, sys_now_ms() - t0) 1175 sys_exit(1) 1176 } 1177 sys_exit(0) 1178 return 0 1179 } 1180 if pcont > 0 { let pst: *i64 = sys_mmap(16) as *i64; sys_wait4(pcont, pst, 0) } 1181 sys_close(wrfd0) 1182 // ROW FIELDS (debt 1787505278): bytes= is the REAL captured byte count (it used to carry the job id, 1183 // mislabelled); the id is job=; reply_ms= is decision -> reply-written, the number reply_reserve_ms 1184 // can be ratcheted from. reply_ms=-1 means the row was stamped on the inline path before any reply. 1185 let xb: *u8 = sys_mmap(96) 1186 var xo: i64 = ta_cat(xb, 0, " job=" as *u8) 1187 xo = ta_catn(xb, xo, jidp) 1188 xo = ta_cat(xb, xo, " reply_ms=" as *u8) 1189 xo = ta_catn(xb, xo, reply_ms) 1190 xb[xo] = 0 as u8 1191 ta_actlog_x(nmp, nml, "sync-promoted" as *u8, "started" as *u8, 0, precap, sys_now_ms() - t0, xb) 1192 return 0 1193} 1194 1195// the serve loop's half of the contract: call AFTER the reply bytes are on the wire. Idempotent no-op 1196// when nothing was deferred, so it is safe on every response path (413, fast, RED, promoted). 1197// SEV-9 2026-09-05 (debt frontdoor/unsafe-call-outcome-unknown-receipt-dropped): THE ASYNC JOB LANE GETS THE SAME 1198// CONTRACT THE PROMOTE LANE ABOVE ALREADY HAS. It reserved the job id, wrote the claim, forked the runner -- and then 1199// sys_wait4()ed the middle child and appended the actlog row BEFORE building its JOB-STARTED reply, so on a storming 1200// array that bookkeeping outlived the 15 s edge window, the edge synthesised 503 'Outcome Unknown', and the reserved 1201// id (the only handle to the outcome) was never delivered while the job ran anyway. Measured 2026-09-05: 7 dropped 1202// receipts, 6 landed, one self-anchored insert issued twice ended at one copy by luck. Same fix, same order: reply 1203// FIRST (the id is real the moment the claim is on disk), park pid1/name/id here, drain in ta_async_finish() which the 1204// serve loop calls right after ta_promote_finish(). A caller that did not opt in (a pure-bytes gate) keeps the inline 1205// wait4+actlog byte-for-byte -- the deferral is the serve loop's contract, never an assumption about the caller. 1206static ta_ap_pending: i64 1207static ta_ap_pid: i64 1208static ta_ap_nmp: i64 1209static ta_ap_nml: i64 1210static ta_ap_jid: i64 1211static ta_ap_t0: i64 1212func ta_async_pending() -> i64 { return ta_ap_pending } 1213func ta_async_finish() -> i64 { 1214 if ta_ap_pending != 1 { return 0 } 1215 ta_ap_pending = 0 1216 if ta_ap_pid > 0 { 1217 let jst: *i64 = sys_mmap(16) as *i64 1218 sys_wait4(ta_ap_pid, jst, 0) 1219 } 1220 ta_actlog(ta_ap_nmp as *u8, ta_ap_nml, "async" as *u8, "started" as *u8, 0, ta_ap_jid, sys_now_ms() - ta_ap_t0) 1221 return 1 1222} 1223 1224func ta_promote_finish() -> i64 { 1225 // the async twin drains in ta_async_finish(), called by the serve loop right after this one 1226 if ta_pp_pending != 1 { return 0 } 1227 ta_pp_pending = 0 1228 let reply_ms: i64 = sys_now_ms() - ta_pp_tdecide 1229 ta_promote_bookkeep(ta_pp_nmp as *u8, ta_pp_nml, ta_pp_jid, ta_pp_jpath as *u8, ta_pp_jout as *u8, ta_pp_jtmp as *u8, ta_pp_xout as *u8, ta_pp_precap, ta_pp_wrfd, ta_pp_t0, reply_ms) 1230 return 1 1231} 1232 1233// Process-local observations share actlog.jrnl. Unknown is -1, never a fabricated zero. 1234// These clocks observe server operations, not physical client arrival or first result byte. 1235const TT_UNKNOWN: i64 = 0-1 1236const TT_I64_MAX: i64 = 9223372036854775807 1237const TT_US_PER_SEC: i64 = 1000000 1238const TT_NS_PER_US: i64 = 1000 1239const TT_NS_PER_SEC: i64 = 1000000000 1240const TT_I64_WIDTH: i64 = 20 1241static tt_clock: *i64 1242static tt_tool: *u8 1243static tt_tool_n: i64 1244static tt_read_begin: i64 1245static tt_read_end: i64 1246static tt_handle_begin: i64 1247static tt_handle_end: i64 1248static tt_write_begin: i64 1249static tt_write_end: i64 1250static tt_write_rc: i64 1251static tt_job: i64 1252static tt_reply_kind: *u8 1253static tt_request_pid: i64 1254static tt_context_active: i64 1255static tt_runner_present: i64 1256static tt_runner_begin: i64 1257static tt_runner_end: i64 1258static tt_runner_code: i64 1259static tt_runner_bytes: i64 1260 1261func ta_timing_now_us() -> i64 { 1262 if (tt_clock as i64) <= 0 { tt_clock = sys_mmap(16) as *i64 } 1263 if (tt_clock as i64) <= 0 { return TT_UNKNOWN } 1264 if sys_clock_gettime_mono(tt_clock) != 0 { return TT_UNKNOWN } 1265 let sec: i64 = tt_clock[0] 1266 let nano: i64 = tt_clock[1] 1267 if sec < 0 { return TT_UNKNOWN } 1268 if nano < 0 { return TT_UNKNOWN } 1269 if nano >= TT_NS_PER_SEC { return TT_UNKNOWN } 1270 if sec > (TT_I64_MAX-nano/TT_NS_PER_US)/TT_US_PER_SEC { return TT_UNKNOWN } 1271 return sec*TT_US_PER_SEC+nano/TT_NS_PER_US 1272} 1273func ta_timing_elapsed(begin: i64, end: i64) -> i64 { 1274 if begin < 0 { return TT_UNKNOWN } 1275 if end < begin { return TT_UNKNOWN } 1276 return end-begin 1277} 1278func ta_timing_field_ok(s: *u8, n: i64) -> i64 { 1279 if n < 0 { return 0 } 1280 if (s as i64) <= 0 { return 0 } 1281 var i: i64 = 0 1282 while i < n { if s[i] < (32 as u8) { return 0 } i = i+1 } 1283 return 1 1284} 1285// `path` is the existing journal in production and an isolated caller path in the gate. 1286// No dur_ms token: legacy latency consumers must not count phase rows as extra tool calls. 1287func ta_timing_emit_to(path: *u8, tool: *u8, tlen: i64, lane: *u8, phase: *u8, job: i64, begin: i64, end: i64, code: i64, bytes: i64) -> i64 { 1288 if ta_timing_field_ok(tool, tlen) == 0 { return 0-1 } 1289 if ta_timing_field_ok(lane, ta_slen(lane)) == 0 { return 0-1 } 1290 if ta_timing_field_ok(phase, ta_slen(phase)) == 0 { return 0-1 } 1291 let a: *u8 = "\tmcp\t" as *u8 1292 let b: *u8 = "\tobserve\t" as *u8 1293 let c: *u8 = "\ttools/timing timing_v=1 lane=" as *u8 1294 let d: *u8 = " job=" as *u8 1295 let context: *u8 = " request_pid=" as *u8 1296 let origin: *u8 = " request_begin_us=" as *u8 1297 let e: *u8 = " clock=monotonic_us clock_scope=same_process_tree begin_us=" as *u8 1298 let f: *u8 = " end_us=" as *u8 1299 let g: *u8 = " elapsed_us=" as *u8 1300 let h: *u8 = " code=" as *u8 1301 let k: *u8 = " bytes=" as *u8 1302 let tail: *u8 = " client_first_byte=unobserved result_first_byte=unobserved\n" as *u8 1303 var cap: i64 = ta_log_size_add(9*TT_I64_WIDTH+1, tlen) 1304 cap = ta_log_size_add(cap, ta_slen(lane)) 1305 cap = ta_log_size_add(cap, ta_slen(phase)) 1306 cap = ta_log_size_add(cap, ta_slen(a)) 1307 cap = ta_log_size_add(cap, ta_slen(b)) 1308 cap = ta_log_size_add(cap, ta_slen(c)) 1309 cap = ta_log_size_add(cap, ta_slen(d)) 1310 cap = ta_log_size_add(cap, ta_slen(context)) 1311 cap = ta_log_size_add(cap, ta_slen(origin)) 1312 cap = ta_log_size_add(cap, ta_slen(e)) 1313 cap = ta_log_size_add(cap, ta_slen(f)) 1314 cap = ta_log_size_add(cap, ta_slen(g)) 1315 cap = ta_log_size_add(cap, ta_slen(h)) 1316 cap = ta_log_size_add(cap, ta_slen(k)) 1317 cap = ta_log_size_add(cap, ta_slen(tail)) 1318 if cap < 0 { return 0-1 } 1319 let row: *u8 = sys_mmap(cap) 1320 if (row as i64) <= 0 { return 0-1 } 1321 var n: i64 = ta_catn(row, 0, sys_now_realtime_sec()) 1322 n = ta_cat(row, n, a); n = ta_catb(row, n, tool, tlen) 1323 n = ta_cat(row, n, b); n = ta_cat(row, n, phase) 1324 n = ta_cat(row, n, c); n = ta_cat(row, n, lane) 1325 n = ta_cat(row, n, d); n = ta_catn(row, n, job) 1326 var request_pid: i64 = TT_UNKNOWN 1327 var request_begin: i64 = TT_UNKNOWN 1328 if tt_context_active == 1 { request_begin = tt_read_begin } 1329 if tt_request_pid > 0 { request_pid = tt_request_pid } 1330 n = ta_cat(row, n, context); n = ta_catn(row, n, request_pid) 1331 n = ta_cat(row, n, origin); n = ta_catn(row, n, request_begin) 1332 n = ta_cat(row, n, e); n = ta_catn(row, n, begin) 1333 n = ta_cat(row, n, f); n = ta_catn(row, n, end) 1334 n = ta_cat(row, n, g); n = ta_catn(row, n, ta_timing_elapsed(begin, end)) 1335 n = ta_cat(row, n, h); n = ta_catn(row, n, code) 1336 n = ta_cat(row, n, k); n = ta_catn(row, n, bytes) 1337 n = ta_cat(row, n, tail) 1338 let result: i64 = ta_journal_append(path, row, n) 1339 sys_munmap(row, cap) 1340 return result 1341} 1342func ta_timing_emit(tool: *u8, tlen: i64, lane: *u8, phase: *u8, job: i64, begin: i64, end: i64, code: i64, bytes: i64) -> i64 { 1343 return ta_timing_emit_to(0 as *u8, tool, tlen, lane, phase, job, begin, end, code, bytes) 1344} 1345func ta_timing_begin() -> i64 { 1346 tt_tool = 0 as *u8; tt_tool_n = 0; tt_job = TT_UNKNOWN 1347 tt_request_pid = TT_UNKNOWN; tt_context_active = 1; tt_runner_present = 0 1348 tt_read_begin = ta_timing_now_us(); tt_read_end = TT_UNKNOWN 1349 tt_handle_begin = TT_UNKNOWN; tt_handle_end = TT_UNKNOWN 1350 tt_write_begin = TT_UNKNOWN; tt_write_end = TT_UNKNOWN; tt_write_rc = TT_UNKNOWN 1351 tt_reply_kind = "response_write_return" as *u8 1352 return 0 1353} 1354func ta_timing_bind(tool: *u8, n: i64) -> i64 { tt_tool = tool; tt_tool_n = n; return 0 } 1355func ta_timing_read_done() -> i64 { tt_read_end = ta_timing_now_us(); return 0 } 1356func ta_timing_handle_begin() -> i64 { tt_handle_begin = ta_timing_now_us(); return 0 } 1357func ta_timing_handle_done() -> i64 { tt_handle_end = ta_timing_now_us(); return 0 } 1358func ta_timing_write_begin() -> i64 { tt_write_begin = ta_timing_now_us(); return 0 } 1359func ta_timing_runner(begin: i64, end: i64, code: i64, bytes: i64) -> i64 { 1360 tt_runner_begin = begin; tt_runner_end = end; tt_runner_code = code; tt_runner_bytes = bytes 1361 tt_runner_present = 1; return 0 1362} 1363func ta_timing_reply_prepare(code: i64) -> i64 { 1364 tt_write_end = ta_timing_now_us(); tt_write_rc = code 1365 if ta_pp_pending == 1 { tt_job = ta_pp_jid; tt_reply_kind = "promoted_ack_write_return" as *u8 } 1366 if ta_ap_pending == 1 { tt_job = ta_ap_jid; tt_reply_kind = "async_ack_write_return" as *u8 } 1367 return 0 1368} 1369func ta_timing_reply_log(bytes: i64) -> i64 { 1370 // Run after existing deferred finish functions; tracing cannot delay drainer creation. 