nx_tools_api_idem_candidate_t190.nx source

1// nx_tools_api_idem_candidate_t190.nx -- Exposes the nx_tool_registry over HTTP with MCP compatibility and idempotency for tool calls. 2import "nx_jobclaim_lib.nx" 3// nx_tools_api.nx -- R0 of the sovereign AGENT-FACING API: expose the nx_tool_registry over HTTP. 4// TWO surfaces from ONE registry (the ecosystem's capability SSOT), benchmark = MCP, and BEYOND it: 5// GET /api/tools -> {"tools":[{name,description,invoke,status}]} -- SUPERSET: every tool advertises its 6// gate-`status` (proven/not), a provenance field MCP's tools/list has no concept of. 7// POST /mcp -> JSON-RPC 2.0 (initialize + tools/list) -- MCP-COMPATIBLE so ANY MCP client (Claude 8// included) discovers Nishi's tools with zero adapter. 9// PURE FUNCTION ta_handle_pfx(prefix, req, req_n, out) -> out_n (bytes in, bytes out, NO socket) so the gate 10// drives it in-process (nx_tools_api_gate), exactly like ma_handle. Composes nx_tool_registry (data) + nx_tabrec 11// (tr_field, transitive). No new transport -- wired behind the sovereign edge at deploy. license_tier: ORIGINAL 12import "nx_mcp_envelope.nx" 13import "_hdl_build/nx_json_lib.nx" 14import "nx_tool_registry.nx" // tool registry and transitive table records 15import "nx_cap_token.nx" // capt_verify / CAPT_OK -- capability-scoped invocation (R2: the beyond-MCP security exceed) 16import "nx_tool_exec_allow.nx" // tea_run / TEA_OK -- R2 EXECUTION: real tools/call runs a vetted GREEN organ (+ transitive nx_tool_run) 17import "nx_tool_http_backend.nx" // thb_dispatch / THB_OK -- 2nd execution kind: a registered HTTP backend (search/doc) fetched in-process over loopback 18import "sha256.nx" // sha256_digest -- PKCE S256 code-challenge verification (OAuth 2.1 AS) 19import "nx_toolcall_idem_candidate_t190.nx" // ti_classify / ti_record -- params._idem Idempotency-Key on tools/call (DI4, 2026-09-05) 20const TA_MAGIC_65536: i64 = 65536 21// seq1301 (2026-07-30): sync tools/call capture cap. DERIVED: worst-case ta_json_esc expansion is 6x 22// (\uXXXX per control byte), jb response buffer = 1MiB => cap = 160KiB keeps 6x escape at 960KiB < jb. 23// The old 64KiB cap clipped organ stdout SILENTLY (an 80KiB source read came back as exactly 65536 24// bytes, no marker -- nearly shipped a truncated daemon). Truncation is now ALSO flagged in _meta. 25const TA_CAPTURE_CAP: i64 = 163840 26const TA_MAGIC_8192: i64 = 8192 27const TA_MAGIC_1048576: i64 = 1048576 28const TA_MAGIC_9999999999: i64 = 9999999999 29const TA_MAGIC_2048: i64 = 2048 30const TA_MAGIC_4096: i64 = 4096 31const TA_MAGIC_1469598: i64 = 1469598 32const TA_MAGIC_16384: i64 = 16384 33const TA_MAGIC_4294967295: i64 = 4294967295 34const TA_MAGIC_3600: i64 = 3600 35const TA_MAGIC_88161: i64 = 88161 36 37const TA_TOOLPFX: *u8 = "knowledge/toolreg-" as *u8 // production registry prefix (mirrors TOOL_PREFIX) 38const TA_MCP_PAGE: i64 = 64 // MCP tools/list page size (cursor pagination); clients walk nextCursor. 39 // 8 made a ~500-tool roster cost ~63 round-trips per session initialize -- 40 // with any per-request store cost that compounds into minutes (2026-07-30 41 // outage). 64 keeps a page well under the 1MiB response buffer. 42const TA_ALL_LIMIT: i64 = 100000 // /api/tools emits ALL tools (effectively-unbounded page) 43// HMAC secret for capability tokens. WARN: PLACEHOLDER for the gate + first increment -- production MUST source this 44// from the sovereign vault (nx_vault), NEVER a compiled constant (a baked secret is forgeable by anyone reading the binary). 45const TA_CAP_SECRET: *u8 = "nishi-tools-cap-hmac-secret-v1-REPLACE-FROM-VAULT" as *u8 46// PROD secret: raw bytes in this keyfile (relative to the server CWD = the NAS nishihost dir), 0600, provisioned once. 47// Loaded per tools/call; falls back to the constant above ONLY when absent (dev / in-process gates). This retires the 48// baked secret in production while keeping the gates deterministic. 49const TA_CAP_KEYFILE: *u8 = "tools_cap_secret.key" as *u8 50 51// ---- byte helpers (self-contained) ------------------------------------------------------------------ 52func ta_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 53func ta_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i } 54// async-job file landing (rung 24): O_CREAT|O_TRUNC write, full-drain loop. 55// ---- INVOCATION LEDGER (2026-08-04, debt 1785878018) ------------------------------------------ 56// THE DEFECT THIS CLOSES: nx_catalog / nx_wirecensus grade an organ's INVOKED axis from 57// knowledge/status/actlog.jrnl -- but nothing ever wrote a tools/call there. Only organs that 58// self-log, plus harvest ingests, appeared. MEASURED: nx_agreebound_gate, nx_writebench and 59// nx_writebench_gate were each driven over the LIVE /mcp surface (HTTP 200, full output, 60// _meta.exit_code 0) and all three still graded REGISTERED-DARK(S4) "NEVER RUN", while nx_catalog 61// itself had ZERO rows despite many runs. So the banked headline "768 registered / 274 invoked / 62// 183 DARK" was measuring SELF-LOGGING ADOPTION, and an MCP-only tool could never be cleared -- 63// the guard reported a gap that no amount of using the tools could close. 64// ★★★★★A DETECTOR'S COVERAGE IS TWO SETS: WHAT IT MATCHES AND WHERE IT LOOKS. This one looked in a 65// log its own subject never wrote to. The daemon that dispatches the call is the only place that 66// KNOWS a call happened, so the record belongs here. 67// 68// NEVER-BRICK / never-degrade: append-only, best-effort, fail-silent. A missing dir, a full disk or 69// a refused open must NEVER affect the tool result -- logging observes the call, it does not gate 70// it. Row shape matches the existing journal: epoch \t actor \t tool \t verb \t status \t note. 71// (ta_actlog itself is defined below ta_catb/ta_catn, which it uses.) 72 73func ta_job_put(path: *u8, buf: *u8, n: i64) -> i64 { 74 if n < 0 { return 0 - 1 } 75 let fd: i64 = sys_openat_wr(path, 420) 76 if fd < 0 { return fd } 77 var w: i64 = 0 78 while w < n { 79 let r: i64 = sys_write(fd, ((buf as i64) + w) as *u8, n - w) 80 if r != TR_EINTR { 81 if r <= 0 { 82 sys_close(fd) 83 if r < 0 { return r } 84 return 0 - 1 85 } 86 w = w + r 87 } 88 } 89 let closed: i64 = sys_close(fd) 90 if closed < 0 { return closed } 91 return 0 92} 93// Publish the completion marker only after output and marker writes succeed. 94// This orders visible evidence; it does not establish power-loss durability. 95func ta_job_publish(output_path: *u8, output: *u8, output_n: i64, temp_path: *u8, marker: *u8, marker_n: i64, claim_path: *u8) -> i64 { 96 let output_rc: i64 = ta_job_put(output_path, output, output_n) 97 if output_rc != 0 { return output_rc } 98 let marker_rc: i64 = ta_job_put(temp_path, marker, marker_n) 99 if marker_rc != 0 { return marker_rc } 100 return sys_renameat(temp_path, claim_path) 101} 102 103func ta_catb(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n } 104func ta_catn(d: *u8, o: i64, v: i64) -> i64 { 105 // Keep magnitude nonpositive: the signed minimum has no positive counterpart. 106 var m: i64 = v 107 var w: i64 = o 108 if m < 0 { d[w] = 45 as u8; w = w+1 } 109 if m > 0 { m = 0-m } 110 let first: i64 = w 111 if m == 0 { d[w] = 48 as u8; return w+1 } 112 while m < 0 { 113 d[w] = (48-(m%10)) as u8 114 w = w+1 115 m = m/10 116 } 117 var left: i64 = first 118 var right: i64 = w-1 119 while left < right { 120 let digit: u8 = d[left] 121 d[left] = d[right] 122 d[right] = digit 123 left = left+1 124 right = right-1 125 } 126 return w 127} 128// LATENCY TELEMETRY (2026-08-07). This row already recorded WHAT ran and WHETHER it worked, but 129// never HOW LONG -- and the 503 class is entirely a latency problem: the edge closes the window at 130// 15s (NX_SD2_BACKEND_TIMEOUT_S) and the sync lane is budgeted at 14s, so a call that outruns it is 131// a 503 whose work may still have LANDED. The async lane fixes that, but its membership was a hand 132// written list of tools somebody noticed failing -- you cannot route by latency you never measured. 133// dur_ms is TOTAL HANDLER TIME from the moment authority is granted, because that is the quantity 134// the edge window actually applies; exec time alone would understate it. 135// APPENDED at the end of the free-text tail, so tab-splitting readers and key= scanners both keep 136// working unchanged (rule 19). 137// ONE row writer. `extra` is a NUL-terminated suffix of ` key=value` fields appended BEFORE the newline -- 138// ADDITIVE: the seven positional fields are byte-identical, so every existing reader (nx_actlog, 139// nx_toolatency, the harvest beat) parses exactly what it parsed before; a reader that wants the new 140// fields greps them by name. Added 2026-08-23 for the sync-promoted row (job=, reply_ms=; debt 1787505278). 