1371 if (tt_tool as i64) <= 0 { return 0 } 1372 if tt_tool_n <= 0 { return 0 } 1373 if tt_runner_present == 1 { 1374 var phase: *u8 = "sync_runner_return" as *u8 1375 if tt_runner_code == TR_PROMOTE { phase = "sync_runner_promoted" as *u8 } 1376 ta_timing_emit(tt_tool, tt_tool_n, "sync", phase, tt_job, tt_runner_begin, tt_runner_end, tt_runner_code, tt_runner_bytes) 1377 } 1378 ta_timing_emit(tt_tool, tt_tool_n, "server", "request_read_return", tt_job, tt_read_begin, tt_read_end, 0, TT_UNKNOWN) 1379 ta_timing_emit(tt_tool, tt_tool_n, "server", "handler_response_return", tt_job, tt_handle_begin, tt_handle_end, 0, TT_UNKNOWN) 1380 var accepted: i64 = TT_UNKNOWN 1381 if tt_write_rc == 0 { accepted = bytes } 1382 return ta_timing_emit(tt_tool, tt_tool_n, "server", tt_reply_kind, tt_job, tt_write_begin, tt_write_end, tt_write_rc, accepted) 1383} 1384 1385// DI4 CONTRACT SYMBOL (/compare/dataio, 2026-09-05): the Idempotency-Key presenter for tools/call. params._idem names 1386// the request; ta_mcp_call classifies it through nx_toolcall_idem_lib BEFORE any execution and records or releases 1387// the outcome at every exit. Returns 1 with out2 = {offset, len} into body when a key is present, else 0. 1388func ta_idempotency_key(body: *u8, bn: i64, out2: *i64) -> i64 { return ta_json_str(body, bn, "\"_idem\"" as *u8, out2) } 1389 1390func ta_mcp_call(prefix: *u8, req: *u8, req_n: i64, body: *u8, bn: i64, jb: *u8, bin: i64) -> i64 { 1391 var b: i64 = bin 1392 let nm2: *i64 = sys_mmap(16) as *i64 1393 if ta_json_str(body, bn, "\"name\"" as *u8, nm2) != 1 { 1394 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"missing params.name\"}}" as *u8) 1395 } 1396 let nmp: *u8 = ((body as i64) + nm2[0]) as *u8 1397 let nml: i64 = nm2[1] 1398 // load the cap-signing secret: prefer the vault-provisioned keyfile (production); else the dev/gate constant. 1399 let slb: *i64 = sys_mmap(16) as *i64 1400 let secret: *u8 = ta_load_cap_secret(slb) 1401 let secretlen: i64 = slb[0] 1402 let cap2: *i64 = sys_mmap(16) as *i64 1403 var granted: i64 = 0 - 9 // sentinel: no capability presented 1404 var capp: *u8 = 0 as *u8 1405 var capl: i64 = 0 1406 // ---- PRESENTER SELECTION: ANY-GRANTS (root fix 2026-07-30) ---------------------------------------------- 1407 // WAS a FIRST-PRESENT-WINS chain: if the X-Nishi-Cap header was present AT ALL, params._cap was never read -- 1408 // it sat inside the else. That contradicted the contract this file states in TWO places (ta_query_cap: "an 1409 // explicit per-call _cap always wins"; the deny text below: "params._cap ... per-call override, wins over all 1410 // others") and it made a session whose header carries a least-authority READ cap STRUCTURALLY unable to 1411 // escalate for even one call: the deliberate override was silently ignored and the caller got a -32001 1412 // indistinguishable from -- no such tool -- which is the exact trigger for the measured 44pct ssh/PowerShell 1413 // fallback that the ?cap= presenter was built to kill. Same session-starts-denied lockout, different door. 1414 // NOW: collect every presenter, try them in documented precedence order, and let the FIRST ONE THAT ACTUALLY 1415 // GRANTS THIS TOOL authorize the call. This CANNOT widen authority -- each candidate is still HMAC-verified, 1416 // expiry-checked, revocation-checked and least-authority-checked against THIS tool name -- so choosing WHICH 1417 // proven token authorizes can never grant what no presented token carries. It deletes exactly one state: a 1418 // caller holding a valid, granting capability refused because a weaker one happened to arrive first. 1419 // Slots in precedence order: 0 body params._cap (per-call override) | 1 X-Nishi-Cap | 2 Bearer | 3 ?cap= 1420 let ps: *i64 = sys_mmap(64) as *i64 1421 var pz: i64 = 0 1422 while pz < 8 { ps[pz] = 0; pz = pz + 1 } 1423 let pcb: *i64 = sys_mmap(16) as *i64 1424 if ta_json_str(body, bn, "\"_cap\"" as *u8, pcb) == 1 { ps[0] = (body as i64) + pcb[0]; ps[1] = pcb[1] } 1425 if ta_header(req, req_n, "X-Nishi-Cap:" as *u8, cap2) == 1 { ps[2] = (req as i64) + cap2[0]; ps[3] = cap2[1] } 1426 // OAuth 2.1 interop (R2): a STOCK MCP client presents the cap as `Authorization: Bearer <cap>` (RFC6750 1427 // header method) -- an ALTERNATE PRESENTER for the SAME object-capability, no ambient scope, still 1428 // HMAC-verified below, no confused-deputy. Scheme match is case-insensitive per RFC7235. 1429 if ta_header(req, req_n, "Authorization:" as *u8, cap2) == 1 { 1430 let bav: *u8 = ((req as i64) + cap2[0]) as *u8 1431 let bavl: i64 = cap2[1] 1432 if bavl > 7 { 1433 let pbl: *u8 = "bearer " as *u8 1434 var bj: i64 = 0 1435 var bok: i64 = 1 1436 while bj < 7 { 1437 var bc: i64 = bav[bj] as i64 1438 if bc >= 65 { if bc <= 90 { bc = bc + 32 } } 1439 if bc != (pbl[bj] as i64) { bok = 0 } 1440 bj = bj + 1 1441 } 1442 if bok == 1 { ps[4] = (bav as i64) + 7; ps[5] = bavl - 7 } 1443 } 1444 } 1445 // ?cap=<token> on the request line: the session BASELINE, and the one presenter every HTTP client provably 1446 // sends. Lowest precedence by construction -- see ta_query_cap for why this presenter exists. 1447 if ta_query_cap(req, req_n, cap2) == 1 { ps[6] = (req as i64) + cap2[0]; ps[7] = cap2[1] } 1448 var pk: i64 = 0 1449 while pk < 4 { 1450 let pcp: i64 = ps[pk + pk] 1451 let pcl: i64 = ps[pk + pk + 1] 1452 if pcl > 0 { 1453 // remember that SOMETHING was presented: drives data.presented and WHICH deny text the caller gets 1454 // (no-capability and wrong-capability have OPPOSITE remedies). 1455 if capl <= 0 { capp = pcp as *u8; capl = pcl } 1456 var pg: i64 = capt_verify(secret, secretlen, pcp as *u8, pcl, nmp, nml, sys_now_realtime_sec()) 1457 // revocation: even a valid, unexpired, tool-granting cap is refused if its nonce is on the denylist 1458 // (kill leaked caps). Checked PER PRESENTER so a revoked one cannot mask a live one behind it. 1459 if pg == CAPT_OK { if ta_nonce_revoked(capt_nonce_of(pcp as *u8, pcl)) == 1 { pg = CAPT_DENY_REVOKED } } 1460 if pg == CAPT_OK { capp = pcp as *u8; capl = pcl; granted = CAPT_OK; pk = 4 } 1461 else { if granted == (0 - 9) { granted = pg } } 1462 } 1463 pk = pk + 1 1464 } 1465 if granted == CAPT_OK { 1466 // Handler clock starts the instant authority is granted -- everything after this point is 1467 // time the CALLER is waiting, which is what the edge's window measures. 1468 let ta_t0: i64 = sys_now_ms() 1469 ta_timing_bind(nmp, nml) 1470 // ---- DI4 IDEMPOTENCY KEY (2026-09-05, /compare/dataio ta_idempotency_key): params._idem names the request; 1471 // the first applied outcome is recorded and a retry under the same name is REPLAYED, never re-executed. 1472 // Decided AFTER authority (a replay still needs a granting cap) and BEFORE any execution or dispatch. Every 1473 // outcome point below records (NEW -> applied) or releases (nothing applied); absent key = unchanged path. 1474 let idb: *i64 = sys_mmap(16) as *i64 1475 var idp: *u8 = 0 as *u8 1476 var idl: i64 = 0 1477 if ta_idempotency_key(body, bn, idb) == 1 { idp = ((body as i64) + idb[0]) as *u8; idl = idb[1] } 1478 let idhex: *u8 = sys_mmap(TI_HEX_CH + 8) 1479 let idrow: *u8 = sys_mmap(TI_ROW_CAP) 1480 idhex[0] = 0 as u8 1481 idrow[0] = 0 as u8 1482 let idst: i64 = ti_classify(TI_LEDGER, TI_DIR, idp, idl, idhex, idrow, TI_ROW_CAP, sys_now_realtime_sec()) 1483 if idst == TI_BADKEY { 1484 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"NX-IDEM REFUSED bad-key: params._idem must be 1..200 printable ASCII characters (33..126, no whitespace) -- a key is a token, not a payload. Nothing was executed.\"}],\"isError\":true,\"_meta\":{\"idem\":\"BADKEY\"}}}" as *u8) 1485 return b 1486 } 1487 if idst == TI_INFLIGHT { 1488 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"NX-IDEM IN-FLIGHT key=" as *u8) 1489 b = ta_json_esc(jb, b, idp, idl) 1490 b = ta_cat(jb, b, " -- another call holding this key has reserved it and not yet recorded an outcome (claim age " as *u8) 1491 b = ta_catn(jb, b, ti_claim_age(TI_DIR, idhex, sys_now_realtime_sec())) 1492 b = ta_cat(jb, b, " s). NOT re-executed. Retry with the same key once it records; if the age keeps growing the holder died between reserve and record: adjudicate the artifact and use a new key.\"}],\"isError\":false,\"_meta\":{\"idem\":\"INFLIGHT\"}}}" as *u8) 1493 return b 1494 } 1495 if idst == TI_REPLAY { 1496 let rjid: i64 = ti_row_int(idrow, "job=" as *u8) 1497 if rjid >= 0 { 1498 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"NX-IDEM REPLAY key=" as *u8) 1499 b = ta_json_esc(jb, b, idp, idl) 1500 b = ta_cat(jb, b, " first_outcome=" as *u8) 1501 b = ta_json_esc(jb, b, idrow, ta_slen(idrow)) 1502 b = ta_cat(jb, b, " -- this key was already applied and its job is real: NOT re-executed. Read _jobs/job_<id>.claim then .out for that id exactly as for a JOB-STARTED reply.\"}],\"isError\":false,\"_meta\":{\"job\":" as *u8) 1503 b = ta_catn(jb, b, rjid) 1504 b = ta_cat(jb, b, ",\"state\":\"REPLAY\",\"idem\":\"REPLAY\"}}}" as *u8) 1505 return b 1506 } 1507 let rop: *u8 = sys_mmap(TI_PATH_CAP) 1508 ti_out_path(TI_DIR, idhex, rop) 1509 let rlb: *i64 = sys_mmap(16) as *i64 1510 let rbuf: *u8 = sys_read_file(rop, rlb) 1511 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"" as *u8) 1512 if (rbuf as i64) != 0 { b = ta_json_esc(jb, b, rbuf, rlb[0]) } 1513 b = ta_cat(jb, b, " [NX-IDEM REPLAY key=" as *u8) 1514 b = ta_json_esc(jb, b, idp, idl) 1515 b = ta_cat(jb, b, " first_outcome=" as *u8) 1516 b = ta_json_esc(jb, b, idrow, ta_slen(idrow)) 1517 if (rbuf as i64) == 0 { b = ta_cat(jb, b, " REPLAY-ARTIFACT-GONE: the recorded output file is no longer on disk, the outcome above is the whole record" as *u8) } 1518 b = ta_cat(jb, b, " -- NOT re-executed]\"}],\"isError\":false,\"_meta\":{\"exit_code\":" as *u8) 1519 b = ta_catn(jb, b, ti_row_int(idrow, "exit=" as *u8)) 1520 b = ta_cat(jb, b, ",\"idem\":\"REPLAY\"}}}" as *u8) 1521 return b 1522 } 1523 // ---- R2 EXECUTE: the capability said WHO may call; the execution allowlist (nx_tool_exec_allow) says 1524 // WHICH vetted, gate-GREEN ELF actually runs (defense in depth, fail-closed). Only a GREEN-allowlisted 1525 // tool is forked+captured; anything else is authorized-but-not-runnable. never-brick: name-only, no path, 1526 // no /bin/sh -- a bad/absent row can only refuse. Capture is bounded (64KB) so the escaped result always 1527 // fits the 1MB jb buffer. Args come from params.arguments.argv (parsed just below into a native argv). 1528 let xcap: i64 = TA_CAPTURE_CAP 1529 let xout: *u8 = sys_mmap(xcap) 1530 let xlen: *i64 = sys_mmap(16) as *i64 1531 let xrc: *i64 = sys_mmap(16) as *i64 1532 // R2 ARGS: parse optional params.arguments.argv (JSON string array) into a native argv vector so 1533 // multi-arg organs are callable over MCP. av[0] is reserved for the resolved ELF path (filled by 1534 // tea_run_argv); parsed args land at av[1..]. Absent/empty argv -> av = [path, 0] = argless, i.e. 1535 // byte-for-byte the prior behavior, so already-working no-arg tools are unaffected (back-compat). 1536 let av: *i64 = sys_mmap(TA_MAGIC_8192) as *i64 1537 // ARGV SCRATCH SIZED FROM THE BODY (2026-08-23): the unescaped argv can never exceed the body that 1538 // carried it, so bn + 1 is the exact bound. The former 64 KiB scratch let ta_json_str_array keep "what 1539 // fit": a file content above 65535 bytes arrived as its prefix and nx_fs_write wrote the truncated file 1540 // with an OK receipt -- silent data loss wearing a constant, behind the serve loop's 64 KiB read window. 1541 let sbcap: i64 = bn + 1 1542 let sb: *u8 = sys_mmap(sbcap) 1543 if (av as i64) <= 0 { 1544 if idst == TI_NEW { ti_release(TI_DIR, idhex) } 1545 return ta_cat(jb, b, ",\"error\":{\"code\":-32603,\"message\":\"argv allocation failed; nothing executed\"}}" as *u8) 1546 } 1547 if (sb as i64) <= 0 { 1548 if idst == TI_NEW { ti_release(TI_DIR, idhex) } 1549 return ta_cat(jb, b, ",\"error\":{\"code\":-32603,\"message\":\"argv allocation failed; nothing executed\"}}" as *u8) 1550 } 1551 let ac: i64 = ta_json_str_array(body, bn, "\"argv\"" as *u8, av, 1, 250, sb, sbcap) 1552 if ac < 0 { 1553 if idst == TI_NEW { ti_release(TI_DIR, idhex) } 1554 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"argv must be a complete string array with valid Unicode, no NUL and within argument/output capacity; nothing executed\"}}" as *u8) 1555 } 1556 av[1 + ac] = 0 1557 // ---- HTTP-BACKEND dispatch (data-driven, fail-closed, SSRF-safe): a tool declared in tool_backends.conf 1558 // is an already-running sovereign HTTP service reached IN-PROCESS over loopback -- no shim binary. Tried 1559 // BEFORE fork-exec; THB_NOROUTE (not a backend) falls straight through to the fork-exec path below, 1560 // byte-for-byte unchanged for organ tools (never-brick preserving). 1561 let hbcap: i64 = TA_MAGIC_1048576 1562 let hbout: *u8 = sys_mmap(hbcap) 1563 let hblen: *i64 = sys_mmap(16) as *i64 1564 let hbrc: i64 = thb_dispatch(nmp, nml, av, ac, hbout, hbcap, hblen) 1565 if hbrc == THB_OK { 1566 ta_actlog(nmp, nml, "http" as *u8, "ok" as *u8, 0, hblen[0], sys_now_ms() - ta_t0) 1567 // DI4: a keyed HTTP-backend call records its bytes and outcome so a retry under the same key replays them 1568 if idst == TI_NEW { let hop: *u8 = sys_mmap(TI_PATH_CAP); ti_out_path(TI_DIR, idhex, hop); ta_job_put(hop, hbout, hblen[0]); let hrow: *u8 = sys_mmap(TI_ROW_CAP); let hrl: i64 = ti_row_sync(hrow, TI_ROW_CAP, "http" as *u8, nmp, nml, 0, hblen[0], TI_DIR, idhex); ti_record(TI_LEDGER, idp, idl, hrow, hrl) } 1569 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"" as *u8) 1570 b = ta_json_esc(jb, b, hbout, hblen[0]) 1571 b = ta_cat(jb, b, "\"}],\"isError\":false,\"_meta\":{\"backend\":\"http\",\"bytes\":" as *u8) 1572 b = ta_catn(jb, b, hblen[0]) 1573 b = ta_cat(jb, b, "}}}" as *u8) 1574 return b 1575 } 1576 if hbrc == THB_ERR { 1577 if idst == TI_NEW { ti_release(TI_DIR, idhex) } // DI4: nothing was applied, so the key must be judged afresh 1578 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"tool '" as *u8) 1579 b = ta_json_esc(jb, b, nmp, nml) 1580 b = ta_cat(jb, b, "' HTTP backend is declared but unreachable\"}],\"isError\":true}}" as *u8) 1581 return b 1582 } 1583 // ---- ASYNC JOB LANE (rung 24; eats seq1273, defuses the seq1261 1584 // trigger): a long organ run cannot live inside the synchronous 1585 // response window -- the edge read-timeout drops the response and the 1586 // daemon then dies writing to the dead socket (the crash-loop class). 1587 // "_async":"1" anywhere in the body forks the SAME cap+allowlist-gated 1588 // pinned dispatch DETACHED (double-fork, no zombies): stdout lands in 1589 // _jobs/job_<id>.out, then _jobs/job_<id>.done lands ATOMICALLY 1590 // (tmp+rename, written LAST = the completion marker). The call returns 1591 // the job id IMMEDIATELY; poll with the already-registered nx_fs 1592 // (read _jobs/job_<id>.done then .out) -- no new poll surface. 1593 let asyb: *i64 = sys_mmap(16) as *i64 1594 var isasync: i64 = 0 1595 if ta_json_str(body, bn, "\"_async\"" as *u8, asyb) == 1 { if body[asyb[0]] == (49 as u8) { isasync = 1 } } 1596 // ---- ASYNC-ONLY ENFORCEMENT (seq1293, incident 2026-07-29): the DAEMON owns the envelope, 1597 // so the daemon decides -- a tool listed in async_only_tools.conf (one exact name per line, 1598 // hot-read per call like the cap) is FORCED onto the job lane even when the caller forgot 1599 // _async. The 2026-07-29 outage trigger was exactly a heavy sweep running sync, outrunning 1600 // the edge window, and being retried. Absent/empty conf = byte-identical prior behavior. 1601 if isasync == 0 { 1602 let aosz: *i64 = sys_mmap(16) as *i64 1603 let aob: *u8 = sys_read_file("async_only_tools.conf" as *u8, aosz) 1604 if (aob as i64) != 0 { if aosz[0] > 0 { 1605 if ta_async_match(aob, aosz[0], nmp, nml, av, ac) == 1 { isasync = 1 } 1606 } } 1607 } 1608 // Reserve before execution, including the sync lane that may later promote. 1609 // Budget is the existing edge reply reserve; collisions never imply ownership. 1610 let claim_begin:i64=sys_now_ms() 1611 let claim_budget:i64=tea_reply_reserve_ms() 1612 let claim_info:*i64=sys_mmap(32) as *i64 1613 claim_info[0]=0;claim_info[1]=0;claim_info[2]=0;claim_info[3]=0 1614 let jpath:*u8=sys_mmap(256);let jout2:*u8=sys_mmap(256);let jtmp:*u8=sys_mmap(256) 1615 let claim_line:*u8=sys_mmap(JR_LINE) 1616 var jid:i64=JR_ERR_INVALID 1617 let mkdir_rc:i64=sys_mkdir("_jobs",MODE_0755) 1618 if mkdir_rc==0 || mkdir_rc==JR_ERR_EXIST { 1619 if claim_budget>0 && claim_begin<=JR_ID_MAX-claim_budget { 1620 jid=jr_reserve(JR_JOBS,sys_now_realtime_sec(),claim_begin+claim_budget,jpath,256,claim_line,JR_LINE,claim_info) 1621 } 1622 }else{jid=mkdir_rc} 1623 let claim_elapsed:i64=sys_now_ms()-claim_begin 1624 if jid<=0 { 1625 if idst==TI_NEW{ti_release(TI_DIR,idhex)} 1626 b=ta_cat(jb,b,",\"error\":{\"code\":-32003,\"message\":\"Job reservation failed before execution; inspect filesystem errno or configured reply budget\",\"data\":{\"executed\":false,\"reservation_errno\":") 1627 b=ta_catn(jb,b,jid) 1628 b=ta_cat(jb,b,",\"reserved_unstarted_id\":");b=ta_catn(jb,b,claim_info[0]) 1629 b=ta_cat(jb,b,",\"reservation_elapsed_ms\":");b=ta_catn(jb,b,claim_elapsed) 1630 return ta_cat(jb,b,"}}}") 1631 } 1632 jr_mkpath(jout2,256,JR_JOBS,jid,JR_EXT_OUT) 1633 jr_mkpath(jtmp,256,JR_JOBS,jid,".tmp") 1634 if isasync == 1 { 1635 // DI4: the job id IS the outcome of a keyed async call -- recorded the instant it is reserved, BEFORE the fork 1636 // and before the reply, so a lost reply is replayed with the same id instead of a second execution. 1637 if idst == TI_NEW { let arow: *u8 = sys_mmap(TI_ROW_CAP); let arl: i64 = ti_row_job(arow, TI_ROW_CAP, "async" as *u8, nmp, nml, jid); ti_record(TI_LEDGER, idp, idl, arow, arl) } 1638 let pid1: i64 = sys_fork() 1639 if pid1 == 0 { 1640 // middle child: shed every inherited fd above stderr (listen + 1641 // conn sockets included) so a detached job can never pin the 1642 // daemon's ports; then detach the worker and exit at once. 1643 var fdc: i64 = 3 1644 while fdc < 256 { sys_close(fdc); fdc = fdc + 1 } 1645 // ★LEAVE THE DAEMON'S SESSION AND PROCESS GROUP (seq1611). 1646 // Closing fds and double-forking reparents the worker to init but 1647 // leaves it in the DAEMON'S process group, so any group-directed 1648 // signal -- a supervisor cycling the daemon, a request-child sweep 1649 // -- kills it mid-run. MEASURED: short jobs recorded exit=0 and 1650 // finished, while the multi-minute regen died after its first two 1651 // output lines EVERY time, with an EMPTY exit slot (= terminated by 1652 // a signal, not an exit). A detached job must own its own session, 1653 // exactly as hc_spawn_tapi already does for the daemon itself. 1654 nx_setsid() 1655 let pid2: i64 = sys_fork() 1656 if pid2 != 0 { sys_exit(0) } 1657 // seq1301: job output lands on DISK (no json-escape bound applies) -> full 1MiB capture, 1658 // and a clipped capture is MARKED inside the .out itself so a poller can never mistake 1659 // a truncated result for a complete one. 1660 let jbuf: *u8 = sys_mmap(TA_MAGIC_1048576) 1661 let jlen: *i64 = sys_mmap(16) as *i64 1662 let jrc: *i64 = sys_mmap(16) as *i64 1663 // tmo=0: NO TIMEOUT. A detached job exists precisely to outlive 1664 // the synchronous window; inheriting the 120s request timeout 1665 // killed every multi-minute regen at the 2-minute mark (seq1634). 1666 let tt_exec_begin: i64 = ta_timing_now_us() 1667 let jec: i64 = tea_run_pinned_to(nmp, nml, av, jbuf, TA_MAGIC_1048576, jlen, jrc, 0) 1668 let tt_exec_end: i64 = ta_timing_now_us() 1669 if jlen[0] >= TA_MAGIC_1048576 { 1670 let tm: *u8 = "\n[NX-JOB CAPTURE-TRUNCATED at 1048576 bytes -- output incomplete]\n" as *u8 1671 var tl: i64 = 0 1672 while tm[tl] != (0 as u8) { tl = tl + 1 } 1673 var cw: i64 = 0 1674 while cw < tl { if jlen[0] - tl + cw >= 0 { jbuf[jlen[0] - tl + cw] = tm[cw] } cw = cw + 1 } 1675 } 1676 let dbuf: *u8 = sys_mmap(256) 1677 var db: i64 = ta_cat(dbuf, 0, "state=DONE rc=" as *u8) 1678 db = ta_catn(dbuf, db, jrc[0]) 1679 db = ta_cat(dbuf, db, " exit=" as *u8) 1680 db = ta_catn(dbuf, db, jec) 1681 db = ta_cat(dbuf, db, " bytes=" as *u8) 1682 db = ta_catn(dbuf, db, jlen[0]) 1683 db = ta_cat(dbuf, db, "\n" as *u8) 1684 let tt_publish_begin: i64 = ta_timing_now_us() 1685 let published: i64 = ta_job_publish(jout2, jbuf, jlen[0], jtmp, dbuf, db, jpath) 1686 let tt_publish_end: i64 = ta_timing_now_us() 1687 ta_timing_emit(nmp, nml, "async", "async_runner_return", jid, tt_exec_begin, tt_exec_end, jec, jlen[0]) 1688 ta_timing_emit(nmp, nml, "async", "job_publish_return", jid, tt_publish_begin, tt_publish_end, published, jlen[0]) 1689 if published != 0 { 1690 sys_exit(1) 1691 return 0 1692 } 1693 sys_exit(0) 1694 return 0 1695 } 1696 // SEV-9 2026-09-05: REPLY FIRST. The job id is real (the claim is on disk) and the runner is forked; the 1697 // middle-child reap and the fsync'd actlog row are what outlived the edge window under a storm and cost 1698 // every seat its receipt. Under the serve loop's deferral contract they are parked and drained by 1699 // ta_async_finish() AFTER the JOB-STARTED bytes are on the wire; a caller that did not opt in keeps 1700 // the inline order byte-for-byte. 1701 if ta_defer_ok == 1 { 1702 ta_ap_pid = pid1; ta_ap_nmp = nmp as i64; ta_ap_nml = nml; ta_ap_jid = jid; ta_ap_t0 = ta_t0 1703 ta_ap_pending = 1 1704 } else { 1705 if pid1 > 0 { 1706 let jst: *i64 = sys_mmap(16) as *i64 1707 sys_wait4(pid1, jst, 0) 1708 } 1709 ta_actlog(nmp, nml, "async" as *u8, "started" as *u8, 0, jid, sys_now_ms() - ta_t0) 1710 } 1711 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"JOB-STARTED id=" as *u8) 1712 b = ta_catn(jb, b, jid) 1713 b = ta_cat(jb, b, " tool=" as *u8) 1714 b = ta_json_esc(jb, b, nmp, nml) 1715 b = ta_cat(jb, b, " poll: _jobs/job_<id>.out is the OUTPUT, and _jobs/job_<id>.claim is the TERMINAL MARKER this lane writes atomically (temp+rename) when the job ends: ABSENT = still running; state=DONE rc= exit= bytes= = FINISHED, and bytes=0 there means the tool genuinely produced NOTHING rather than that it is still working. READ .claim BEFORE treating an empty .out as RUNNING -- that ambiguity is how a job that died and a job still thinking became the same observation. .done is never written.