141const TA_LOG_I64_WIDTH: i64 = 20 142const TA_LOG_I64_MAX: i64 = 9223372036854775807 143func ta_log_size_add(a: i64, b: i64) -> i64 { 144 if a < 0 { return 0-1 } 145 if b < 0 { return 0-1 } 146 if a > TA_LOG_I64_MAX-b { return 0-1 } 147 return a+b 148} 149// One append implementation for legacy calls and additive observations; no second store. 150func ta_journal_write_fd(fd: i64, row: *u8, n: i64) -> i64 { 151 if fd < 0 { return 0-1 } 152 if n < 0 { return 0-1 } 153 if (row as i64) <= 0 { return 0-1 } 154 var done: i64 = 0 155 while done < n { 156 let wrote: i64 = sys_write(fd, ((row as i64)+done) as *u8, n-done) 157 if wrote <= 0 { if wrote < 0 { return wrote }; return 0-1 } 158 done = done+wrote 159 } 160 return 0 161} 162func ta_journal_append(path: *u8, row: *u8, n: i64) -> i64 { 163 if n < 0 { return 0-1 } 164 if (row as i64) <= 0 { return 0-1 } 165 var fd: i64 = 0-1 166 if (path as i64) > 0 { fd = sys_openat_append(path, 420) } else { 167 fd = sys_openat_append("knowledge/status/actlog.jrnl" as *u8, 420) 168 if fd < 0 { fd = sys_openat_append("/volume1/homes/elderwesto/nishihost/knowledge/status/actlog.jrnl" as *u8, 420) } 169 } 170 if fd < 0 { return fd } 171 let written: i64 = ta_journal_write_fd(fd, row, n) 172 let closed: i64 = sys_close(fd) 173 if written < 0 { return written } 174 return closed 175} 176func ta_actlog_x_to(path: *u8, tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64, extra: *u8) -> i64 { 177 if tlen < 0 { return 0-1 } 178 if (tool as i64) <= 0 { return 0-1 } 179 if (lane as i64) <= 0 { return 0-1 } 180 if (status as i64) <= 0 { return 0-1 } 181 if (extra as i64) <= 0 { return 0-1 } 182 let literals: *u8 = "\tmcp\t\tcall\t\ttools/call lane= exit= bytes= dur_ms=\n" as *u8 183 var cap: i64 = ta_log_size_add(4*TA_LOG_I64_WIDTH+1, ta_slen(literals)) 184 cap = ta_log_size_add(cap, ta_slen(lane)) 185 cap = ta_log_size_add(cap, ta_slen(status)) 186 cap = ta_log_size_add(cap, ta_slen(extra)) 187 cap = ta_log_size_add(cap, tlen) 188 if cap < 0 { return 0-1 } 189 let ln: *u8 = sys_mmap(cap) 190 if (ln as i64) <= 0 { return 0-1 } 191 var o: i64 = ta_catn(ln, 0, sys_now_realtime_sec()) 192 o = ta_cat(ln, o, "\tmcp\t" as *u8) 193 o = ta_catb(ln, o, tool, tlen) 194 o = ta_cat(ln, o, "\tcall\t" as *u8) 195 o = ta_cat(ln, o, status) 196 o = ta_cat(ln, o, "\ttools/call lane=" as *u8) 197 o = ta_cat(ln, o, lane) 198 o = ta_cat(ln, o, " exit=" as *u8) 199 o = ta_catn(ln, o, ec) 200 o = ta_cat(ln, o, " bytes=" as *u8) 201 o = ta_catn(ln, o, bytes) 202 o = ta_cat(ln, o, " dur_ms=" as *u8) 203 o = ta_catn(ln, o, dur_ms) 204 o = ta_cat(ln, o, extra) 205 o = ta_cat(ln, o, "\n" as *u8) 206 let result: i64 = ta_journal_append(path, ln, o) 207 sys_munmap(ln, cap) 208 return result 209} 210func ta_actlog_x(tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64, extra: *u8) -> i64 { 211 return ta_actlog_x_to(0 as *u8, tool, tlen, lane, status, ec, bytes, dur_ms, extra) 212} 213func ta_actlog(tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64) -> i64 { 214 return ta_actlog_x(tool, tlen, lane, status, ec, bytes, dur_ms, "" as *u8) 215} 216 217func ta_put1(d: *u8, o: i64, a: i64) -> i64 { d[o] = a as u8; return o + 1 } 218func ta_put2(d: *u8, o: i64, a: i64, b: i64) -> i64 { d[o] = a as u8; d[o + 1] = b as u8; return o + 2 } 219func ta_hexd(v: i64) -> i64 { if v < 10 { return 48 + v } return 87 + v } // 0-9 then a-f 220 221// ---- cap-signing secret: ONE resolver (DRY across tools/call + cap issue/revoke + the status probe) ---------- 222// Resolve the HMAC signing secret EXACTLY as the server does everywhere: prefer the vault-provisioned keyfile 223// (production), else fall back to the dev/gate placeholder constant. `keyfile` is explicit so a gate can drive it 224// against a temp path without touching the server CWD; ta_load_cap_secret pins the production TA_CAP_KEYFILE. 225func ta_load_cap_secret_from(keyfile: *u8, outlen: *i64) -> *u8 { 226 let ksz: *i64 = sys_mmap(16) as *i64 227 let kf: *u8 = sys_read_file(keyfile, ksz) 228 if (kf as i64) != 0 { if ksz[0] > 0 { outlen[0] = ksz[0]; return kf } } 229 let pn: i64 = ta_slen(TA_CAP_SECRET) // hoist the call OUT of the array store (nx_cc: call-in-array-store -> corrupt/SEGV) 230 outlen[0] = pn 231 return TA_CAP_SECRET 232} 233// ---- DEGRADED-MODE ANNOUNCE (debt 1787255203, 2026-08-20) --------------------------------------- 234// THE FALLBACK ABOVE IS NOT THE BUG AND MUST NOT BE REMOVED. It is deliberate, declared and 235// load-bearing: five consumers sign with the baked constant, and nx_tools_api_exec_gate REQUIRES the 236// unprovisioned state BY ITS OWN DESIGN -- it asserts insecure_placeholder and REFUSES exit 3 if a real 237// keyfile is present, a never-brick guard added after its fixture replaced the production allowlist for 238// 2h20m. Deleting the fallback would break the capability gate suite and re-arm that incident. 239// THE BUG IS THAT ENTERING THE DEGRADED MODE WAS SILENT AT RUNTIME: no log, no warn, no marker, on the 240// per-tools/call hot path in PRODUCTION, with GET /api/cap/status -- a poll somebody has to remember to 241// make -- as the only witness. The asymmetry is what makes that urgent rather than merely untidy: 242// fail-CLOSED announces itself the instant it happens; fail-OPEN is silent BY CONSTRUCTION, so its only 243// signal is the compensating control -- and on 2026-08-20 that control (the */5 cap-plane probe) was 244// itself down and had been for hours. 245// **** MAKE THE MODE AN EVENT, NOT A STATE SOMEBODY HAS TO GO AND ASK ABOUT. **** 246// 247// WHY A LATCH AND NOT A LINE PER CALL: this sits on the per-tools/call path. A line per verification 248// would flood the journal under load and -- worse -- would make the signal something every reader learns 249// to filter, which is the same silence with extra bytes. The latch makes the steady-state cost ONE 250// INTEGER COMPARE, and emits only on the FIRST resolution in this process and on every genuine 251// TRANSITION in EITHER direction. A recovery is as much an event as a degradation, and a detector that 252// only ever reports the bad half cannot tell you the fault cleared. 253// 254// WHY ITS OWN JOURNAL AND NOT actlog.jrnl: actlog is the INVOCATION LEDGER that nx_catalog grades the 255// INVOKED axis from. Writing config-health rows into it would silently move a measurement plane that 256// other organs publish numbers off. ONE SUBJECT PER ROW, AND THE WRITER OWNS ITS OWN FILE. 257// 258// FAIL-SILENT, ALWAYS, same contract as ta_actlog: a refused open, a full disk or a missing directory 259// must NEVER affect a verification. Announcing OBSERVES the mode, it does not gate it. stderr is written 260// FIRST so the daemon log carries the event even when the journal cannot be opened at all. 261static ta_capmode: *i64 262const TA_CAPMODE_SLOTS: i64 = 16 263const TA_CAPMODE_UNSEEN: i64 = 0 264const TA_CAPMODE_PROV: i64 = 1 265const TA_CAPMODE_PLACE: i64 = 2 266const TA_CAPMODE_MODE: i64 = 420 267const TA_CAPMODE_LINE: i64 = 512 268const TA_CAPMODE_JRNL: *u8 = "knowledge/status/capmode.jrnl" as *u8 269 270func ta_capmode_announce(mode: i64) -> i64 { 271 if (ta_capmode as i64) == 0 { 272 ta_capmode = sys_mmap(TA_CAPMODE_SLOTS) as *i64 273 ta_capmode[0] = TA_CAPMODE_UNSEEN 274 } 275 if ta_capmode[0] == mode { return 0 } 276 let prev: i64 = ta_capmode[0] 277 ta_capmode[0] = mode 278 let ln: *u8 = sys_mmap(TA_CAPMODE_LINE) 279 var o: i64 = ta_catn(ln, 0, sys_now_realtime_sec()) 280 o = ta_cat(ln, o, "\tnx_tools_api\tcap-secret\t" as *u8) 281 if mode == TA_CAPMODE_PLACE { 282 o = ta_cat(ln, o, "DEGRADED\tcapability tokens are being verified with the BAKED PLACEHOLDER constant, which is forgeable by anyone who can read the binary -- provision " as *u8) 283 o = ta_cat(ln, o, TA_CAP_KEYFILE) 284 o = ta_cat(ln, o, " (0600, server CWD) to retire it" as *u8) 285 } else { 286 o = ta_cat(ln, o, "PROVISIONED\tcapability tokens are being verified with the keyfile-sourced secret" as *u8) 287 } 288 o = ta_cat(ln, o, " prev=" as *u8) 289 o = ta_catn(ln, o, prev) 290 o = ta_cat(ln, o, "\n" as *u8) 291 sys_write(2, ln, o) 292 let fd: i64 = sys_openat_append(TA_CAPMODE_JRNL, TA_CAPMODE_MODE) 293 if fd >= 0 { 294 var w: i64 = 0 295 while w < o { 296 let r: i64 = sys_write(fd, ((ln as i64) + w) as *u8, o - w) 297 if r <= 0 { w = o } else { w = w + r } 298 } 299 sys_close(fd) 300 } 301 sys_munmap(ln, TA_CAPMODE_LINE) 302 return 1 303} 304 305// THE PRODUCTION ENTRY POINT, AND THE ONLY ONE THAT ANNOUNCES. ta_load_cap_secret_from stays a PURE 306// resolver so a gate can drive a temp keyfile, and so GET /api/cap/status (which reaches it through 307// ta_cap_provisioned_from) can PROBE the mode without flipping the latch. That separation is what stops 308// the */5 liveness probe from announcing about itself once every five minutes, forever. 