\"}],\"isError\":false,\"_meta\":{\"job\":" as *u8) 1716 b = ta_catn(jb, b, jid) 1717 b = ta_cat(jb, b, ",\"state\":\"RUNNING\"}}}" as *u8) 1718 return b 1719 } 1720 // SYNCHRONOUS LANE (root fix 2026-07-30, ws=sev-eater). A client is waiting behind the 1721 // edge's MEASURED 15.02s window, so this call gets the SYNC budget -- not the 120s default 1722 // that tea_run_pinned carries for the async lane. Holding a worker slot past the window 1723 // cannot deliver an answer to anyone; it only starves the bounded 16-worker pool, which is 1724 // exactly how a trickle of hung calls took the whole agent surface down for every seat 1725 // (measured: handler in pipe_wait behind an nx_mgmt_call parked in sk_wait_data, 10 stuck 1726 // handler pairs, 4 of 8 requests 503ing). This is the SYNC half of the seq1611/1634 fix: 1727 // that arc correctly gave the DETACHED lane an unbounded budget; the synchronous lane still 1728 // needed one BOUNDED BY THE CALLER'S PATIENCE. Same primitive, opposite direction. 1729 // PROMOTABLE (2026-08-22). The old sync lane, at its deadline, forked a watchdog that SIGKILLed 1730 // the worker -- DESTROYING THE ANSWER of every call that outran the edge window while the work 1731 // ran on and its side effects landed. Two lies followed: the edge synthesised a 503 (work landed, 1732 // caller told it failed), and -- worse -- this handler emitted isError:false with a -5 exit for a 1733 // KILLED organ (success reported for destroyed work). Now the deadline PROMOTES: tr_run_capture_ 1734 // deadline hands back the LIVE worker + pipe and we adopt it onto the SAME job lane the async path 1735 // uses, so the caller gets a JOB-STARTED handle instead of a 503 and the worker finishes. 1736 // Leak-free BY THE SERVE MODEL: tsv_serve is fork-per-request and the request child exit_group's 1737 // after responding, so the worker and the detached drainer reparent to init, which reaps them. 1738 // The deadline is DERIVED live from edge_window.conf (window - reserve), never a typed literal. 1739 let promsrc: *i64 = sys_mmap(16) as *i64 1740 let promote_at: i64 = tea_sync_promote_ms(promsrc) 1741 let wpid: *i64 = sys_mmap(16) as *i64 1742 let wrfd: *i64 = sys_mmap(16) as *i64 1743 let tt_exec_begin: i64 = ta_timing_now_us() 1744 let ec: i64 = tea_run_pinned_deadline(nmp, nml, av, xout, xcap, xlen, xrc, promote_at, wpid, wrfd) 1745 let tt_exec_end: i64 = ta_timing_now_us() 1746 ta_timing_runner(tt_exec_begin, tt_exec_end, ec, xlen[0]) 1747 // Inline runs finalize their already-owned claim, preserving the same result handle 1748 // used by async/promotion. A publication error cannot relabel executed work unexecuted. 1749 var inline_published:i64=0 1750 if ec!=TR_PROMOTE { 1751 var cn:i64=ta_cat(claim_line,0,"state=DONE rc=");cn=ta_catn(claim_line,cn,xrc[0]) 1752 cn=ta_cat(claim_line,cn," exit=");cn=ta_catn(claim_line,cn,ec) 1753 cn=ta_cat(claim_line,cn," bytes=");cn=ta_catn(claim_line,cn,xlen[0]);claim_line[cn]=10;cn=cn+1 1754 if ta_job_publish(jout2,xout,xlen[0],jtmp,claim_line,cn,jpath)==0{inline_published=1} 1755 } 1756 if xrc[0] == TEA_OK { 1757 if ec == TR_PROMOTE { 1758 let jidp:i64=jid 1759 let jpathp:*u8=jpath 1760 let joutp:*u8=jout2 1761 let jtmpp:*u8=jtmp 1762 let precap: i64 = xlen[0] // bytes captured BEFORE promotion; the drainer prepends them to the tail 1763 // DI4: a keyed sync call that outran the window is now a job -- its id is the outcome, recorded before the reply 1764 if idst == TI_NEW { let prow: *u8 = sys_mmap(TI_ROW_CAP); let prl: i64 = ti_row_job(prow, TI_ROW_CAP, "promote" as *u8, nmp, nml, jidp); ti_record(TI_LEDGER, idp, idl, prow, prl) } 1765 // REPLY FIRST (debt 1787505278). Everything above this line is what the reply NEEDS (a 1766 // reserved, real job id). Everything the drainer needs is parked; the fork/wait4/actlog 1767 // run in ta_promote_finish() AFTER the serve loop has put the JOB-STARTED bytes on the 1768 // wire. A caller that did not sign the contract gets the old inline ordering, unchanged. 1769 let tdecide: i64 = sys_now_ms() 1770 if ta_defer_ok == 1 { 1771 ta_pp_nmp = nmp as i64; ta_pp_nml = nml; ta_pp_jid = jidp 1772 ta_pp_jpath = jpathp as i64; ta_pp_jout = joutp as i64; ta_pp_jtmp = jtmpp as i64 1773 ta_pp_xout = xout as i64; ta_pp_precap = precap; ta_pp_wrfd = wrfd[0] 1774 ta_pp_t0 = ta_t0; ta_pp_tdecide = tdecide 1775 ta_pp_pending = 1 1776 } else { 1777 ta_promote_bookkeep(nmp, nml, jidp, jpathp, joutp, jtmpp, xout, precap, wrfd[0], ta_t0, TA_REPLY_MS_UNOBSERVED) 1778 } 1779 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"JOB-STARTED id=" as *u8) 1780 b = ta_catn(jb, b, jidp) 1781 b = ta_cat(jb, b, " tool=" as *u8) 1782 b = ta_json_esc(jb, b, nmp, nml) 1783 b = ta_cat(jb, b, " -- this sync call outran the edge window and was PROMOTED to the job lane, NOT killed. Completion marker: _jobs/job_<id>.claim (state=CLAIMED -> state=DONE); payload: _jobs/job_<id>.out.\"}],\"isError\":false,\"_meta\":{\"job\":" as *u8) 1784 b = ta_catn(jb, b, jidp) 1785 b = ta_cat(jb, b, ",\"state\":\"RUNNING\",\"promoted\":1,\"budget_ms\":" as *u8) 1786 b = ta_catn(jb, b, promote_at) 1787 b = ta_cat(jb, b, ",\"budget_src\":" as *u8) 1788 if promsrc[0] == TEA_SRC_CONF { b = ta_cat(jb, b, "\"conf\"" as *u8) } else { b = ta_cat(jb, b, "\"default\"" as *u8) } 1789 b = ta_cat(jb, b, "}}}" as *u8) 1790 return b 1791 } 1792 // 2a THE SUCCESS-ENVELOPE HONESTY FIX. ec is the RETURN value (child exit 0..255, or a NEGATIVE 1793 // harness sentinel: -2 pipe, -3 fork, -4 wait, -5 timeout, -6 chdir). The old code branched only 1794 // on xrc[0] (the RESOLVE code, set BEFORE the fork), so a killed/failed run was emitted as 1795 // isError:false with a negative exit_code -- the daemon reporting SUCCESS for work it DESTROYED. 1796 // isError keys on the harness sentinels (ec < 0), NEVER on the organ's own exit: a gate exiting 1797 // 1 for RED is a correct answer, not an error. TR_PROMOTE (-7) is handled above, so it is not here. 1798 if ec < 0 { 1799 ta_actlog(nmp, nml, "sync" as *u8, "harness-fail" as *u8, ec, xlen[0], sys_now_ms() - ta_t0) 1800 if idst == TI_NEW { ti_release(TI_DIR, idhex) } // DI4: the harness failed, nothing is known to have applied -- the key is judged afresh 1801 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"the tool run did not complete inside the daemon (harness code " as *u8) 1802 b = ta_catn(jb, b, ec) 1803 b = ta_cat(jb, b, ": -5 deadline, -2 pipe, -3 fork, -4 wait, -6 chdir). This is NOT the organ exit code and NOT a success -- re-run on the async lane (_async=1) for unbounded work.\"}],\"isError\":true,\"_meta\":{\"harness_code\":" as *u8) 1804 b = ta_catn(jb, b, ec) 1805 b = ta_cat(jb, b, "}}}" as *u8) 1806 return ta_claim_meta(jb,b,jid,claim_elapsed,inline_published) 1807 } 1808 ta_actlog(nmp, nml, "sync" as *u8, "ok" as *u8, ec, xlen[0], sys_now_ms() - ta_t0) 1809 // DI4: a keyed sync call keeps its bytes beside the job artifacts and records exit+bytes+path, so a retry under 1810 // the same key answers the same text (the organ's own exit code, RED included, is an outcome -- it is recorded) 1811 if idst == TI_NEW { let sop: *u8 = sys_mmap(TI_PATH_CAP); ti_out_path(TI_DIR, idhex, sop); ta_job_put(sop, xout, xlen[0]); let srow: *u8 = sys_mmap(TI_ROW_CAP); let srl: i64 = ti_row_sync(srow, TI_ROW_CAP, "sync" as *u8, nmp, nml, ec, xlen[0], TI_DIR, idhex); ti_record(TI_LEDGER, idp, idl, srow, srl) } 1812 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"" as *u8) 1813 b = ta_json_esc(jb, b, xout, xlen[0]) 1814 // seq1301 put capture_truncated in _meta -- correct, and it is STILL emitted below. But MCP 1815 // CLIENTS DO NOT SURFACE _meta: they render result.content[].text ONLY. So the one consumer who 1816 // acts on a truncated result never saw the warning, and the sole symptom was ABSENCE of the 1817 // tool's own trailing footer -- a negative signal no caller knows to look for. Say it IN THE 1818 // TEXT, where every client actually reads. Guarded by the same condition, so untruncated output 1819 // stays byte-identical to before (rule 19). No backslash escapes here on purpose. 1820 if xlen[0] >= xcap { 1821 b = ta_cat(jb, b, " [NX-TRUNCATED OUTPUT-IS-PARTIAL capture_cap=" as *u8) 1822 b = ta_catn(jb, b, xcap) 1823 b = ta_cat(jb, b, " -- narrow the query or re-run with _async=1]" as *u8) 1824 } 1825 b = ta_cat(jb, b, "\"}],\"isError\":false,\"_meta\":{\"exit_code\":" as *u8) 1826 b = ta_catn(jb, b, ec) 1827 b = ta_cat(jb, b, ",\"bytes\":" as *u8) 1828 b = ta_catn(jb, b, xlen[0]) 1829 // seq1301: a full capture buffer means the organ's stdout was (or may have been) CLIPPED -- 1830 // silence here is how a truncated source nearly shipped. Say so, machine-readably. 