309func ta_load_cap_secret(outlen: *i64) -> *u8 { 310 let s: *u8 = ta_load_cap_secret_from(TA_CAP_KEYFILE, outlen) 311 // hoist the const pointer to a local before comparing (nx_cc: touching a CONST directly is the 312 // documented footgun ta_cap_provisioned_from already works around three lines below). 313 let plc: *u8 = TA_CAP_SECRET 314 if (s as i64) == (plc as i64) { ta_capmode_announce(TA_CAPMODE_PLACE) } else { ta_capmode_announce(TA_CAPMODE_PROV) } 315 return s 316} 317 318 319// 1 if a REAL secret is loaded (a non-empty keyfile whose bytes are NOT the forgeable baked placeholder), else 0. 320// Reveals only a boolean config-health fact -- NEVER the secret. Also catches the footgun of a keyfile that literally 321// contains the placeholder string. 322func ta_cap_provisioned_from(keyfile: *u8) -> i64 { 323 let sl: *i64 = sys_mmap(16) as *i64 324 let s: *u8 = ta_load_cap_secret_from(keyfile, sl) 325 let plc: *u8 = TA_CAP_SECRET // hoist the const ptr to a local before indexing (nx_cc: CONST[i] indexing is broken) 326 let pn: i64 = ta_slen(plc) 327 if sl[0] != pn { return 1 } 328 var i: i64 = 0 329 while i < pn { if s[i] != plc[i] { return 1 } i = i + 1 } 330 return 0 331} 332func ta_cap_provisioned() -> i64 { return ta_cap_provisioned_from(TA_CAP_KEYFILE) } 333 334// a[0..an) equals NUL-terminated b ? (exact) -- used for method/path slice compares. 335func ta_streq_n(a: *u8, an: i64, b: *u8) -> i64 { 336 var i: i64 = 0 337 while i < an { if b[i] == (0 as u8) { return 0 } if a[i] != b[i] { return 0 } i = i + 1 } 338 if b[i] != (0 as u8) { return 0 } 339 return 1 340} 341 342// append s[0..n) into d at o as a JSON-safe string body (RFC 8259: escape " \ and control chars). Returns new o. 343// THE defensive boundary: a description carrying a raw '"' would corrupt the JSON otherwise (silent corruption). 344func ta_json_esc(d: *u8, o: i64, s: *u8, n: i64) -> i64 { 345 var i: i64 = 0 346 while i < n { 347 let c: i64 = (s[i] as i64) & 0xff 348 if c == 34 { o = ta_put2(d, o, 92, 34) } 349 else { if c == 92 { o = ta_put2(d, o, 92, 92) } 350 else { if c == 10 { o = ta_put2(d, o, 92, 110) } 351 else { if c == 13 { o = ta_put2(d, o, 92, 114) } 352 else { if c == 9 { o = ta_put2(d, o, 92, 116) } 353 else { if c < 32 { 354 o = ta_put2(d, o, 92, 117); o = ta_put2(d, o, 48, 48) 355 o = ta_put1(d, o, ta_hexd((c >> 4) & 0xf)); o = ta_put1(d, o, ta_hexd(c & 0xf)) 356 } else { o = ta_put1(d, o, c) } } } } } } 357 i = i + 1 358 } 359 return o 360} 361 362// first offset of NUL-term `needle` in hay[0..hn), or -1. 363func ta_indexof(hay: *u8, hn: i64, needle: *u8) -> i64 { 364 let nl: i64 = ta_slen(needle) 365 if nl == 0 { return 0 } 366 var i: i64 = 0 367 while i + nl <= hn { 368 var m: i64 = 1; var j: i64 = 0 369 while j < nl { if hay[i + j] != needle[j] { m = 0 } j = j + 1 } 370 if m == 1 { return i } 371 i = i + 1 372 } 373 return 0 - 1 374} 375 376// ---- HTTP request shredding ------------------------------------------------------------------------- 377// body offset = just past the CRLFCRLF header terminator (req_n if none -> empty body). 378func ta_body_off(req: *u8, req_n: i64) -> i64 { 379 var i: i64 = 0 380 while i + 3 < req_n { 381 if req[i] == (13 as u8) { if req[i + 1] == (10 as u8) { if req[i + 2] == (13 as u8) { if req[i + 3] == (10 as u8) { return i + 4 } } } } 382 i = i + 1 383 } 384 return req_n 385} 386// parse request line "METHOD SP PATH SP VERSION": mo[0/1]=method off/len, po[0/1]=path off/len. 1 ok / 0 malformed. 387func ta_reqline(req: *u8, req_n: i64, mo: *i64, po: *i64) -> i64 { 388 var i: i64 = 0 389 var sp1: i64 = 0 - 1 390 while i < req_n { if sp1 < 0 { if req[i] == (32 as u8) { sp1 = i } } i = i + 1 } 391 if sp1 < 0 { return 0 } 392 mo[0] = 0; mo[1] = sp1 393 let k: i64 = sp1 + 1 394 var sp2: i64 = 0 - 1 395 i = k 396 while i < req_n { if sp2 < 0 { if req[i] == (32 as u8) { sp2 = i } } i = i + 1 } 397 po[0] = k 398 if sp2 < 0 { po[1] = req_n - k } else { po[1] = sp2 - k } 399 return 1 400} 401 402// ---- JSON body field pluck (single-responsibility, fail-closed) ------------------------------------- 403// string VALUE content of "<keyq>":"content" -> out2[0]=off,out2[1]=len; 1 found / 0 absent. keyq includes quotes. 404func ta_json_str(body: *u8, n: i64, keyq: *u8, out2: *i64) -> i64 { 405 let p: i64 = ta_indexof(body, n, keyq) 406 if p < 0 { return 0 } 407 var i: i64 = p + ta_slen(keyq) 408 var q1: i64 = 0 - 1 409 while i < n { if q1 < 0 { if body[i] == (34 as u8) { q1 = i } } i = i + 1 } 410 if q1 < 0 { return 0 } 411 var q2: i64 = 0 - 1 412 i = q1 + 1 413 while i < n { if q2 < 0 { if body[i] == (34 as u8) { q2 = i } } i = i + 1 } 414 if q2 < 0 { return 0 } 415 out2[0] = q1 + 1; out2[1] = q2 - (q1 + 1) 416 return 1 417} 418// RAW value token after "<keyq>": (number OR quoted string, echoed verbatim for JSON-RPC id). 1 found / 0 absent. 419func ta_json_raw(body: *u8, n: i64, keyq: *u8, out2: *i64) -> i64 { 420 let p: i64 = ta_indexof(body, n, keyq) 421 if p < 0 { return 0 } 422 var i: i64 = p + ta_slen(keyq) 423 var col: i64 = 0 - 1 424 while i < n { if col < 0 { if body[i] == (58 as u8) { col = i } } i = i + 1 } 425 if col < 0 { return 0 } 426 var s: i64 = col + 1 427 var go: i64 = 1 428 while go == 1 { if s >= n { go = 0 } else { let c: i64 = body[s] as i64; if c == 32 { s = s + 1 } else { if c == 9 { s = s + 1 } else { go = 0 } } } } 429 var e: i64 = s 430 var go2: i64 = 1 431 while go2 == 1 { 432 if e >= n { go2 = 0 } else { 433 let c: i64 = body[e] as i64 434 if c == 44 { go2 = 0 } else { if c == 125 { go2 = 0 } else { if c == 32 { go2 = 0 } else { if c == 13 { go2 = 0 } else { if c == 10 { go2 = 0 } else { e = e + 1 } } } } } 435 } 436 } 437 out2[0] = s; out2[1] = e - s 438 return 1 439} 440// string-ARRAY value: parse "<keyq>":[ "s0","s1",... ] -> write each element (JSON-unescaped, NUL-terminated) 441// into the bump buffer `scratch` (capacity scap) and store its pointer (as i64) in out[base+k]. Returns the count 442// k (>=0); 0 for an absent or empty array; -1 refuses malformed or over-capacity input. 443// JSON escapes and raw UTF-8 preserve native argv bytes, excluding embedded NUL. 444// Existing field lookup retained; a present argv must be a complete string-only array. 445// Returns -1 on malformed Unicode/JSON, NUL, argument count or scratch overflow. 446// The caller must refuse execution on failure; no partial argv is a successful result. 447func ta_json_str_array(body: *u8, n: i64, keyq: *u8, out: *i64, base: i64, maxn: i64, scratch: *u8, scap: i64) -> i64 { 448 if base < 0 { return 0 - 1 }; if maxn < 0 { return 0 - 1 }; if scap <= 0 { return 0 - 1 } 449 let p: i64 = ta_indexof(body, n, keyq) 450 if p < 0 { return 0 } 451 var i: i64 = jx_skip_ws(body, n, p + ta_slen(keyq)) 452 if i >= n { return 0 - 1 }; if body[i] != (58 as u8) { return 0 - 1 } 453 i = jx_skip_ws(body, n, i + 1) 454 if i >= n { return 0 - 1 }; if body[i] != (91 as u8) { return 0 - 1 } 455 i = jx_skip_ws(body, n, i + 1) 456 if i >= n { return 0 - 1 } 457 if body[i] == (93 as u8) { return 0 } 458 var k: i64 = 0; var w: i64 = 0 459 while i < n { 460 if body[i] != (34 as u8) { return 0 - 1 } 461 if k >= maxn { return 0 - 1 } 462 if w >= scap { return 0 - 1 } 463 let dst: *u8 = ((scratch as i64) + w) as *u8 464 let end: i64 = jx_copy_str_argv(body, n, i + 1, dst, scap - w) 465 if end < 0 { return 0 - 1 } 466 let used: i64 = jx_len(dst) + 1 467 out[base + k] = dst as i64 468 w = w + used; k = k + 1 469 i = jx_skip_ws(body, n, end) 470 if i >= n { return 0 - 1 } 471 if body[i] == (93 as u8) { return k } 472 if body[i] != (44 as u8) { return 0 - 1 } 473 i = jx_skip_ws(body, n, i + 1) 474 // A closing bracket here is a trailing comma, so the next iteration refuses it. 475 } 476 return 0 - 1 477} 478 479// ---- response assembly (all JSON) ------------------------------------------------------------------- 480func ta_emit(out: *u8, status: *u8, body: *u8, body_n: i64) -> i64 { 481 var o: i64 = ta_cat(out, 0, status) 482 o = ta_cat(out, o, "\r\nContent-Type: application/json\r\nConnection: close\r\nContent-Length: " as *u8) 483 o = ta_catn(out, o, body_n) 484 o = ta_cat(out, o, "\r\n\r\n" as *u8) 485 o = ta_catb(out, o, body, body_n) 486 return o 487} 488func ta_emit_lit(out: *u8, status: *u8, lit: *u8) -> i64 { return ta_emit(out, status, lit, ta_slen(lit)) } 489 490// ---- R1 rich MCP tool schemas (data-driven, benchmark = MCP 2025-06-18 tools spec) -------------------- 491// Per-tool title + annotations (readOnly/destructive/idempotent/openWorld safety hints) + outputSchema + the 492// TYPED argv CONTRACT, sourced from a TAB-separated config so vetting a tool's profile is a data edit (rule 11), 493// not a code change. 494// Row: <name>\t<title>\t<ro>\t<destr>\t<idem>\t<openworld>\t<output-desc>[\t<argv-contract>] 495// col8 argv-contract (07-17, the tool-schema SOTA gap): the tool's exact argv grammar (verbs/args), emitted as 496// the inputSchema argv description so an agent reads the CONTRACT from tools/list instead of a generic blurb. 497// Absent col8 -> the generic argv description (back-compat). Conf is read per call = contract edits are LIVE. 498// UNKNOWN tool (no row) -> MCP-safe defaults: NOT read-only, POSSIBLY destructive, NOT idempotent, open-world 499// (so an agent treats an un-annotated tool as the cautious case). '#' comment + blank lines ignored. 500const TA_SCHEMACONF: *u8 = "knowledge/tool_schemas.conf" as *u8 // server CWD-relative (like tool_allowlist.conf) 501// DERIVED argv contracts (nx_toolgrammar), the col8 FALLBACK. Separate file on purpose: tool_schemas.conf 502// is a SHARED, hand-authored registry and a derived value must never overwrite a human's. Precedence is 503// authored col8 > derived grammar > generic placeholder. Read per request, so a re-harvest is LIVE. 504const TA_GRAMMARCONF: *u8 = "knowledge/tool_grammar.conf" as *u8 505// DERIVED MCP safety annotations (nx_toolflags). Applied ONLY to rows whose output-desc marks them 506// registration-synthesized -- i.e. whose quad was the hardcoded constant ma_schema_append_row writes and 507// never a measurement. MEASURED: 694 of 869 tools (79.9%) published that constant as if it were a fact, 508// so a read-only dashboard shipped as destructiveHint=true and agents refused safe reads. 509const TA_FLAGSCONF: *u8 = "knowledge/tool_flags.conf" as *u8 510// Atomic job-id reservation: the same O_CREAT|O_EXCL claim dl_lock (nx_dispatch_lease) uses. Values 511// PROVEN on this host by nx_exclprobe (first=fd3, second=-17 EEXIST) before being shipped here. 512const TA_SYS_OPENAT: i64 = 257 513const TA_AT_FDCWD: i64 = 0 - 100 514const TA_OEXCL: i64 = 193 // O_CREAT(0x40)|O_EXCL(0x80)|O_WRONLY(0x1) 515const TA_CLAIMMODE: i64 = 420 // 0644 516 517func ta_bool_json(v: i64) -> *u8 { if v == 1 { return "true" as *u8 } return "false" as *u8 } 518 519// idx-th TAB-field of line buf[ls,le) -> out2[0]=off,out2[1]=len; 1 if present, 0 if fewer fields. 520func ta_tsv_field(buf: *u8, ls: i64, le: i64, idx: i64, out2: *i64) -> i64 { 521 var fi: i64 = 0 522 var s: i64 = ls 523 var i: i64 = ls 524 while i <= le { 525 var sep: i64 = 0 526 if i == le { sep = 1 } else { if buf[i] == (9 as u8) { sep = 1 } } 527 if sep == 1 { 528 if fi == idx { out2[0] = s; out2[1] = i - s; return 1 } 529 fi = fi + 1 530 s = i + 1 531 } 532 i = i + 1 533 } 534 return 0 535} 536 537// emit ,"title":.. ,"annotations":{..} ,"outputSchema":{..} for `name` from `conf`. Testable (_from); the 538// production wrapper pins TA_SCHEMACONF. Always emits annotations (defaults if no row) so every MCP tool carries 539// safety hints. Appends to body at offset bin; returns the new offset. 540func ta_emit_mcp_schema_from(conf: *u8, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { 541 let szp0: *i64 = sys_mmap(16) as *i64 542 let buf0: *u8 = sys_read_file(conf, szp0) 543 var n0: i64 = 0 544 if (buf0 as i64) != 0 { n0 = szp0[0] } 545 return ta_emit_mcp_schema_buf(buf0, n0, name, nlen, body, bin) 546} 547// Buffer-based core: the schema conf is read ONCE PER REQUEST by the caller, not once per TOOL. 548// At page size 64 a per-tool re-read meant 64 x ~125KB file reads for a single tools/list -- the 549// dominant per-page cost once the toolreg plane was compacted (2026-07-30). 550// DERIVED-grammar lookup: <name>\t<grammar> rows emitted by nx_toolgrammar from each organ's OWN source 551// header. Consulted ONLY when tool_schemas.conf declares no col8, so an AUTHORED contract always wins and 552// a derived one can never overwrite a human's. MEASURED 2026-08-06: 749 of 869 tools (86.2%) had no col8 553// at all and served the generic "positional CLI args" placeholder; the harvest supplies 378 real ones. 554func ta_grammar_lookup(gbuf: *u8, gbn: i64, name: *u8, nlen: i64, out2: *i64) -> i64 { 555 if (gbuf as i64) == 0 { return 0 } 556 var ls: i64 = 0 557 var i: i64 = 0 558 while i <= gbn { 559 var eol: i64 = 0 560 if i == gbn { eol = 1 } else { if gbuf[i] == (10 as u8) { eol = 1 } } 561 if eol == 1 { 562 let le: i64 = i 563 if le > ls { if gbuf[ls] != (35 as u8) { 564 let f0: *i64 = sys_mmap(16) as *i64 565 if ta_tsv_field(gbuf, ls, le, 0, f0) == 1 { 566 if f0[1] == nlen { 567 var m: i64 = 1 568 var c: i64 = 0 569 while c < nlen { if gbuf[f0[0] + c] != name[c] { m = 0 } c = c + 1 } 570 if m == 1 { 571 let ff: *i64 = sys_mmap(16) as *i64 572 if ta_tsv_field(gbuf, ls, le, 1, ff) == 1 { if ff[1] > 0 { out2[0] = ff[0]; out2[1] = ff[1]; return 1 } } 573 return 0 574 } 575 } 576 } 577 } } 578 ls = i + 1 579 } 580 i = i + 1 581 } 582 return 0 583} 584// Does the schema row's output-desc carry the registration-synthesized marker? If so its safety quad is a 585// CONSTANT, not a measurement, and a derived quad may replace it. Any other row is human- or backfill- 586// authored and is left ALONE -- a derived value must never overwrite an authored one. 587func ta_od_has(buf: *u8, od_s: i64, od_l: i64, needle: *u8) -> i64 { 588 let m: i64 = ta_slen(needle) 589 if od_l < m { return 0 } 590 var i: i64 = 0 591 while i + m <= od_l { 592 var j: i64 = 0 593 var hit: i64 = 1 594 while j < m { if buf[od_s + i + j] != needle[j] { hit = 0; j = m } else { j = j + 1 } } 595 if hit == 1 { return 1 } 596 i = i + 1 597 } 598 return 0 599} 600// TWO shapes carry a FABRICATED quad, and both must be overridable: 601// (a) "(registered via /api/tools/register)" -- ma_schema_append_row's hardcoded 0/1/0/1. 602// (b) "auto-derived from source header by nx_schema_backfill" -- that organ's OLD path, whose own 603// header records the evidence: "of the 389 rows this organ has auto-derived, 389 carry the 604// identical quad 0 1 0 1 -- zero exceptions", i.e. it was never looked up either. 605// The organ's NEW path stamps "safety flags STATIC-DERIVED from the source's own syscalls"; that IS a 606// measurement and is left ALONE. Distinguishing (b) from the new path by its own marker is the only 607// honest way to tell a constant from a value that merely looks like one. 608func ta_od_is_regstub(buf: *u8, od_s: i64, od_l: i64) -> i64 { 609 if ta_od_has(buf, od_s, od_l, "safety flags STATIC-DERIVED" as *u8) == 1 { return 0 } 610 if ta_od_has(buf, od_s, od_l, "(registered via /api/tools/register)" as *u8) == 1 { return 1 } 611 if ta_od_has(buf, od_s, od_l, "auto-derived from source header by nx_schema_backfill" as *u8) == 1 { return 1 } 612 return 0 613} 614// <name>\t<ro>\t<destr>\t<idem>\t<open> -> out4[0..3]. 1 found / 0 absent. 615func ta_flags_lookup(fbuf: *u8, fbn: i64, name: *u8, nlen: i64, out4: *i64) -> i64 { 616 if (fbuf as i64) == 0 { return 0 } 617 var ls: i64 = 0 618 var i: i64 = 0 619 while i <= fbn { 620 var eol: i64 = 0 621 if i == fbn { eol = 1 } else { if fbuf[i] == (10 as u8) { eol = 1 } } 622 if eol == 1 { 623 let le: i64 = i 624 if le > ls { if fbuf[ls] != (35 as u8) { 625 let f0: *i64 = sys_mmap(16) as *i64 626 if ta_tsv_field(fbuf, ls, le, 0, f0) == 1 { 627 if f0[1] == nlen { 628 var m: i64 = 1 629 var c: i64 = 0 630 while c < nlen { if fbuf[f0[0] + c] != name[c] { m = 0 } c = c + 1 } 631 if m == 1 { 632 var k: i64 = 0 633 var okall: i64 = 1 634 while k < 4 { 635 if ta_tsv_field(fbuf, ls, le, k + 1, f0) == 1 { 636 if fbuf[f0[0]] == (49 as u8) { out4[k] = 1 } else { out4[k] = 0 } 637 } else { okall = 0 } 638 k = k + 1 639 } 640 return okall 641 } 642 } 643 } 644 } } 645 ls = i + 1 646 } 647 i = i + 1 648 } 649 return 0 650} 651func ta_emit_mcp_schema_buf2(buf: *u8, bufn: i64, gbuf: *u8, gbn: i64, fbuf: *u8, fbn: i64, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { 652 var b: i64 = bin 653 var ro: i64 = 0; var de: i64 = 1; var idp: i64 = 0; var ow: i64 = 1 // MCP-safe defaults for an unknown tool 654 var has_title: i64 = 0; var tt_s: i64 = 0; var tt_l: i64 = 0 655 var has_out: i64 = 0; var od_s: i64 = 0; var od_l: i64 = 0 656 var has_av: i64 = 0; var av_s: i64 = 0; var av_l: i64 = 0 // col8: typed argv contract 657 if (buf as i64) != 0 { 658 let n: i64 = bufn 659 var ls: i64 = 0; var i: i64 = 0; var done: i64 = 0 660 while i <= n { 661 var eol: i64 = 0 662 if i == n { eol = 1 } else { if buf[i] == (10 as u8) { eol = 1 } } 663 if eol == 1 { 664 if done == 0 { 665 let le: i64 = i 666 if le > ls { if buf[ls] != (35 as u8) { 667 let f0: *i64 = sys_mmap(16) as *i64 668 if ta_tsv_field(buf, ls, le, 0, f0) == 1 { 669 if f0[1] == nlen { 670 var m: i64 = 1; var c: i64 = 0 671 while c < nlen { if buf[f0[0] + c] != name[c] { m = 0 } c = c + 1 } 672 if m == 1 { 673 let ff: *i64 = sys_mmap(16) as *i64 674 if ta_tsv_field(buf, ls, le, 1, ff) == 1 { has_title = 1; tt_s = ff[0]; tt_l = ff[1] } 675 if ta_tsv_field(buf, ls, le, 2, ff) == 1 { if buf[ff[0]] == (49 as u8) { ro = 1 } else { ro = 0 } } 676 if ta_tsv_field(buf, ls, le, 3, ff) == 1 { if buf[ff[0]] == (49 as u8) { de = 1 } else { de = 0 } } 677 if ta_tsv_field(buf, ls, le, 4, ff) == 1 { if buf[ff[0]] == (49 as u8) { idp = 1 } else { idp = 0 } } 678 if ta_tsv_field(buf, ls, le, 5, ff) == 1 { if buf[ff[0]] == (49 as u8) { ow = 1 } else { ow = 0 } } 679 if ta_tsv_field(buf, ls, le, 6, ff) == 1 { has_out = 1; od_s = ff[0]; od_l = ff[1] } 680 if ta_tsv_field(buf, ls, le, 7, ff) == 1 { if ff[1] > 0 { has_av = 1; av_s = ff[0]; av_l = ff[1] } } 681 done = 1 682 } 683 } 684 } 685 } } 686 } 687 ls = i + 1 688 } 689 i = i + 1 690 } 691 } 692 // inputSchema: argv array typed by the tool's own contract (col8) when declared; generic otherwise. 