1831 if xlen[0] >= xcap { 1832 b = ta_cat(jb, b, ",\"capture_truncated\":1,\"capture_cap\":" as *u8) 1833 b = ta_catn(jb, b, xcap) 1834 } 1835 b = ta_cat(jb, b, "}}}" as *u8) 1836 return ta_claim_meta(jb,b,jid,claim_elapsed,inline_published) 1837 } 1838 if idst == TI_NEW { ti_release(TI_DIR, idhex) } // DI4: nothing ran, so a keyed retry must be judged afresh 1839 // capability-valid but NOT on the GREEN execution allowlist -> clean TOOL-level error (not a protocol 1840 // error). rc magnitude: 0=blocked(present,non-GREEN) 1=not-in-allowlist 2=no-allowlist-file. 1841 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"tool '" as *u8) 1842 b = ta_json_esc(jb, b, nmp, nml) 1843 b = ta_cat(jb, b, "' is capability-authorized but not on the GREEN execution allowlist (rc=" as *u8) 1844 b = ta_catn(jb, b, 0 - xrc[0]) 1845 b = ta_cat(jb, b, ")\"}],\"isError\":true}}" as *u8) 1846 return ta_claim_meta(jb,b,jid,claim_elapsed,inline_published) 1847 } 1848 // ACTIONABLE DENY (rule 18: say WHAT happened, WHY it matters, WHAT to do). The old text was a bare 1849 // capability-denied-is-required, which a caller cannot distinguish from -- this tool does not exist -- 1850 // measured as the trigger for the ssh/PowerShell fallback cascade (debt seq1235). The two cases have 1851 // OPPOSITE remedies, so they get OPPOSITE messages, and the presented flag states which one you are in. 1852 b = ta_cat(jb, b, ",\"error\":{\"code\":-32001,\"message\":\"capability denied for tool '" as *u8) 1853 b = ta_json_esc(jb, b, nmp, nml) 1854 if capl <= 0 { 1855 b = ta_cat(jb, b, "': NO capability was presented. This tool EXISTS and is callable -- this is an auth gap, NOT a missing tool, so do NOT fall back to shell/ssh. Present one of: ?cap=<token> on the MCP URL (session baseline, survives clients that drop custom headers), X-Nishi-Cap: <token>, Authorization: Bearer <token>, or params._cap in the call arguments (per-call override, wins over all others). Mint one with the management API POST /api/cap/mint allow=<tool>&confirm=yes with authorized admin credentials; optional days=<lifetime-days> and nonce=<positive-integer>. Signing-key status is GET /api/cap/status on this public tools API origin, not the management API." as *u8) 1856 } else { 1857 b = ta_cat(jb, b, "': the capability you DID present does not grant this tool, or is expired, forged, or revoked. Check its allow-list covers this exact tool name; mint a scoped one with the management API POST /api/cap/mint allow=<tool>&confirm=yes with authorized admin credentials; optional days=<lifetime-days> and nonce=<positive-integer>. Confirm signing-key status with GET /api/cap/status on this public tools API origin, not the management API. The tool itself exists -- do NOT fall back to shell/ssh." as *u8) 1858 } 1859 b = ta_cat(jb, b, "\",\"data\":{\"reason\":" as *u8) 1860 b = ta_catn(jb, b, 0 - granted) 1861 b = ta_cat(jb, b, ",\"presented\":" as *u8) 1862 if capl > 0 { b = ta_cat(jb, b, "1" as *u8) } else { b = ta_cat(jb, b, "0" as *u8) } 1863 b = ta_cat(jb, b, ",\"tool\":\"" as *u8) 1864 b = ta_json_esc(jb, b, nmp, nml) 1865 b = ta_cat(jb, b, "\",\"presenters\":[\"query:?cap=\",\"header:X-Nishi-Cap\",\"header:Authorization Bearer\",\"body:params._cap\"]" as *u8) 1866 b = ta_cat(jb, b, "}}}" as *u8) 1867 return b 1868} 1869 1870// R3: MCP resources/read -- serve READABLE content (not tool execution). Two resources: the LIVE ecosystem maturity 1871// grade (forks the allowlisted rollup, escapes its output) and the operating doctrine (embedded). Public read-only 1872// (non-sensitive, no side effects); resource not found -> -32002. Composes with the nx_ecosystem_maturity_rollup tool. 1873func ta_mcp_resread(body: *u8, bn: i64, jb: *u8, b0: i64) -> i64 { 1874 var b: i64 = b0 1875 let u2: *i64 = sys_mmap(16) as *i64 1876 if ta_json_str(body, bn, "\"uri\"" as *u8, u2) == 0 { 1877 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"resources/read requires params.uri\"}}" as *u8) 1878 } 1879 let up: *u8 = ((body as i64) + u2[0]) as *u8 1880 let ul: i64 = u2[1] 1881 if ta_indexof(up, ul, "ecosystem-maturity" as *u8) >= 0 { 1882 let xcap: i64 = TA_MAGIC_65536 1883 let xout: *u8 = sys_mmap(xcap) 1884 let xlen: *i64 = sys_mmap(16) as *i64 1885 let xrc: *i64 = sys_mmap(16) as *i64 1886 let av: *i64 = sys_mmap(64) as *i64 1887 av[1] = 0 1888 tea_run_pinned("nx_ecosystem_maturity_rollup" as *u8, 28, av, xout, xcap, xlen, xrc) 1889 b = ta_cat(jb, b, ",\"result\":{\"contents\":[{\"uri\":\"nishi://sota/ecosystem-maturity\",\"mimeType\":\"text/plain\",\"text\":\"" as *u8) 1890 if xrc[0] == TEA_OK { b = ta_json_esc(jb, b, xout, xlen[0]) } else { b = ta_cat(jb, b, "(maturity rollup unavailable)" as *u8) } 1891 return ta_cat(jb, b, "\"}]}}" as *u8) 1892 } 1893 if ta_indexof(up, ul, "doctrine/operating" as *u8) >= 0 { 1894 b = ta_cat(jb, b, ",\"result\":{\"contents\":[{\"uri\":\"nishi://doctrine/operating\",\"mimeType\":\"text/plain\",\"text\":\"" as *u8) 1895 b = ta_cat(jb, b, "Operate Nishi over sovereign MCP. Tools: nishi_search/nishi_doc (search); nx_status/nx_services/nx_health (status); nx_mgmt (admin: build/deploy/reconcile/restart); nx_ecosystem_maturity_rollup (live grade). Auth: ?cap=token on the MCP URL (session baseline -- use this if your client drops custom headers), X-Nishi-Cap header, Authorization: Bearer cap, or params._cap (per-call, wins over the rest). Build+deploy on the NAS via /api/build + /api/deploy (never-brick, auto-rollback). One-command edit-to-build: nx_ship target tokenfile srcdir." as *u8) 1896 return ta_cat(jb, b, "\"}]}}" as *u8) 1897 } 1898 return ta_cat(jb, b, ",\"error\":{\"code\":-32002,\"message\":\"resource not found\"}}" as *u8) 1899} 1900// R3: MCP prompts/get -- return a reusable prompt template, arguments filled. `operate-nishi` primes an agent on the 1901// sovereign toolset; `ship-target` (arg: target) is a build+deploy prompt. unknown -> -32602. 1902func ta_mcp_promget(body: *u8, bn: i64, jb: *u8, b0: i64) -> i64 { 1903 var b: i64 = b0 1904 let n2: *i64 = sys_mmap(16) as *i64 1905 if ta_json_str(body, bn, "\"name\"" as *u8, n2) == 0 { 1906 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"prompts/get requires params.name\"}}" as *u8) 1907 } 1908 let np: *u8 = ((body as i64) + n2[0]) as *u8 1909 let nl: i64 = n2[1] 1910 if ta_streq_n(np, nl, "operate-nishi" as *u8) == 1 { 1911 b = ta_cat(jb, b, ",\"result\":{\"description\":\"Prime an agent to operate the Nishi ecosystem over sovereign MCP\",\"messages\":[{\"role\":\"user\",\"content\":{\"type\":\"text\",\"text\":\"" as *u8) 1912 b = ta_cat(jb, b, "You operate the Nishi sovereign ecosystem over MCP; prefer these tools over shell. Search: nishi_search/nishi_doc. Status: nx_status/nx_services/nx_health. Admin build/deploy/reconcile/restart (never-brick): nx_mgmt. Live SOTA grade: nx_ecosystem_maturity_rollup. One-command edit-to-build: nx_ship. Read the resource nishi://doctrine/operating first." as *u8) 1913 return ta_cat(jb, b, "\"}}]}}" as *u8) 1914 } 1915 if ta_streq_n(np, nl, "ship-target" as *u8) == 1 { 1916 let t2: *i64 = sys_mmap(16) as *i64 1917 var tp: *u8 = "TARGET" as *u8 1918 var tl: i64 = 6 1919 if ta_json_str(body, bn, "\"target\"" as *u8, t2) == 1 { tp = ((body as i64) + t2[0]) as *u8; tl = t2[1] } 1920 b = ta_cat(jb, b, ",\"result\":{\"description\":\"Build and deploy a target on the NAS over sovereign APIs\",\"messages\":[{\"role\":\"user\",\"content\":{\"type\":\"text\",\"text\":\"Build and deploy the target '" as *u8) 1921 b = ta_json_esc(jb, b, tp, tl) 1922 b = ta_cat(jb, b, "' on the NAS with ZERO shell: sync+compile via nx_ship (or nx_mgmt POST /api/build target=" as *u8) 1923 b = ta_json_esc(jb, b, tp, tl) 1924 b = ta_cat(jb, b, "), then promote via nx_mgmt POST /api/deploy (never-brick, auto-rollback), and verify with nx_health.\"}}]}}" as *u8) 1925 return b 1926 } 1927 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"unknown prompt\"}}" as *u8) 1928} 1929func ta_mcp(prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64 { 1930 let bo: i64 = ta_body_off(req, req_n) 1931 let body: *u8 = ((req as i64) + bo) as *u8 1932 let bn: i64 = req_n - bo 1933 let envelope: *NxMcpEnvelope = sys_mmap(NX_MCP_ENVELOPE_BYTES) as *NxMcpEnvelope 1934 let envelope_kind: i64 = nme_read(body, bn, envelope) 1935 if envelope_kind == 2 { return ta_emit_lit(out, "HTTP/1.1 202 Accepted" as *u8, "" as *u8) } 1936 if envelope_kind != 1 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "" as *u8) } 1937 let idbuf: *u8 = ((body as i64) + envelope.id_off) as *u8 1938 let idlen: i64 = envelope.id_len 1939 var meth: i64 = 0 1940 if envelope_kind == 1 { 1941 let mp: *u8 = ((body as i64) + envelope.method_off) as *u8 1942 let ml: i64 = envelope.method_len 1943 if ta_streq_n(mp, ml, "tools/list" as *u8) == 1 { meth = 2 } else { if ta_streq_n(mp, ml, "initialize" as *u8) == 1 { meth = 1 } else { if ta_streq_n(mp, ml, "tools/call" as *u8) == 1 { meth = 3 } else { if ta_streq_n(mp, ml, "resources/list" as *u8) == 1 { meth = 4 } else { if ta_streq_n(mp, ml, "resources/read" as *u8) == 1 { meth = 5 } else { if ta_streq_n(mp, ml, "prompts/list" as *u8) == 1 { meth = 6 } else { if ta_streq_n(mp, ml, "prompts/get" as *u8) == 1 { meth = 7 } } } } } } } 1944 } 1945 let jb: *u8 = sys_mmap(TA_MAGIC_1048576) 1946 var b: i64 = ta_cat(jb, 0, "{\"jsonrpc\":\"2.0\",\"id\":" as *u8) 1947 b = ta_catb(jb, b, idbuf, idlen) 1948 if meth == 1 { 1949 b = ta_cat(jb, b, ",\"result\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{\"tools\":{\"listChanged\":false},\"resources\":{\"listChanged\":false},\"prompts\":{\"listChanged\":false}},\"serverInfo\":{\"name\":\"nishi-tools\",\"version\":\"1\"}}}" as *u8) 1950 } else { if meth == 2 { 1951 // MCP cursor pagination: params.cursor is a numeric offset; emit a page + nextCursor iff more remain. 1952 var pgoff: i64 = 0 1953 let cb2: *i64 = sys_mmap(16) as *i64 1954 if ta_json_raw(body, bn, "\"cursor\"" as *u8, cb2) == 1 { pgoff = tr_atoi(body, cb2[0], cb2[1]) } 1955 let moreb: *i64 = sys_mmap(16) as *i64 1956 moreb[0] = 0 1957 b = ta_cat(jb, b, ",\"result\":{\"tools\":[" as *u8) 1958 b = ta_emit_tools(prefix, jb, b, 1, pgoff, TA_MCP_PAGE, moreb) 1959 b = ta_cat(jb, b, "]" as *u8) 1960 if moreb[0] == 1 { b = ta_cat(jb, b, ",\"nextCursor\":\"" as *u8); b = ta_catn(jb, b, pgoff + TA_MCP_PAGE); b = ta_cat(jb, b, "\"" as *u8) } 1961 b = ta_cat(jb, b, "}}" as *u8) 1962 } else { if meth == 3 { 1963 b = ta_mcp_call(prefix, req, req_n, body, bn, jb, b) 1964 } else { if meth == 4 { 1965 b = ta_cat(jb, b, ",\"result\":{\"resources\":[{\"uri\":\"nishi://sota/ecosystem-maturity\",\"name\":\"Ecosystem Maturity Grade\",\"description\":\"live liar-killed per-domain maturity toward S-class, measured from the sovereign seg_store\",\"mimeType\":\"text/plain\"},{\"uri\":\"nishi://doctrine/operating\",\"name\":\"Nishi Operating Doctrine\",\"description\":\"how to operate the ecosystem over sovereign MCP + APIs\",\"mimeType\":\"text/plain\"}]}}" as *u8) 1966 } else { if meth == 5 { 1967 b = ta_mcp_resread(body, bn, jb, b) 1968 } else { if meth == 6 { 1969 b = ta_cat(jb, b, ",\"result\":{\"prompts\":[{\"name\":\"operate-nishi\",\"description\":\"Prime an agent to operate the Nishi ecosystem over sovereign MCP\"},{\"name\":\"ship-target\",\"description\":\"Build and deploy a target on the NAS over sovereign APIs\",\"arguments\":[{\"name\":\"target\",\"description\":\"the runtime organ to build and deploy\",\"required\":true}]}]}}" as *u8) 1970 } else { if meth == 7 { 1971 b = ta_mcp_promget(body, bn, jb, b) 1972 } else { 1973 b = ta_cat(jb, b, ",\"error\":{\"code\":-32601,\"message\":\"method not found\"}}" as *u8) 1974 } } } } } } } 1975 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 1976} 1977 1978// ---- THE router: pure request bytes -> response bytes (gate drives this directly, no socket) --------- 1979// POST /api/cap/issue -- SELF-SERVICE capability DELEGATION (pure ocap, no ambient identity). Present YOUR capability 1980// (X-Nishi-Cap header or params._cap) + a narrower "allow" (+ optional "exp"); get back a delegated capability that is a 1981// SUBSET of yours (capt_attenuate refuses any widening AND an invalid/forged input -> you can never delegate more than 1982// you hold). Root minting from the secret stays operator-side (nx_cap_mint). Ratchet: clamp exp' <= parent exp. 1983// R4 per-client consent ledger: cap_consent.log (append-only). One line per delegation: 1984// now <TAB> client <TAB> allow <TAB> exp <TAB> parent_nonce <TAB> child_nonce 1985// In the ocap model the operator's SCOPED, attenuated mint IS the per-client consent (a deliberate least-authority 1986// grant, superior to a yes/no consent screen); this makes that intent EXPLICIT (client-attributed) + AUDITABLE. 