693 b = ta_cat(body, b, ",\"inputSchema\":{\"type\":\"object\",\"properties\":{\"argv\":{\"type\":\"array\",\"items\":{\"type\":\"string\"},\"description\":\"" as *u8) 694 if has_av == 1 { 695 b = ta_json_esc(body, b, ((buf as i64) + av_s) as *u8, av_l) 696 } else { 697 var gemit: i64 = 0 698 if gbn > 0 { 699 let g2: *i64 = sys_mmap(16) as *i64 700 if ta_grammar_lookup(gbuf, gbn, name, nlen, g2) == 1 { 701 b = ta_json_esc(body, b, ((gbuf as i64) + g2[0]) as *u8, g2[1]) 702 gemit = 1 703 } 704 } 705 if gemit == 0 { b = ta_cat(body, b, "positional CLI args passed to the organ (argv[1..])" as *u8) } 706 } 707 b = ta_cat(body, b, "\"}}}" as *u8) 708 if has_title == 1 { 709 b = ta_cat(body, b, ",\"title\":\"" as *u8) 710 b = ta_json_esc(body, b, ((buf as i64) + tt_s) as *u8, tt_l) 711 b = ta_cat(body, b, "\"" as *u8) 712 } 713 // A CONSTANT WEARING THE SHAPE OF A MEASUREMENT IS WORSE THAN A BLANK. If this row's flags came from 714 // the register API's hardcoded quad, prefer the DERIVED quad (nx_toolflags: the organ's own syscalls 715 // plus one level of its import closure). Authored and backfill-derived rows are never touched. 716 if fbn > 0 { 717 if has_out == 1 { 718 if ta_od_is_regstub(buf, od_s, od_l) == 1 { 719 let q4: *i64 = sys_mmap(64) as *i64 720 if ta_flags_lookup(fbuf, fbn, name, nlen, q4) == 1 { 721 ro = q4[0] 722 de = q4[1] 723 idp = q4[2] 724 ow = q4[3] 725 } 726 } 727 } 728 } 729 b = ta_cat(body, b, ",\"annotations\":{\"readOnlyHint\":" as *u8) 730 b = ta_cat(body, b, ta_bool_json(ro)) 731 b = ta_cat(body, b, ",\"destructiveHint\":" as *u8) 732 b = ta_cat(body, b, ta_bool_json(de)) 733 b = ta_cat(body, b, ",\"idempotentHint\":" as *u8) 734 b = ta_cat(body, b, ta_bool_json(idp)) 735 b = ta_cat(body, b, ",\"openWorldHint\":" as *u8) 736 b = ta_cat(body, b, ta_bool_json(ow)) 737 b = ta_cat(body, b, "}" as *u8) 738 if has_out == 1 { 739 b = ta_cat(body, b, ",\"outputSchema\":{\"type\":\"object\",\"description\":\"" as *u8) 740 b = ta_json_esc(body, b, ((buf as i64) + od_s) as *u8, od_l) 741 b = ta_cat(body, b, "\"}" as *u8) 742 } 743 return b 744} 745// Back-compat presenter: callers with no grammar buffer (the gate's fixture path) keep the old signature 746// and get exactly the previous behaviour -- the generic argv description. Only the live registry walk in 747// ta_emit_tools passes a real grammar buffer, so gate fixtures stay hermetic. 748func ta_emit_mcp_schema_buf(buf: *u8, bufn: i64, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { 749 return ta_emit_mcp_schema_buf2(buf, bufn, 0 as *u8, 0, 0 as *u8, 0, name, nlen, body, bin) 750} 751func ta_emit_mcp_schema(name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { return ta_emit_mcp_schema_from(TA_SCHEMACONF, name, nlen, body, bin) } 752 753// ---- the registry -> JSON tools array (shared by REST + MCP; mcp=1 emits inputSchema, mcp=0 emits invoke/status) -- 754func ta_emit_field(body: *u8, b: i64, rec: *u8, rl: i64, idx: i64) -> i64 { 755 let f2: *i64 = sys_mmap(16) as *i64 756 if tr_field(rec, 0, rl, idx, f2) == 1 { return ta_json_esc(body, b, ((rec as i64) + f2[0]) as *u8, f2[1]) } 757 return b 758} 759// ---- DISCOVERABILITY: description falls back to the schema title ------------------------------------ 760// MEASURED 2026-08-06 over the live tools/list, all 14 pages: of 869 registered tools, 663 (76.3%) carry 761// "<name> output (registered via /api/tools/register)" as their MCP `description`. That string is a 762// REGISTRATION-TIME PLACEHOLDER, not prose: ma_schema_append_row (nx_mgmt_api.nx) writes the registrant's 763// real one-liner into schema col2 (`title`) and SYNTHESISES col7. `description` is the one field every MCP 764// client -- and every LLM choosing a tool -- actually reads, so the estate published a stub to its most-read 765// surface while the real text sat one column away. 587 of those 663 (88.5%) have a usable title already. 766// The information was never missing; it was MISFILED. Preferring the title here fixes all 663 at read time 767// with no data migration and no destructive write. The writer fix is separate (debt 1786056847). 768// Honest limit: this is a READ-side repair. It does not improve a tool whose title is ALSO absent. 769func ta_desc_is_stub(rec: *u8, rl: i64, name: *u8, nlen: i64) -> i64 { 770 let f2: *i64 = sys_mmap(16) as *i64 771 if tr_field(rec, 0, rl, 1, f2) != 1 { return 0 } 772 let ds: i64 = f2[0] 773 let dl: i64 = f2[1] 774 let sfx: *u8 = " output (" as *u8 775 let sl: i64 = ta_slen(sfx) 776 if dl < nlen + sl { return 0 } 777 var i: i64 = 0 778 while i < nlen { if rec[ds + i] != name[i] { return 0 } i = i + 1 } 779 var j: i64 = 0 780 while j < sl { if rec[ds + nlen + j] != sfx[j] { return 0 } j = j + 1 } 781 return 1 782} 783 784// col1 (title) of `name`'s row in the schema-conf buffer -> out2 = (off,len). 1 found / 0 absent. 785// Same row-scan shape as ta_emit_mcp_schema_buf; '#' comments and blank lines ignored. 786func ta_schema_title_buf(buf: *u8, bufn: i64, name: *u8, nlen: i64, out2: *i64) -> i64 { 787 if (buf as i64) == 0 { return 0 } 788 var ls: i64 = 0 789 var i: i64 = 0 790 while i <= bufn { 791 var eol: i64 = 0 792 if i == bufn { eol = 1 } else { if buf[i] == (10 as u8) { eol = 1 } } 793 if eol == 1 { 794 let le: i64 = i 795 if le > ls { if buf[ls] != (35 as u8) { 796 let f0: *i64 = sys_mmap(16) as *i64 797 if ta_tsv_field(buf, ls, le, 0, f0) == 1 { 798 if f0[1] == nlen { 799 var m: i64 = 1 800 var c: i64 = 0 801 while c < nlen { if buf[f0[0] + c] != name[c] { m = 0 } c = c + 1 } 802 if m == 1 { 803 let ff: *i64 = sys_mmap(16) as *i64 804 if ta_tsv_field(buf, ls, le, 1, ff) == 1 { if ff[1] > 0 { out2[0] = ff[0]; out2[1] = ff[1]; return 1 } } 805 return 0 806 } 807 } 808 } 809 } } 810 ls = i + 1 811 } 812 i = i + 1 813 } 814 return 0 815} 816 817func ta_emit_tools(prefix: *u8, body: *u8, bin: i64, mcp: i64, offset: i64, limit: i64, out_more: *i64) -> i64 { 818 var b: i64 = bin 819 var tidx: i64 = 0 // pagination: index across ALL tools; emit only [offset, offset+limit); flag out_more if beyond 820 // SIZE-TO-NEED. This is the live "what tools exist" surface, and the 64 KiB 821 // ceiling it replaces was already ~1/3 consumed at ~1,072 registered tools. 822 // Past that ceiling reg_index refused with -1, which this function fed into a 823 // pagination walk -- so the tool list would have gone EMPTY, and an empty tool 824 // list is indistinguishable from a healthy registry with nothing in it. 825 let idxbox: *i64 = sys_mmap(16) as *i64 826 let il: i64 = tool_list_pfx(prefix, idxbox) 827 let idxbuf: *u8 = idxbox[0] as *u8 828 var scb: *u8 = 0 as *u8 829 var scn: i64 = 0 830 // Loaded for BOTH surfaces now (was mcp==1 only): the REST tools array needs the schema title as well, 831 // because `description` now falls back to it whenever the registry row carries the registration stub. 832 let sszp: *i64 = sys_mmap(16) as *i64 833 scb = sys_read_file(TA_SCHEMACONF, sszp) 834 if (scb as i64) != 0 { scn = sszp[0] } 835 // read ONCE per request, never once per tool: a per-tool re-read cost 64 x ~125KB on one tools/list page 836 var gcb: *u8 = 0 as *u8 837 var gcn: i64 = 0 838 let gszp: *i64 = sys_mmap(16) as *i64 839 gcb = sys_read_file(TA_GRAMMARCONF, gszp) 840 if (gcb as i64) != 0 { gcn = gszp[0] } 841 var fcb: *u8 = 0 as *u8 842 var fcn: i64 = 0 843 let fszp: *i64 = sys_mmap(16) as *i64 844 fcb = sys_read_file(TA_FLAGSCONF, fszp) 845 if (fcb as i64) != 0 { fcn = fszp[0] } 846 let namez: *u8 = sys_mmap(512) 847 let po: *i64 = sys_mmap(16) as *i64 848 let lo: *i64 = sys_mmap(16) as *i64 849 var ls: i64 = 0 850 var i: i64 = 0 851 var first: i64 = 1 852 while i <= il { 853 var eol: i64 = 0 854 if i == il { eol = 1 } else { if idxbuf[i] == (10 as u8) { eol = 1 } } 855 if eol == 1 { 856 let nl: i64 = i - ls 857 if nl > 0 { 858 var c: i64 = 0 859 while c < nl { namez[c] = idxbuf[ls + c]; c = c + 1 } 860 namez[nl] = 0 as u8 861 if tool_get_pfx(prefix, namez, po, lo) == 1 { 862 if tidx >= offset { if tidx < offset + limit { 863 let rec: *u8 = po[0] as *u8 864 let rl: i64 = lo[0] 865 if first == 0 { b = ta_cat(body, b, "," as *u8) } 866 first = 0 867 b = ta_cat(body, b, "{\"name\":\"" as *u8) 868 b = ta_emit_field(body, b, rec, rl, 0) 869 b = ta_cat(body, b, "\",\"description\":\"" as *u8) 870 // Prefer the schema title when the registry carries the registration-time stub. 871 var demit: i64 = 0 872 if scn > 0 { 873 if ta_desc_is_stub(rec, rl, namez, nl) == 1 { 874 let t2: *i64 = sys_mmap(16) as *i64 875 if ta_schema_title_buf(scb, scn, namez, nl, t2) == 1 { 876 b = ta_json_esc(body, b, ((scb as i64) + t2[0]) as *u8, t2[1]) 877 demit = 1 878 } 879 } 880 } 881 if demit == 0 { b = ta_emit_field(body, b, rec, rl, 1) } 882 if mcp == 1 { 883 b = ta_cat(body, b, "\"" as *u8) 884 b = ta_emit_mcp_schema_buf2(scb, scn, gcb, gcn, fcb, fcn, namez, nl, body, b) // all three confs read once per request above 885 b = ta_cat(body, b, "}" as *u8) 886 } else { 887 b = ta_cat(body, b, "\",\"invoke\":\"" as *u8) 888 b = ta_emit_field(body, b, rec, rl, 2) 889 b = ta_cat(body, b, "\",\"status\":\"" as *u8) 890 b = ta_emit_field(body, b, rec, rl, 3) 891 b = ta_cat(body, b, "\"}" as *u8) 892 } 893 } else { if (out_more as i64) != 0 { out_more[0] = 1 } } } 894 tidx = tidx + 1 895 } 896 } 897 ls = i + 1 898 } 899 i = i + 1 900 } 901 return b 902} 903 904// ---- route handlers --------------------------------------------------------------------------------- 905func ta_index(out: *u8) -> i64 { 906 let body: *u8 = "{\"api\":\"nishi-tools\",\"version\":1,\"surfaces\":{\"rest\":\"GET /api/tools\",\"mcp\":\"POST /mcp (JSON-RPC 2.0: initialize, tools/list)\"},\"beyond_mcp\":\"each tool carries a gate-status MCP tools/list has no field for\"}" as *u8 907 return ta_emit_lit(out, "HTTP/1.1 200 OK" as *u8, body) 908} 909func ta_emit_page(out: *u8, html: *u8, n: i64) -> i64 { 910 var o: i64 = ta_cat(out, 0, "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: " as *u8) 911 o = ta_catn(out, o, n) 912 o = ta_cat(out, o, "\r\n\r\n" as *u8) 913 o = ta_catb(out, o, html, n) 914 return o 915} 916// GET /tools -- a self-contained HUMAN page (NO double-quotes in the HTML so it is a clean NishiLang literal): it 917// fetches /api/tools client-side + renders one card per tool (XSS-escaped). THE login-level UI surface for the 918// capability ([[feedback-tools-must-surface-in-ui]]). 919func ta_html_tools(out: *u8) -> i64 { 920 let h: *u8 = sys_mmap(TA_MAGIC_8192) 921 var o: i64 = 0 922 o = ta_cat(h, o, "<!DOCTYPE html><meta charset=utf-8><meta name=viewport content='width=device-width,initial-scale=1'><title>Nishi Tools</title>" as *u8) 923 o = ta_cat(h, o, "<style>body{font-family:-apple-system,Segoe UI,sans-serif;max-width:900px;margin:4vh auto;padding:0 20px;color:#1c1c1e}h1{font-size:1.4rem;margin-bottom:.2rem}.sub{color:#666;margin:.1rem 0 1.1rem}.card{border:1px solid #e2e2e6;border-radius:10px;padding:12px 16px;margin:12px 0;background:#fbfbfd}.card h3{margin:.1rem 0 .3rem;font-family:ui-monospace,monospace}.inv{font-family:ui-monospace,monospace;font-size:.82rem;color:#555;background:#f2f2f7;padding:6px 8px;border-radius:6px;margin:.4rem 0;overflow-x:auto}.badge{display:inline-block;font-size:.72rem;padding:2px 8px;border-radius:99px;background:#e6f5ec;color:#0a6;font-weight:600}code{font-family:ui-monospace,monospace}.mcp{background:#eef;border:1px solid #dde;border-radius:8px;padding:10px 14px;font-size:.86rem;margin:1rem 0}</style>" as *u8) 924 o = ta_cat(h, o, "<h1>Nishi Tools</h1><p class=sub>Sovereign agent-facing registry &mdash; MCP-compatible + superset.</p><div class=mcp><b>MCP endpoint:</b> <code>POST /mcp</code> (JSON-RPC 2.0: <code>initialize</code>, <code>tools/list</code>) &mdash; any MCP client connects with zero adapter. &nbsp;<b>REST:</b> <code>GET /api/tools</code>. &nbsp;<b>Beyond MCP:</b> every tool carries a gate-<code>status</code>.</div><div id=t>loading&hellip;</div>" as *u8) 925 o = ta_cat(h, o, "<script>function esc(s){return String(s).split('&').join('&amp;').split('<').join('&lt;').split('>').join('&gt;')}fetch('/api/tools').then(function(r){return r.json()}).then(function(j){var a=j.tools||[],b='';for(var i=0;i<a.length;i++){var t=a[i];b+='<div class=card><h3>'+esc(t.name)+' <span class=badge>'+esc(t.status||'')+'</span></h3><div>'+esc(t.description||'')+'</div><div class=inv>'+esc(t.invoke||'')+'</div></div>'}document.getElementById('t').innerHTML=b||'<i>no tools registered</i>'}).catch(function(){document.getElementById('t').innerHTML='<i>failed to load /api/tools</i>'})</script>" as *u8) 926 return ta_emit_page(out, h, o) 927} 928func ta_tools(prefix: *u8, out: *u8) -> i64 { 929 let jb: *u8 = sys_mmap(TA_MAGIC_1048576) 930 var b: i64 = ta_cat(jb, 0, "{\"api\":\"nishi-tools\",\"version\":1,\"tools\":[" as *u8) 931 b = ta_emit_tools(prefix, jb, b, 0, 0, TA_ALL_LIMIT, 0 as *i64) 932 b = ta_cat(jb, b, "]}" as *u8) 933 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 934} 935// extract an HTTP header value into out2 (off,len). `key` includes the trailing colon, e.g. "X-Nishi-Cap:". 936// Searches only the header region (before the CRLFCRLF), trims leading spaces, stops at CR/LF. 1 found / 0 absent. 937func ta_header(req: *u8, req_n: i64, key: *u8, out2: *i64) -> i64 { 938 let hend: i64 = ta_body_off(req, req_n) 939 let p: i64 = ta_indexof(req, hend, key) 940 if p < 0 { return 0 } 941 var vs: i64 = p + ta_slen(key) 942 var go: i64 = 1 943 while go == 1 { if vs < hend { if req[vs] == (0x20 as u8) { vs = vs + 1 } else { go = 0 } } else { go = 0 } } 944 var ve: i64 = vs 945 var go2: i64 = 1 946 while go2 == 1 { if ve < hend { let c: i64 = req[ve] as i64; if c == 13 { go2 = 0 } else { if c == 10 { go2 = 0 } else { ve = ve + 1 } } } else { go2 = 0 } } 947 out2[0] = vs; out2[1] = ve - vs 948 return 1 949} 950 951// ---- ALTERNATE PRESENTER: the capability on the REQUEST-LINE QUERY STRING (?cap=<token>) ------------------ 952// WHY THIS EXISTS (measured 2026-07-30; debt seq1235). An MCP client that does not deliver its configured 953// X-Nishi-Cap header leaves EVERY tools/call denied for a WHOLE SESSION. The deny is indistinguishable from 954// -- this tool does not exist -- so the session falls back to raw ssh/PowerShell and never revisits: that is 955// 5,776 of 13,003 measured tool calls (44pct). Custom request headers are the most commonly dropped part of an 956// HTTP client's config; the URL is the ONE thing every client provably sends, because it is how the request 957// reached us at all. Binding the cap to the URL makes a session-starts-denied state impossible BY CONSTRUCTION 958// instead of by remembering to restart a client so a header re-loads. 959// SAME OBJECT-CAPABILITY, different presenter: the token is still HMAC-verified, expiry-checked, revocation- 960// checked and least-authority below. This changes WHERE the token is read from, never WHETHER it is proven -- 961// exactly the relationship the Authorization: Bearer presenter already has to the native header. 962// PRECEDENCE IS LOWEST ON PURPOSE (see ta_mcp_call): an explicit per-call _cap always wins, so the URL carries 963// the session BASELINE (least authority) and a deliberate escalation still overrides it. 964// Present ONLY a read/least-authority cap this way: URLs are logged by proxies far more readily than headers. 965// Key match is EXACT (len 3 + c,a,p) so a lookalike param like recap= or capx= can never authorize. 966func ta_query_cap(req: *u8, req_n: i64, out2: *i64) -> i64 { 967 let mo: *i64 = sys_mmap(16) as *i64 968 let po: *i64 = sys_mmap(16) as *i64 969 if ta_reqline(req, req_n, mo, po) == 0 { return 0 } 970 let poff: i64 = po[0] 971 let plen: i64 = po[1] 972 var qi: i64 = 0 973 var qs: i64 = 0 - 1 974 while qi < plen { if qs < 0 { if req[poff + qi] == (63 as u8) { qs = qi + 1 } } qi = qi + 1 } 975 if qs < 0 { return 0 } 976 // walk k=v pairs separated by '&'; accept the FIRST pair whose key is exactly cap (len 3). 977 var s: i64 = qs 978 while s < plen { 979 var e: i64 = s 980 var go: i64 = 1 981 while go == 1 { if e >= plen { go = 0 } else { if req[poff + e] == (38 as u8) { go = 0 } else { e = e + 1 } } } 982 var eq: i64 = 0 - 1 983 var k: i64 = s 984 while k < e { if eq < 0 { if req[poff + k] == (61 as u8) { eq = k } } k = k + 1 } 985 if eq - s == 3 { 986 if req[poff + s] == (99 as u8) { if req[poff + s + 1] == (97 as u8) { if req[poff + s + 2] == (112 as u8) { 987 if e - eq - 1 > 0 { out2[0] = poff + eq + 1; out2[1] = e - eq - 1; return 1 } 988 } } } 989 } 990 s = e + 1 991 } 992 return 0 993} 994// Liveness marker for the query-string presenter: returns 1 so a gate can assert the presenter is COMPILED IN 995// rather than merely declared. Asserted by nx_tools_api_gate T14. 996func ta_query_cap_available() -> i64 { 997 return 1 998} 999 1000// R2: capability-scoped tools/call. Requires an X-Nishi-Cap capability token that GRANTS the requested tool (authority- 1001// in-the-token, verified with NO ambient identity -> confused-deputy is structurally impossible, unlike MCP's OAuth 1002// scopes). No capability, or one that doesn't grant this tool, or a forged/expired one -> JSON-RPC -32001. On success: 1003// ---- REVOCATION denylist: kill a leaked capability BEFORE its expiry (completes issue->delegate->verify->REVOKE) ---- 1004const TA_REVOKED_LIST: *u8 = "cap_revoked.list" as *u8 // newline-separated decimal nonces, relative to the server CWD 1005func ta_openat_append(path: *u8) -> i64 { return __syscall(257, AT_FDCWD, path, 0x441, 0x1a4, 0, 0) } // O_WRONLY|O_CREAT|O_APPEND, 0644 1006func ta_nonce_revoked(nonce: i64) -> i64 { 1007 if nonce < 0 { return 0 } 1008 let szp: *i64 = sys_mmap(16) as *i64 1009 let buf: *u8 = sys_read_file(TA_REVOKED_LIST, szp) 1010 if (buf as i64) == 0 { return 0 } 1011 let n: i64 = szp[0] 1012 let dec: *u8 = sys_mmap(32); let dl: i64 = ta_catn(dec, 0, nonce) 1013 var s: i64 = 0; var i: i64 = 0 1014 while i <= n { 1015 var eol: i64 = 0 1016 if i == n { eol = 1 } else { if buf[i] == (0x0a as u8) { eol = 1 } } 1017 if eol == 1 { 1018 if i - s == dl { var m: i64 = 1; var c: i64 = 0; while c < dl { if buf[s + c] != dec[c] { m = 0 } c = c + 1 } if m == 1 { return 1 } } 1019 s = i + 1 1020 } 1021 i = i + 1 1022 } 1023 return 0 1024} 1025func ta_append_revoked(nonce: i64) -> i64 { 1026 let dec: *u8 = sys_mmap(48); var dl: i64 = ta_catn(dec, 0, nonce); dec[dl] = 0x0a as u8; dl = dl + 1 1027 let fd: i64 = ta_openat_append(TA_REVOKED_LIST) 1028 if fd < 0 { return 0 - 1 } 1029 sys_write(fd, dec, dl); sys_close(fd) 1030 return 0 1031} 1032 1033// a SAFE STUB result (increment 1 proves the AUTHORIZATION; real tool execution is a separate guarded surface). Appends 1034// the ",result"/",error" tail to jb and returns the new offset. 1035// seq1293: exact-line membership test (CR-tolerant) for async_only_tools.conf -- substring matching 1036// would let "nx_fs" shadow "nx_fs_write", so lines must match the WHOLE tool name. 1037func ta_name_in_lines(buf: *u8, n: i64, nm: *u8, nl: i64) -> i64 { 1038 var i: i64 = 0 1039 while i < n { 1040 var e: i64 = i 1041 var s: i64 = 1 1042 while s == 1 { if e >= n { s = 0 } else { if buf[e] == (10 as u8) { s = 0 } else { e = e + 1 } } } 1043 var le: i64 = e 1044 if le > i { if buf[le-1] == (13 as u8) { le = le - 1 } } 1045 if le - i == nl { 1046 var j: i64 = 0 1047 var ok: i64 = 1 1048 while j < nl { if buf[i+j] != nm[j] { ok = 0; j = nl } else { j = j + 1 } } 1049 if ok == 1 { return 1 } 1050 } 1051 i = e + 1 1052 } 1053 return 0 1054} 1055// PER-VERB ASYNC ROUTING (2026-08-06). async_only_tools.conf lines may now be EITHER 1056// <tool> -- the whole tool is forced onto the job lane (existing behaviour, unchanged) 1057// <tool> <verb> -- ONLY that verb is forced; every other verb stays synchronous 1058// WHY THE VERB AND NOT THE TOOL. MEASURED 2026-08-06: `nx_debt add` costs ~0.6s CPU but 23-40s WALL 1059// (0.113 user + 0.515 sys of a 40.026s run; later probes 23s and 25s -- variable, so contention, not a 1060// fixed backoff). Every measured value outruns the edge window, so the response is dropped and the row 1061// NEVER LANDS, while the caller sees a 503 and believes the plane is down. Several findings were lost 1062// that way before it was measured. But `nx_debt find` answers in milliseconds: listing the whole tool 1063// would buy the write back by making EVERY READ a two-step poll -- paying for the fix with the common 1064// case, which is the same trade the fabricated-annotation default made. 1065// ★ THE LATENCY IS A PROPERTY OF THE VERB, SO THE ROUTING MUST BE TOO. 1066// Exact whole-line matching is preserved (a substring rule would let "nx_fs" shadow "nx_fs_write"), and 1067// an absent/empty conf is still byte-identical prior behaviour. 1068func ta_async_match(buf: *u8, n: i64, nm: *u8, nl: i64, av: *i64, ac: i64) -> i64 { 1069 if ta_name_in_lines(buf, n, nm, nl) == 1 { return 1 } 1070 if ac < 1 { return 0 } 1071 // av[0] is RESERVED for the resolved ELF path (filled later by tea_run_argv); the caller's first 1072 // argument is av[1]. Reading av[0] here silently matched nothing -- the conf line was correct, the 1073 // binary was correct, and the routing simply never fired. 1074 // ★ AN ARGV WHOSE SLOT 0 IS RESERVED IS NOT THE ARGV YOU ASSUME -- READ THE BUILDER, NOT THE NAME. 1075 let v: *u8 = av[1] as *u8 1076 if (v as i64) == 0 { return 0 } 1077 var vl: i64 = 0 1078 while v[vl] != (0 as u8) { vl = vl + 1 } 1079 if vl == 0 { return 0 } 1080 let want: i64 = nl + 1 + vl 1081 var i: i64 = 0 1082 while i < n { 1083 var e: i64 = i 1084 var s: i64 = 1 1085 while s == 1 { if e >= n { s = 0 } else { if buf[e] == (10 as u8) { s = 0 } else { e = e + 1 } } } 1086 var le: i64 = e 1087 if le > i { if buf[le-1] == (13 as u8) { le = le - 1 } } 1088 if le - i == want { 1089 var ok: i64 = 1 1090 var j: i64 = 0 1091 while j < nl { if buf[i+j] != nm[j] { ok = 0; j = nl } else { j = j + 1 } } 1092 if ok == 1 { if buf[i+nl] != (32 as u8) { ok = 0 } } 1093 if ok == 1 { 1094 var k: i64 = 0 1095 while k < vl { if buf[i+nl+1+k] != v[k] { ok = 0; k = vl } else { k = k + 1 } } 1096 } 1097 if ok == 1 { return 1 } 1098 } 1099 i = e + 1 1100 } 1101 return 0 1102} 1103// ---- DEFERRED PROMOTION BOOKKEEPING (LANE K 2026-08-23, debt 1787505278) -------------------------------- 1104// THE DEFECT: the TR_PROMOTE reply ("JOB-STARTED id=...") was BUILT only after mkdir + claim + fork + wait4 1105// + actlog, and SENT by the serve loop later still. On a saturated array that bookkeeping overshot the 1106// promote decision -- measured lane=sync-promoted dur_ms p50 16410 / p90 26612 / p99 41422 against a 1107// 14000 ms decision inside a 15000 ms edge window, so 574 permil of promoted calls replied AFTER the edge 1108// had already synthesised a 503: the "raw 503 that had actually landed" class every seat hits. 1109// THE FIX is ORDER, not budget (the Envoy rule: announce cheaply BEFORE the expensive work). The reply 1110// needs ONLY the reserved job id, so ta_mcp_call reserves the claim (the id must be real), parks what the 1111// drainer needs in these process-local statics, and RETURNS the reply at once. A caller that OWNS A 1112// SOCKET calls ta_defer_enable() before ta_handle and ta_promote_finish() after the reply bytes are on the 1113// wire; finish forks the drainer, reaps the middle child and writes the actlog row -- the SAME code that 1114// used to run inline, now ONE function (ta_promote_bookkeep) on both paths. A caller that did not opt in 1115// (a pure-bytes gate driving ta_handle) keeps the old inline ordering byte-for-byte: the deferral is a 1116// contract the serve loop signs, never an assumption about the caller. Fork-per-request makes the statics 1117// per-request by construction; the inline (backpressure) path resets ta_pp_pending in finish. 1118static ta_defer_ok: i64 1119static ta_pp_pending: i64 1120static ta_pp_nmp: i64 1121static ta_pp_nml: i64 1122static ta_pp_jid: i64 1123static ta_pp_jpath: i64 1124static ta_pp_jout: i64 1125static ta_pp_jtmp: i64 1126static ta_pp_xout: i64 1127static ta_pp_precap: i64 1128static ta_pp_wrfd: i64 1129static ta_pp_t0: i64 1130static ta_pp_tdecide: i64 1131const TA_REPLY_MS_UNOBSERVED: i64 = 0 - 1 // inline path: the reply has not been written when the row is stamped 1132 1133func ta_defer_enable() -> i64 { ta_defer_ok = 1; return 0 } 1134func ta_promote_pending() -> i64 { return ta_pp_pending } 1135 1136// the drainer + the row, verbatim from the former inline block. reply_ms < 0 = unobserved (inline path). 1137func ta_promote_bookkeep(nmp: *u8, nml: i64, jidp: i64, jpathp: *u8, joutp: *u8, jtmpp: *u8, xout: *u8, precap: i64, wrfd0: i64, t0: i64, reply_ms: i64) -> i64 { 1138 let pcont: i64 = sys_fork() 1139 if pcont == 0 { 1140 var fdc2: i64 = 3 1141 while fdc2 < 256 { if fdc2 != wrfd0 { sys_close(fdc2) } fdc2 = fdc2 + 1 } 1142 nx_setsid() 1143 let cc2: i64 = sys_fork() 1144 if cc2 != 0 { sys_exit(0) } 1145 let tt_capture_begin: i64 = ta_timing_now_us() 1146 let jbuf: *u8 = sys_mmap(TA_MAGIC_1048576) 1147 var jn: i64 = 0 1148 while jn < precap { if jn < TA_MAGIC_1048576 { jbuf[jn] = xout[jn] } jn = jn + 1 } 1149 var drun: i64 = 1 1150 while drun == 1 { 1151 if jn >= TA_MAGIC_1048576 { drun = 0 } else { 1152 let dr: i64 = sys_read(wrfd0, ((jbuf as i64) + jn) as *u8, TA_MAGIC_1048576 - jn) 1153 if dr > 0 { jn = jn + dr } else { drun = 0 } 1154 } 1155 } 1156 let tt_capture_end: i64 = ta_timing_now_us() 1157 if jn >= TA_MAGIC_1048576 { 1158 let tm: *u8 = "\n[NX-JOB CAPTURE-TRUNCATED at 1048576 bytes -- output incomplete]\n" as *u8 1159 var tl: i64 = 0; while tm[tl] != (0 as u8) { tl = tl + 1 } 1160 var cw: i64 = 0; while cw < tl { if jn - tl + cw >= 0 { jbuf[jn - tl + cw] = tm[cw] } cw = cw + 1 } 1161 } 1162 let dbuf2: *u8 = sys_mmap(256) 1163 // exit=PROMOTED-UNREAPED is HONEST: the drainer is the worker's sibling (the request 1164 // child forked both), so it can drain the pipe to EOF but cannot wait4 the worker -- 1165 // init reaps it. A promoted call trades an exit code for an answer that otherwise does 1166 // not exist at all, and the record says which it is rather than fabricating a 0. 