1987const TA_CONSENT_LOG: *u8 = "cap_consent.log" as *u8 1988func ta_append_consent(client: *u8, cl: i64, allowp: *u8, allowl: i64, exp: i64, pnonce: i64, cnonce: i64) -> i64 { 1989 let fd: i64 = ta_openat_append(TA_CONSENT_LOG) 1990 if fd < 0 { return 0 - 1 } 1991 let line: *u8 = sys_mmap(TA_MAGIC_8192) 1992 var o: i64 = ta_catn(line, 0, sys_now_realtime_sec()) 1993 line[o] = 9 as u8; o = o + 1 1994 o = ta_catb(line, o, client, cl) 1995 line[o] = 9 as u8; o = o + 1 1996 o = ta_catb(line, o, allowp, allowl) 1997 line[o] = 9 as u8; o = o + 1 1998 o = ta_catn(line, o, exp) 1999 line[o] = 9 as u8; o = o + 1 2000 o = ta_catn(line, o, pnonce) 2001 line[o] = 9 as u8; o = o + 1 2002 o = ta_catn(line, o, cnonce) 2003 line[o] = 10 as u8; o = o + 1 2004 sys_write(fd, line, o) 2005 sys_close(fd) 2006 return 0 2007} 2008// GET /api/cap/consent-log -- PUBLIC audit trail of who-delegated-what-to-which-client (no secrets: nonces + scope only). 2009func ta_cap_consent_log(out: *u8) -> i64 { 2010 let szp: *i64 = sys_mmap(16) as *i64 2011 let buf: *u8 = sys_read_file(TA_CONSENT_LOG, szp) 2012 let jb: *u8 = sys_mmap(TA_MAGIC_1048576) 2013 var b: i64 = ta_cat(jb, 0, "{\"consent_log\":\"" as *u8) 2014 if (buf as i64) != 0 { b = ta_json_esc(jb, b, buf, szp[0]) } 2015 b = ta_cat(jb, b, "\",\"schema\":\"now\\tclient\\tallow\\texp\\tparent_nonce\\tchild_nonce\",\"note\":\"append-only; ocap scoped+attenuated delegation IS the per-client consent, recorded here for audit + revocable via /api/cap/revoke\"}" as *u8) 2016 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 2017} 2018func ta_cap_issue(req: *u8, req_n: i64, out: *u8) -> i64 { 2019 let bo: i64 = ta_body_off(req, req_n) 2020 let body: *u8 = ((req as i64) + bo) as *u8 2021 let bn: i64 = req_n - bo 2022 let slb: *i64 = sys_mmap(16) as *i64 2023 let secret: *u8 = ta_load_cap_secret(slb) 2024 let secretlen: i64 = slb[0] 2025 let cap2: *i64 = sys_mmap(16) as *i64 2026 var pp: *u8 = 0 as *u8 2027 var pl: i64 = 0 2028 if ta_header(req, req_n, "X-Nishi-Cap:" as *u8, cap2) == 1 { pp = ((req as i64) + cap2[0]) as *u8; pl = cap2[1] } 2029 else { let cb: *i64 = sys_mmap(16) as *i64; if ta_json_str(body, bn, "\"_cap\"" as *u8, cb) == 1 { pp = ((body as i64) + cb[0]) as *u8; pl = cb[1] } } 2030 if pl <= 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"present your capability (X-Nishi-Cap header or params._cap)\"}" as *u8) } 2031 let ab: *i64 = sys_mmap(16) as *i64 2032 var allowp: *u8 = 0 as *u8 2033 var allowl: i64 = 0 2034 if ta_json_str(body, bn, "\"allow\"" as *u8, ab) == 1 { allowp = ((body as i64) + ab[0]) as *u8; allowl = ab[1] } 2035 if allowl <= 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"specify a narrower \\\"allow\\\" tool-set (comma-separated)\"}" as *u8) } 2036 var exp: i64 = TA_MAGIC_9999999999 2037 let eb: *i64 = sys_mmap(16) as *i64 2038 if ta_json_raw(body, bn, "\"exp\"" as *u8, eb) == 1 { exp = tr_atoi(body, eb[0], eb[1]) } 2039 // caller-supplied nonce -> a UNIQUE identity per delegated cap so it can be revoked individually (default 7 if omitted) 2040 var dnonce: i64 = 7 2041 let nb: *i64 = sys_mmap(16) as *i64 2042 if ta_json_raw(body, bn, "\"nonce\"" as *u8, nb) == 1 { dnonce = tr_atoi(body, nb[0], nb[1]) } 2043 let ntok: *u8 = sys_mmap(TA_MAGIC_2048) 2044 let ntn: i64 = capt_attenuate(secret, secretlen, pp, pl, allowp, allowl, exp, dnonce, ntok, TA_MAGIC_2048) 2045 if ntn > 0 { 2046 // R4: record the per-client consent (who consented by holding the parent, to which client, what scope, when). 2047 let clb: *i64 = sys_mmap(16) as *i64 2048 var clientp: *u8 = "anonymous" as *u8 2049 var clientl: i64 = 9 2050 if ta_json_str(body, bn, "\"client\"" as *u8, clb) == 1 { clientp = ((body as i64) + clb[0]) as *u8; clientl = clb[1] } 2051 ta_append_consent(clientp, clientl, allowp, allowl, exp, capt_nonce_of(pp, pl), dnonce) 2052 let jb: *u8 = sys_mmap(TA_MAGIC_4096) 2053 var b: i64 = ta_cat(jb, 0, "{\"cap\":\"" as *u8) 2054 b = ta_catb(jb, b, ntok, ntn) 2055 b = ta_cat(jb, b, "\",\"consent_recorded\":true,\"note\":\"delegated capability -- a SUBSET of yours (attenuation is subset-only; widening is refused); per-client consent logged (see GET /api/cap/consent-log)\"}" as *u8) 2056 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 2057 } 2058 return ta_emit_lit(out, "HTTP/1.1 403 Forbidden" as *u8, "{\"error\":\"cannot delegate: your capability is invalid/forged, or the requested tools exceed your grant (no widening)\"}" as *u8) 2059} 2060 2061// POST /api/cap/revoke -- REVOKE a capability you hold: present it (X-Nishi-Cap / params._cap); if its MAC is valid its 2062// nonce is added to the denylist and it (plus any cap sharing that nonce) is refused thereafter. Fail-closed: only a 2063// MAC-valid cap can be revoked (the denylist can't be spammed with garbage). Cascading parent->child is a ratchet. 2064func ta_cap_revoke(req: *u8, req_n: i64, out: *u8) -> i64 { 2065 let bo: i64 = ta_body_off(req, req_n) 2066 let body: *u8 = ((req as i64) + bo) as *u8 2067 let bn: i64 = req_n - bo 2068 let slb: *i64 = sys_mmap(16) as *i64 2069 let secret: *u8 = ta_load_cap_secret(slb) 2070 let secretlen: i64 = slb[0] 2071 let cap2: *i64 = sys_mmap(16) as *i64 2072 var pp: *u8 = 0 as *u8 2073 var pl: i64 = 0 2074 if ta_header(req, req_n, "X-Nishi-Cap:" as *u8, cap2) == 1 { pp = ((req as i64) + cap2[0]) as *u8; pl = cap2[1] } 2075 else { let cb: *i64 = sys_mmap(16) as *i64; if ta_json_str(body, bn, "\"_cap\"" as *u8, cb) == 1 { pp = ((body as i64) + cb[0]) as *u8; pl = cb[1] } } 2076 if pl <= 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"present the capability to revoke (X-Nishi-Cap or params._cap)\"}" as *u8) } 2077 let plb: *i64 = sys_mmap(16) as *i64 2078 if capt_mac_ok(secret, secretlen, pp, pl, plb) == 0 { return ta_emit_lit(out, "HTTP/1.1 403 Forbidden" as *u8, "{\"error\":\"invalid/forged capability -- nothing revoked\"}" as *u8) } 2079 let nn: i64 = capt_nonce_of(pp, pl) 2080 ta_append_revoked(nn) 2081 let jb: *u8 = sys_mmap(256) 2082 var b: i64 = ta_cat(jb, 0, "{\"revoked_nonce\":" as *u8) 2083 b = ta_catn(jb, b, nn) 2084 b = ta_cat(jb, b, ",\"note\":\"denylisted; this capability (and any sharing its nonce) is refused from now on\"}" as *u8) 2085 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 2086} 2087 2088// GET /api/cap/status -- PUBLIC config-health readout for the capability-grant bootstrap: reports whether the server 2089// loaded a REAL signing keyfile or is still on the FORGEABLE baked placeholder. Reveals NO secret (only the boolean 2090// state) -- and if it says placeholder, that secret is already public in the source, so nothing leaks. This is what 2091// lets an operator confirm `nx_cap_keygen` + restart took effect BEFORE minting (otherwise a real token fails with an 2092// opaque -32001 and there is no way to tell why). Needs no capability -- it must be checkable before any cap exists. 2093func ta_cap_status(out: *u8) -> i64 { 2094 if ta_cap_provisioned() == 1 { 2095 return ta_emit_lit(out, "HTTP/1.1 200 OK" as *u8, "{\"cap_signing\":\"provisioned\",\"secure\":true,\"note\":\"a real keyfile is loaded; minted tokens will verify\"}" as *u8) 2096 } 2097 return ta_emit_lit(out, "HTTP/1.1 200 OK" as *u8, "{\"cap_signing\":\"insecure_placeholder\",\"secure\":false,\"note\":\"forgeable baked secret in use -- run nx_cap_keygen in the server CWD and restart nx_tools_api, then re-check\"}" as *u8) 2098} 2099 2100// RFC 9728 Protected Resource Metadata -- lets a stock MCP client DISCOVER how to authenticate to this resource 2101// (bearer token in the Authorization header) and where the authorization server is. GET /.well-known/oauth-protected- 2102// resource. Advertises the ocap-as-bearer interop (R2); native X-Nishi-Cap / _cap remain first-class. 2103func ta_oauth_prm(out: *u8) -> i64 { 2104 return ta_emit_lit(out, "HTTP/1.1 200 OK" as *u8, "{\"resource\":\"https://nishifamily.com/mcp\",\"authorization_servers\":[\"https://nishifamily.com\"],\"bearer_methods_supported\":[\"header\"],\"resource_name\":\"Nishi Sovereign MCP\",\"resource_documentation\":\"https://nishifamily.com/api\"}" as *u8) 2105} 2106// ============================================================================================================ 2107// OAuth 2.1 AUTHORIZATION SERVER (RFC 6749/8252 + PKCE RFC 7636 S256 + AS-metadata RFC 8414 + dynamic client 2108// registration RFC 7591). Interactive consent at /oauth/authorize. STATELESS signed tokens: client_id + auth-code 2109// are capt_issue-signed (no client/token DB); access_token is a real scoped cap. One-time-use codes tracked in a 2110// BOUNDED static-pointer table (like the rate limiter). The issued bearer IS an X-Nishi-Cap -> the resource server 2111// (tools/call) already accepts it (Authorization: Bearer). ocap remains superior; this is for stock OAuth clients. 2112// ============================================================================================================ 2113const OC_SLOTS: i64 = 256 2114static oc_nonce: *i64 // one-time auth-code nonce (0 = free slot) 2115static oc_rhash: *i64 // bound redirect_uri hash 2116static oc_exp: *i64 // code expiry (epoch) 2117static oc_bind: *u8 // OC_SLOTS*160: [0..48)=code_challenge(S256, 43ch) , [48..160)=granted scope (tool CSV) 2118func oauth_state_init() -> i64 { 2119 if (oc_nonce as i64) == 0 { 2120 oc_nonce = sys_mmap(OC_SLOTS * 8) as *i64 2121 oc_rhash = sys_mmap(OC_SLOTS * 8) as *i64 2122 oc_exp = sys_mmap(OC_SLOTS * 8) as *i64 2123 oc_bind = sys_mmap(OC_SLOTS * 160) 2124 } 2125 return 0 2126} 2127func oauth_slotv(h: i64, slots: i64) -> i64 { var x: i64 = h; if x < 0 { x = 0 - x } return x - (x / slots) * slots } 2128func oauth_strhash(s: *u8, n: i64) -> i64 { var h: i64 = TA_MAGIC_1469598; var i: i64 = 0; while i < n { h = h * 31 + (s[i] as i64); i = i + 1 } if h == 0 { h = 1 } return h } 2129// extract param "key=" from a query/form string -> value [off,len) into out2 (0 if absent). Boundary = start or '&'. 2130func oauth_param(src: *u8, slen: i64, key: *u8, klen: i64, out2: *i64) -> i64 { 2131 var i: i64 = 0 2132 while i + klen <= slen { 2133 var atb: i64 = 0 2134 if i == 0 { atb = 1 } else { if src[i - 1] == (38 as u8) { atb = 1 } } 2135 if atb == 1 { 2136 var k: i64 = 0 2137 while k < klen { if src[i + k] != key[k] { k = klen + 9 } else { k = k + 1 } } 2138 if k == klen { if i + klen < slen { if src[i + klen] == (61 as u8) { 2139 let v: i64 = i + klen + 1 2140 var e: i64 = v 2141 var go: i64 = 1 2142 while go == 1 { if e >= slen { go = 0 } else { if src[e] == (38 as u8) { go = 0 } else { e = e + 1 } } } 2143 out2[0] = v 2144 out2[1] = e - v 2145 return 1 2146 } } } 2147 } 2148 i = i + 1 2149 } 2150 return 0 2151} 2152// minimal percent-decode (+ -> space, %XX -> byte) for building the redirect Location. Returns decoded length. 2153func oauth_hexv(c: i64) -> i64 { if c >= 48 { if c <= 57 { return c - 48 } } if c >= 65 { if c <= 70 { return c - 55 } } if c >= 97 { if c <= 102 { return c - 87 } } return 0 } 2154func oauth_urldec(src: *u8, n: i64, dst: *u8) -> i64 { 2155 var i: i64 = 0 2156 var o: i64 = 0 2157 while i < n { 2158 let c: i64 = src[i] as i64 2159 if c == 37 { if i + 2 < n { dst[o] = ((oauth_hexv(src[i+1] as i64) * 16) + oauth_hexv(src[i+2] as i64)) as u8; o = o + 1; i = i + 3 } else { dst[o] = 37 as u8; o = o + 1; i = i + 1 } } 2160 else { if c == 43 { dst[o] = 32 as u8; o = o + 1; i = i + 1 } else { dst[o] = c as u8; o = o + 1; i = i + 1 } } 2161 } 2162 return o 2163} 2164// base64url (no padding) of raw bytes -> out. For 32-byte SHA-256 -> 43 chars (PKCE S256 challenge form). 2165func oauth_b64url(inb: *u8, n: i64, out: *u8) -> i64 { 2166 var o: i64 = 0 2167 var i: i64 = 0 2168 while i + 3 <= n { 2169 let x: i64 = ((inb[i] as i64) << 16) | ((inb[i+1] as i64) << 8) | (inb[i+2] as i64) 2170 out[o] = b64url_enc_char((x >> 18) & 63) as u8; o = o + 1 2171 out[o] = b64url_enc_char((x >> 12) & 63) as u8; o = o + 1 2172 out[o] = b64url_enc_char((x >> 6) & 63) as u8; o = o + 1 2173 out[o] = b64url_enc_char(x & 63) as u8; o = o + 1 2174 i = i + 3 2175 } 2176 let rem: i64 = n - i 2177 if rem == 1 { 2178 let x: i64 = (inb[i] as i64) << 16 2179 out[o] = b64url_enc_char((x >> 18) & 63) as u8; o = o + 1 2180 out[o] = b64url_enc_char((x >> 12) & 63) as u8; o = o + 1 2181 } else { if rem == 2 { 2182 let x: i64 = ((inb[i] as i64) << 16) | ((inb[i+1] as i64) << 8) 2183 out[o] = b64url_enc_char((x >> 18) & 63) as u8; o = o + 1 2184 out[o] = b64url_enc_char((x >> 12) & 63) as u8; o = o + 1 2185 out[o] = b64url_enc_char((x >> 6) & 63) as u8; o = o + 1 2186 } } 2187 return o 2188} 2189func oauth_resp(out: *u8, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64 { 2190 var o: i64 = ta_cat(out, 0, "HTTP/1.1 " as *u8) 2191 o = ta_cat(out, o, status) 2192 o = ta_cat(out, o, "\r\nContent-Type: " as *u8) 2193 o = ta_cat(out, o, ctype) 2194 o = ta_cat(out, o, "\r\nCache-Control: no-store\r\nConnection: close\r\nContent-Length: " as *u8) 2195 o = capt_catn(out, o, blen) 2196 o = ta_cat(out, o, "\r\n\r\n" as *u8) 2197 o = ta_catb(out, o, body, blen) 2198 return o 2199} 2200// GET /.well-known/oauth-authorization-server (RFC 8414) 2201func ta_oauth_asmeta(out: *u8) -> i64 { 2202 let body: *u8 = "{\"issuer\":\"https://nishifamily.com\",\"authorization_endpoint\":\"https://nishifamily.com/oauth/authorize\",\"token_endpoint\":\"https://nishifamily.com/oauth/token\",\"registration_endpoint\":\"https://nishifamily.com/oauth/register\",\"response_types_supported\":[\"code\"],\"grant_types_supported\":[\"authorization_code\"],\"code_challenge_methods_supported\":[\"S256\"],\"token_endpoint_auth_methods_supported\":[\"none\"],\"scopes_supported\":[\"nishi_search\",\"nishi_doc\",\"nx_status\",\"nx_health\",\"nx_services\"]}" as *u8 2203 return oauth_resp(out, "200 OK" as *u8, "application/json" as *u8, body, capt_slen(body)) 2204} 2205// POST /oauth/register (RFC 7591 dynamic client registration). body JSON {redirect_uri, client_name}. client_id is a 2206// STATELESS capt-signed token binding the redirect_uri (its nonce = hash(redirect_uri)) -> no client DB. 2207func ta_oauth_register(req: *u8, req_n: i64, out: *u8) -> i64 { 2208 let bo: i64 = ta_body_off(req, req_n) 2209 let body: *u8 = ((req as i64) + bo) as *u8 2210 let bn: i64 = req_n - bo 2211 let slb: *i64 = sys_mmap(16) as *i64 2212 let secret: *u8 = ta_load_cap_secret(slb) 2213 let rb: *i64 = sys_mmap(16) as *i64 2214 if ta_json_str(body, bn, "\"redirect_uri\"" as *u8, rb) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_client_metadata\",\"error_description\":\"redirect_uri required\"}" as *u8) } 2215 let rp: *u8 = ((body as i64) + rb[0]) as *u8 2216 let rl: i64 = rb[1] 2217 let cidtok: *u8 = sys_mmap(TA_MAGIC_2048) 2218 let cidn: i64 = capt_issue(secret, slb[0], "oauth_client" as *u8, 12, TA_MAGIC_9999999999, oauth_strhash(rp, rl), cidtok, TA_MAGIC_2048) 2219 let jb: *u8 = sys_mmap(TA_MAGIC_4096) 2220 var b: i64 = ta_cat(jb, 0, "{\"client_id\":\"" as *u8) 2221 b = ta_catb(jb, b, cidtok, cidn) 2222 b = ta_cat(jb, b, "\",\"token_endpoint_auth_method\":\"none\",\"grant_types\":[\"authorization_code\"],\"response_types\":[\"code\"],\"redirect_uris\":[\"" as *u8) 2223 b = ta_catb(jb, b, rp, rl) 2224 b = ta_cat(jb, b, "\"]}" as *u8) 2225 return oauth_resp(out, "201 Created" as *u8, "application/json" as *u8, jb, b) 2226} 2227// GET /oauth/authorize?response_type=code&client_id&redirect_uri&scope&state&code_challenge&code_challenge_method=S256 2228// -> INTERACTIVE CONSENT page (the human approves the scope). Approve POSTs to /oauth/approve. 2229func ta_oauth_authorize(req: *u8, req_n: i64, out: *u8) -> i64 { 2230 let mo: *i64 = sys_mmap(16) as *i64 2231 let po: *i64 = sys_mmap(16) as *i64 2232 ta_reqline(req, req_n, mo, po) 2233 let full: *u8 = ((req as i64) + po[0]) as *u8 2234 let flen: i64 = po[1] 2235 var qpos: i64 = 0 - 1 2236 var qi: i64 = 0 2237 while qi < flen { if qpos < 0 { if full[qi] == (63 as u8) { qpos = qi } } qi = qi + 1 } 2238 if qpos < 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"missing query\"}" as *u8, 62) } 2239 let query: *u8 = ((full as i64) + qpos + 1) as *u8 2240 let qlen: i64 = flen - qpos - 1 2241 let aslb: *i64 = sys_mmap(16) as *i64 2242 let secret: *u8 = ta_load_cap_secret(aslb) 2243 let cib: *i64 = sys_mmap(16) as *i64 2244 let rib: *i64 = sys_mmap(16) as *i64 2245 let ccb: *i64 = sys_mmap(16) as *i64 2246 let scb: *i64 = sys_mmap(16) as *i64 2247 if oauth_param(query, qlen, "client_id" as *u8, 9, cib) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\"}" as *u8, 27) } 2248 if oauth_param(query, qlen, "redirect_uri" as *u8, 12, rib) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\"}" as *u8, 27) } 2249 if oauth_param(query, qlen, "code_challenge" as *u8, 14, ccb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"PKCE code_challenge required (S256)\"}" as *u8, 82) } 2250 let cip: *u8 = ((query as i64) + cib[0]) as *u8 2251 let rip: *u8 = ((query as i64) + rib[0]) as *u8 2252 let plb: *i64 = sys_mmap(16) as *i64 2253 if capt_mac_ok(secret, aslb[0], cip, cib[1], plb) == 0 { return oauth_resp(out, "401 Unauthorized" as *u8, "application/json" as *u8, "{\"error\":\"invalid_client\"}" as *u8, 26) } 2254 if capt_nonce_of(cip, cib[1]) != oauth_strhash(rip, rib[1]) { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"redirect_uri not registered for this client\"}" as *u8, 90) } 2255 var scp: *u8 = "nishi_search" as *u8 2256 var scl: i64 = 12 2257 if oauth_param(query, qlen, "scope" as *u8, 5, scb) == 1 { scp = ((query as i64) + scb[0]) as *u8; scl = scb[1] } 2258 // consent page: nishi-native, self-contained. Approve form re-submits the exact params to /oauth/approve. 2259 let jb: *u8 = sys_mmap(TA_MAGIC_16384) 2260 var b: i64 = ta_cat(jb, 0, "<html><head><meta charset=utf-8><title>Authorize</title><style>body{font-family:system-ui;max-width:34em;margin:3em auto;padding:0 1em;color:midnightblue}h1{color:seagreen}.s{background:honeydew;border-left:4px solid seagreen;padding:.5em 1em;border-radius:5px;margin:1em 0}button{font-size:1em;padding:.5em 1.4em;border:0;border-radius:6px;cursor:pointer}.a{background:seagreen;color:white}.d{background:gainsboro}</style></head><body><h1>Authorize access</h1><p>An application is requesting a Nishi capability. Review the scope you are granting.</p><div class=s><b>Scope:</b> <code>" as *u8) 2261 b = ta_catb(jb, b, scp, scl) 2262 b = ta_cat(jb, b, "</code></div><form method=post action=/oauth/approve>" as *u8) 2263 b = ta_cat(jb, b, "<input type=hidden name=client_id value=\"" as *u8); b = ta_catb(jb, b, cip, cib[1]); b = ta_cat(jb, b, "\">" as *u8) 2264 b = ta_cat(jb, b, "<input type=hidden name=redirect_uri value=\"" as *u8); b = ta_catb(jb, b, rip, rib[1]); b = ta_cat(jb, b, "\">" as *u8) 2265 b = ta_cat(jb, b, "<input type=hidden name=code_challenge value=\"" as *u8); b = ta_catb(jb, b, ((query as i64) + ccb[0]) as *u8, ccb[1]); b = ta_cat(jb, b, "\">" as *u8) 2266 b = ta_cat(jb, b, "<input type=hidden name=scope value=\"" as *u8); b = ta_catb(jb, b, scp, scl); b = ta_cat(jb, b, "\">" as *u8) 2267 let stb: *i64 = sys_mmap(16) as *i64 2268 if oauth_param(query, qlen, "state" as *u8, 5, stb) == 1 { b = ta_cat(jb, b, "<input type=hidden name=state value=\"" as *u8); b = ta_catb(jb, b, ((query as i64) + stb[0]) as *u8, stb[1]); b = ta_cat(jb, b, "\">" as *u8) } 2269 b = ta_cat(jb, b, "<button class=a type=submit>Approve</button></form><p style=color:slategray>Powered by the Nishi sovereign auth plane -- OPAQUE + object-capability. The issued bearer is an attenuated cap.</p></body></html>" as *u8) 2270 return oauth_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, jb, b) 2271} 2272// POST /oauth/approve (the consent GRANT). Issues a one-time auth code bound to {redirect_uri, code_challenge, scope} 2273// and 302-redirects to redirect_uri?code=..&state=.. 2274func ta_oauth_approve(req: *u8, req_n: i64, out: *u8) -> i64 { 2275 oauth_state_init() 2276 let bo: i64 = ta_body_off(req, req_n) 2277 let body: *u8 = ((req as i64) + bo) as *u8 2278 let bn: i64 = req_n - bo 2279 let pslb: *i64 = sys_mmap(16) as *i64 2280 let secret: *u8 = ta_load_cap_secret(pslb) 2281 let cib: *i64 = sys_mmap(16) as *i64 2282 let rib: *i64 = sys_mmap(16) as *i64 2283 let ccb: *i64 = sys_mmap(16) as *i64 2284 let scb: *i64 = sys_mmap(16) as *i64 2285 if oauth_param(body, bn, "client_id" as *u8, 9, cib) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_request\"}" as *u8) } 2286 if oauth_param(body, bn, "redirect_uri" as *u8, 12, rib) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_request\"}" as *u8) } 2287 if oauth_param(body, bn, "code_challenge" as *u8, 14, ccb) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_request\"}" as *u8) } 2288 let cip: *u8 = ((body as i64) + cib[0]) as *u8 2289 let rip: *u8 = ((body as i64) + rib[0]) as *u8 2290 let plb: *i64 = sys_mmap(16) as *i64 2291 if capt_mac_ok(secret, pslb[0], cip, cib[1], plb) == 0 { return ta_emit_lit(out, "HTTP/1.1 401 Unauthorized" as *u8, "{\"error\":\"invalid_client\"}" as *u8) } 2292 if capt_nonce_of(cip, cib[1]) != oauth_strhash(rip, rib[1]) { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_request\"}" as *u8) } 2293 var scp: *u8 = "nishi_search" as *u8 2294 var scl: i64 = 12 2295 if oauth_param(body, bn, "scope" as *u8, 5, scb) == 1 { scp = ((body as i64) + scb[0]) as *u8; scl = scb[1] } 2296 let ccp: *u8 = ((body as i64) + ccb[0]) as *u8 2297 let ccl: i64 = ccb[1] 2298 let now: i64 = sys_now_realtime_sec() 2299 var cnonce: i64 = (oauth_strhash(ccp, ccl) ^ (now * 131 + 7)) & TA_MAGIC_4294967295 // positive 32-bit -> capt_catn writes it 2300 if cnonce == 0 { cnonce = 1 } 2301 let s: i64 = oauth_slotv(cnonce, OC_SLOTS) 2302 oc_nonce[s] = cnonce 2303 oc_rhash[s] = oauth_strhash(rip, rib[1]) 2304 oc_exp[s] = now + 60 2305 var z: i64 = 0 2306 while z < ccl { if z < 47 { oc_bind[s * 160 + z] = ccp[z] } z = z + 1 } 2307 oc_bind[s * 160 + 47] = 0 as u8 2308 z = 0 2309 while z < scl { if z < 111 { oc_bind[s * 160 + 48 + z] = scp[z] } z = z + 1 } 2310 oc_bind[s * 160 + 48 + scl] = 0 as u8 2311 let code: *u8 = sys_mmap(TA_MAGIC_2048) 2312 let codn: i64 = capt_issue(secret, pslb[0], "oauth_code" as *u8, 10, now + 60, cnonce, code, TA_MAGIC_2048) 2313 // build Location = <decoded redirect_uri>?code=<code>&state=<state> 2314 let loc: *u8 = sys_mmap(TA_MAGIC_4096) 2315 var lo: i64 = oauth_urldec(rip, rib[1], loc) 2316 loc[lo] = 63 as u8; lo = lo + 1 2317 lo = ta_cat(loc, lo, "code=" as *u8) 2318 lo = ta_catb(loc, lo, code, codn) 2319 let stb: *i64 = sys_mmap(16) as *i64 2320 if oauth_param(body, bn, "state" as *u8, 5, stb) == 1 { 2321 lo = ta_cat(loc, lo, "&state=" as *u8) 2322 lo = ta_catb(loc, lo, ((body as i64) + stb[0]) as *u8, stb[1]) 2323 } 2324 var o: i64 = ta_cat(out, 0, "HTTP/1.1 302 Found\r\nLocation: " as *u8) 2325 o = ta_catb(out, o, loc, lo) 2326 o = ta_cat(out, o, "\r\nCache-Control: no-store\r\nConnection: close\r\nContent-Length: 0\r\n\r\n" as *u8) 2327 return o 2328} 2329// POST /oauth/token grant_type=authorization_code&code&redirect_uri&code_verifier -> verify code sig + one-time-use + 2330// redirect binding + PKCE(S256) -> mint a scoped access cap. RFC 6749 s5.1 JSON. 2331func ta_oauth_token(req: *u8, req_n: i64, out: *u8) -> i64 { 2332 oauth_state_init() 2333 let bo: i64 = ta_body_off(req, req_n) 2334 let body: *u8 = ((req as i64) + bo) as *u8 2335 let bn: i64 = req_n - bo 2336 let slb: *i64 = sys_mmap(16) as *i64 2337 let secret: *u8 = ta_load_cap_secret(slb) 2338 let gtb: *i64 = sys_mmap(16) as *i64 2339 let cdb: *i64 = sys_mmap(16) as *i64 2340 let rib: *i64 = sys_mmap(16) as *i64 2341 let cvb: *i64 = sys_mmap(16) as *i64 2342 if oauth_param(body, bn, "grant_type" as *u8, 10, gtb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\"}" as *u8, 27) } 2343 if oauth_param(body, bn, "code" as *u8, 4, cdb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"code required\"}" as *u8, 60) } 2344 if oauth_param(body, bn, "redirect_uri" as *u8, 12, rib) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\"}" as *u8, 27) } 2345 if oauth_param(body, bn, "code_verifier" as *u8, 13, cvb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"PKCE code_verifier required\"}" as *u8, 76) } 2346 let cdp: *u8 = ((body as i64) + cdb[0]) as *u8 2347 let plb: *i64 = sys_mmap(16) as *i64 2348 if capt_mac_ok(secret, slb[0], cdp, cdb[1], plb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"bad code signature\"}" as *u8, 64) } 2349 let cnonce: i64 = capt_nonce_of(cdp, cdb[1]) 2350 let s: i64 = oauth_slotv(cnonce, OC_SLOTS) 2351 let now: i64 = sys_now_realtime_sec() 2352 if oc_nonce[s] != cnonce { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"code unknown/already used\"}" as *u8, 72) } 2353 if now >= oc_exp[s] { oc_nonce[s] = 0; return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"code expired\"}" as *u8, 58) } 2354 let rip: *u8 = ((body as i64) + rib[0]) as *u8 2355 if oc_rhash[s] != oauth_strhash(rip, rib[1]) { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"redirect_uri mismatch\"}" as *u8, 68) } 2356 // PKCE S256: base64url(sha256(code_verifier)) == stored code_challenge 2357 let cvp: *u8 = ((body as i64) + cvb[0]) as *u8 2358 let dg: *u8 = sys_mmap(64) 2359 sha256_digest(cvp, cvb[1], dg) 2360 let calc: *u8 = sys_mmap(128) 2361 let cln: i64 = oauth_b64url(dg, 32, calc) 2362 let chal: *u8 = ((oc_bind as i64) + s * 160) as *u8 2363 var chn: i64 = 0 2364 var cdone: i64 = 0 2365 while cdone == 0 { if chn >= 47 { cdone = 1 } else { if chal[chn] == (0 as u8) { cdone = 1 } else { chn = chn + 1 } } } 2366 var pkok: i64 = 1 2367 if cln != chn { pkok = 0 } 2368 var mi: i64 = 0 2369 while mi < cln { if calc[mi] != chal[mi] { pkok = 0 } mi = mi + 1 } 2370 if pkok == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"PKCE verification failed\"}" as *u8, 70) } 2371 oc_nonce[s] = 0 // ONE-TIME USE: burn the code 2372 let scope: *u8 = ((oc_bind as i64) + s * 160 + 48) as *u8 2373 var scln: i64 = 0 2374 var sdone: i64 = 0 2375 while sdone == 0 { if scln >= 111 { sdone = 1 } else { if scope[scln] == (0 as u8) { sdone = 1 } else { scln = scln + 1 } } } 2376 let atok: *u8 = sys_mmap(TA_MAGIC_2048) 2377 let atn: i64 = capt_issue(secret, slb[0], scope, scln, now + TA_MAGIC_3600, (cnonce ^ TA_MAGIC_88161) & TA_MAGIC_4294967295, atok, TA_MAGIC_2048) 2378 let jb: *u8 = sys_mmap(TA_MAGIC_4096) 2379 var b: i64 = ta_cat(jb, 0, "{\"access_token\":\"" as *u8) 2380 b = ta_catb(jb, b, atok, atn) 2381 b = ta_cat(jb, b, "\",\"token_type\":\"Bearer\",\"expires_in\":3600,\"scope\":\"" as *u8) 2382 b = ta_catb(jb, b, scope, scln) 2383 b = ta_cat(jb, b, "\"}" as *u8) 2384 return oauth_resp(out, "200 OK" as *u8, "application/json" as *u8, jb, b) 2385} 2386 2387func ta_handle_pfx(prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64 { 2388 let mo: *i64 = sys_mmap(16) as *i64 2389 let po: *i64 = sys_mmap(16) as *i64 2390 if ta_reqline(req, req_n, mo, po) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"bad_request_line\"}" as *u8) } 2391 let path: *u8 = ((req as i64) + po[0]) as *u8 2392 var plen: i64 = po[1] 2393 var qi: i64 = 0 2394 var qfound: i64 = 0 - 1 2395 while qi < po[1] { if qfound < 0 { if path[qi] == (63 as u8) { qfound = qi } } qi = qi + 1 } 2396 if qfound >= 0 { plen = qfound } 2397 let mp: *u8 = ((req as i64) + mo[0]) as *u8 2398 let ml: i64 = mo[1] 2399 let is_get: i64 = ta_streq_n(mp, ml, "GET" as *u8) 2400 let is_post: i64 = ta_streq_n(mp, ml, "POST" as *u8) 2401 if ta_streq_n(path, plen, "/api/tools" as *u8) == 1 { if is_get == 1 { return ta_tools(prefix, out) } } 2402 if ta_streq_n(path, plen, "/tools" as *u8) == 1 { if is_get == 1 { return ta_html_tools(out) } } 2403 if ta_streq_n(path, plen, "/mcp" as *u8) == 1 { if is_post == 1 { return ta_mcp(prefix, req, req_n, out) } return ta_cat(out, 0, "HTTP/1.1 405 Method Not Allowed\r\nAllow: POST, OPTIONS\r\nContent-Length: 0\r\nConnection: close\r\n\r\n" as *u8) } 2404 if ta_streq_n(path, plen, "/api/cap/issue" as *u8) == 1 { if is_post == 1 { return ta_cap_issue(req, req_n, out) } } 2405 if ta_streq_n(path, plen, "/api/cap/revoke" as *u8) == 1 { if is_post == 1 { return ta_cap_revoke(req, req_n, out) } } 2406 if ta_streq_n(path, plen, "/api/cap/status" as *u8) == 1 { if is_get == 1 { return ta_cap_status(out) } } 2407 if ta_streq_n(path, plen, "/api/cap/consent-log" as *u8) == 1 { if is_get == 1 { return ta_cap_consent_log(out) } } 2408 if ta_streq_n(path, plen, "/.well-known/oauth-protected-resource" as *u8) == 1 { if is_get == 1 { return ta_oauth_prm(out) } } 2409 if ta_streq_n(path, plen, "/.well-known/oauth-authorization-server" as *u8) == 1 { if is_get == 1 { return ta_oauth_asmeta(out) } } 2410 if ta_streq_n(path, plen, "/oauth/register" as *u8) == 1 { if is_post == 1 { return ta_oauth_register(req, req_n, out) } } 2411 if ta_streq_n(path, plen, "/oauth/authorize" as *u8) == 1 { if is_get == 1 { return ta_oauth_authorize(req, req_n, out) } } 2412 if ta_streq_n(path, plen, "/oauth/approve" as *u8) == 1 { if is_post == 1 { return ta_oauth_approve(req, req_n, out) } } 2413 if ta_streq_n(path, plen, "/oauth/token" as *u8) == 1 { if is_post == 1 { return ta_oauth_token(req, req_n, out) } } 2414 if ta_streq_n(path, plen, "/api" as *u8) == 1 { if is_get == 1 { return ta_index(out) } } 2415 if ta_streq_n(path, plen, "/" as *u8) == 1 { if is_get == 1 { return ta_index(out) } } 2416 return ta_emit_lit(out, "HTTP/1.1 404 Not Found" as *u8, "{\"error\":\"not_found\"}" as *u8) 2417} 2418// production-prefix convenience wrapper (the real registry). 2419func ta_handle(req: *u8, req_n: i64, out: *u8) -> i64 { return ta_handle_pfx(TA_TOOLPFX, req, req_n, out) } 2420 2421func ta_claim_meta(jb:*u8,b:i64,jid:i64,elapsed:i64,published:i64)->i64{ 2422 var p:i64=b 2423 // append top-level evidence object before the final JSON-object delimiter 2424 if p<=0{return p};p=p-1 2425 p=ta_cat(jb,p,",\"job_evidence\":{\"job\":");p=ta_catn(jb,p,jid) 2426 p=ta_cat(jb,p,",\"reservation_elapsed_ms\":");p=ta_catn(jb,p,elapsed) 2427 p=ta_cat(jb,p,",\"publication_verified\":") 2428 if published==1{p=ta_cat(jb,p,"true")}else{p=ta_cat(jb,p,"false")} 2429 return ta_cat(jb,p,"}}") 2430}