1167 var db2: i64 = ta_cat(dbuf2, 0, "state=DONE rc=0 exit=PROMOTED-UNREAPED bytes=" as *u8) 1168 db2 = ta_catn(dbuf2, db2, jn); dbuf2[db2] = 10 as u8; db2 = db2 + 1 1169 let tt_publish_begin: i64 = ta_timing_now_us() 1170 let published: i64 = ta_job_publish(joutp, jbuf, jn, jtmpp, dbuf2, db2, jpathp) 1171 let tt_publish_end: i64 = ta_timing_now_us() 1172 ta_timing_emit(nmp, nml, "sync-promoted", "promoted_capture_return_unreaped", jidp, tt_capture_begin, tt_capture_end, 0-1, jn) 1173 ta_timing_emit(nmp, nml, "sync-promoted", "job_publish_return_unreaped", jidp, tt_publish_begin, tt_publish_end, published, jn) 1174 if published != 0 { 1175 ta_actlog(nmp, nml, "sync-promoted", "evidence-fail", published, jn, sys_now_ms() - t0) 1176 sys_exit(1) 1177 } 1178 sys_exit(0) 1179 return 0 1180 } 1181 if pcont > 0 { let pst: *i64 = sys_mmap(16) as *i64; sys_wait4(pcont, pst, 0) } 1182 sys_close(wrfd0) 1183 // ROW FIELDS (debt 1787505278): bytes= is the REAL captured byte count (it used to carry the job id, 1184 // mislabelled); the id is job=; reply_ms= is decision -> reply-written, the number reply_reserve_ms 1185 // can be ratcheted from. reply_ms=-1 means the row was stamped on the inline path before any reply. 1186 let xb: *u8 = sys_mmap(96) 1187 var xo: i64 = ta_cat(xb, 0, " job=" as *u8) 1188 xo = ta_catn(xb, xo, jidp) 1189 xo = ta_cat(xb, xo, " reply_ms=" as *u8) 1190 xo = ta_catn(xb, xo, reply_ms) 1191 xb[xo] = 0 as u8 1192 ta_actlog_x(nmp, nml, "sync-promoted" as *u8, "started" as *u8, 0, precap, sys_now_ms() - t0, xb) 1193 return 0 1194} 1195 1196// the serve loop's half of the contract: call AFTER the reply bytes are on the wire. Idempotent no-op 1197// when nothing was deferred, so it is safe on every response path (413, fast, RED, promoted). 1198// SEV-9 2026-09-05 (debt frontdoor/unsafe-call-outcome-unknown-receipt-dropped): THE ASYNC JOB LANE GETS THE SAME 1199// CONTRACT THE PROMOTE LANE ABOVE ALREADY HAS. It reserved the job id, wrote the claim, forked the runner -- and then 1200// sys_wait4()ed the middle child and appended the actlog row BEFORE building its JOB-STARTED reply, so on a storming 1201// array that bookkeeping outlived the 15 s edge window, the edge synthesised 503 'Outcome Unknown', and the reserved 1202// id (the only handle to the outcome) was never delivered while the job ran anyway. Measured 2026-09-05: 7 dropped 1203// receipts, 6 landed, one self-anchored insert issued twice ended at one copy by luck. Same fix, same order: reply 1204// FIRST (the id is real the moment the claim is on disk), park pid1/name/id here, drain in ta_async_finish() which the 1205// serve loop calls right after ta_promote_finish(). A caller that did not opt in (a pure-bytes gate) keeps the inline 1206// wait4+actlog byte-for-byte -- the deferral is the serve loop's contract, never an assumption about the caller. 1207static ta_ap_pending: i64 1208static ta_ap_pid: i64 1209static ta_ap_nmp: i64 1210static ta_ap_nml: i64 1211static ta_ap_jid: i64 1212static ta_ap_t0: i64 1213func ta_async_pending() -> i64 { return ta_ap_pending } 1214func ta_async_finish() -> i64 { 1215 if ta_ap_pending != 1 { return 0 } 1216 ta_ap_pending = 0 1217 if ta_ap_pid > 0 { 1218 let jst: *i64 = sys_mmap(16) as *i64 1219 sys_wait4(ta_ap_pid, jst, 0) 1220 } 1221 ta_actlog(ta_ap_nmp as *u8, ta_ap_nml, "async" as *u8, "started" as *u8, 0, ta_ap_jid, sys_now_ms() - ta_ap_t0) 1222 return 1 1223} 1224 1225func ta_promote_finish() -> i64 { 1226 // the async twin drains in ta_async_finish(), called by the serve loop right after this one 1227 if ta_pp_pending != 1 { return 0 } 1228 ta_pp_pending = 0 1229 let reply_ms: i64 = sys_now_ms() - ta_pp_tdecide 1230 ta_promote_bookkeep(ta_pp_nmp as *u8, ta_pp_nml, ta_pp_jid, ta_pp_jpath as *u8, ta_pp_jout as *u8, ta_pp_jtmp as *u8, ta_pp_xout as *u8, ta_pp_precap, ta_pp_wrfd, ta_pp_t0, reply_ms) 1231 return 1 1232} 1233 1234// Process-local observations share actlog.jrnl. Unknown is -1, never a fabricated zero. 1235// These clocks observe server operations, not physical client arrival or first result byte. 1236const TT_UNKNOWN: i64 = 0-1 1237const TT_I64_MAX: i64 = 9223372036854775807 1238const TT_US_PER_SEC: i64 = 1000000 1239const TT_NS_PER_US: i64 = 1000 1240const TT_NS_PER_SEC: i64 = 1000000000 1241const TT_I64_WIDTH: i64 = 20 1242static tt_clock: *i64 1243static tt_tool: *u8 1244static tt_tool_n: i64 1245static tt_read_begin: i64 1246static tt_read_end: i64 1247static tt_handle_begin: i64 1248static tt_handle_end: i64 1249static tt_write_begin: i64 1250static tt_write_end: i64 1251static tt_write_rc: i64 1252static tt_job: i64 1253static tt_reply_kind: *u8 1254static tt_request_pid: i64 1255static tt_context_active: i64 1256static tt_runner_present: i64 1257static tt_runner_begin: i64 1258static tt_runner_end: i64 1259static tt_runner_code: i64 1260static tt_runner_bytes: i64 1261 1262func ta_timing_now_us() -> i64 { 1263 if (tt_clock as i64) <= 0 { tt_clock = sys_mmap(16) as *i64 } 1264 if (tt_clock as i64) <= 0 { return TT_UNKNOWN } 1265 if sys_clock_gettime_mono(tt_clock) != 0 { return TT_UNKNOWN } 1266 let sec: i64 = tt_clock[0] 1267 let nano: i64 = tt_clock[1] 1268 if sec < 0 { return TT_UNKNOWN } 1269 if nano < 0 { return TT_UNKNOWN } 1270 if nano >= TT_NS_PER_SEC { return TT_UNKNOWN } 1271 if sec > (TT_I64_MAX-nano/TT_NS_PER_US)/TT_US_PER_SEC { return TT_UNKNOWN } 1272 return sec*TT_US_PER_SEC+nano/TT_NS_PER_US 1273} 1274func ta_timing_elapsed(begin: i64, end: i64) -> i64 { 1275 if begin < 0 { return TT_UNKNOWN } 1276 if end < begin { return TT_UNKNOWN } 1277 return end-begin 1278} 1279func ta_timing_field_ok(s: *u8, n: i64) -> i64 { 1280 if n < 0 { return 0 } 1281 if (s as i64) <= 0 { return 0 } 1282 var i: i64 = 0 1283 while i < n { if s[i] < (32 as u8) { return 0 } i = i+1 } 1284 return 1 1285} 1286// `path` is the existing journal in production and an isolated caller path in the gate. 1287// No dur_ms token: legacy latency consumers must not count phase rows as extra tool calls. 1288func ta_timing_emit_to(path: *u8, tool: *u8, tlen: i64, lane: *u8, phase: *u8, job: i64, begin: i64, end: i64, code: i64, bytes: i64) -> i64 { 1289 if ta_timing_field_ok(tool, tlen) == 0 { return 0-1 } 1290 if ta_timing_field_ok(lane, ta_slen(lane)) == 0 { return 0-1 } 1291 if ta_timing_field_ok(phase, ta_slen(phase)) == 0 { return 0-1 } 1292 let a: *u8 = "\tmcp\t" as *u8 1293 let b: *u8 = "\tobserve\t" as *u8 1294 let c: *u8 = "\ttools/timing timing_v=1 lane=" as *u8 1295 let d: *u8 = " job=" as *u8 1296 let context: *u8 = " request_pid=" as *u8 1297 let origin: *u8 = " request_begin_us=" as *u8 1298 let e: *u8 = " clock=monotonic_us clock_scope=same_process_tree begin_us=" as *u8 1299 let f: *u8 = " end_us=" as *u8 1300 let g: *u8 = " elapsed_us=" as *u8 1301 let h: *u8 = " code=" as *u8 1302 let k: *u8 = " bytes=" as *u8 1303 let tail: *u8 = " client_first_byte=unobserved result_first_byte=unobserved\n" as *u8 1304 var cap: i64 = ta_log_size_add(9*TT_I64_WIDTH+1, tlen) 1305 cap = ta_log_size_add(cap, ta_slen(lane)) 1306 cap = ta_log_size_add(cap, ta_slen(phase)) 1307 cap = ta_log_size_add(cap, ta_slen(a)) 1308 cap = ta_log_size_add(cap, ta_slen(b)) 1309 cap = ta_log_size_add(cap, ta_slen(c)) 1310 cap = ta_log_size_add(cap, ta_slen(d)) 1311 cap = ta_log_size_add(cap, ta_slen(context)) 1312 cap = ta_log_size_add(cap, ta_slen(origin)) 1313 cap = ta_log_size_add(cap, ta_slen(e)) 1314 cap = ta_log_size_add(cap, ta_slen(f)) 1315 cap = ta_log_size_add(cap, ta_slen(g)) 1316 cap = ta_log_size_add(cap, ta_slen(h)) 1317 cap = ta_log_size_add(cap, ta_slen(k)) 1318 cap = ta_log_size_add(cap, ta_slen(tail)) 1319 if cap < 0 { return 0-1 } 1320 let row: *u8 = sys_mmap(cap) 1321 if (row as i64) <= 0 { return 0-1 } 1322 var n: i64 = ta_catn(row, 0, sys_now_realtime_sec()) 1323 n = ta_cat(row, n, a); n = ta_catb(row, n, tool, tlen) 1324 n = ta_cat(row, n, b); n = ta_cat(row, n, phase) 1325 n = ta_cat(row, n, c); n = ta_cat(row, n, lane) 1326 n = ta_cat(row, n, d); n = ta_catn(row, n, job) 1327 var request_pid: i64 = TT_UNKNOWN 1328 var request_begin: i64 = TT_UNKNOWN 1329 if tt_context_active == 1 { request_begin = tt_read_begin } 1330 if tt_request_pid > 0 { request_pid = tt_request_pid } 1331 n = ta_cat(row, n, context); n = ta_catn(row, n, request_pid) 1332 n = ta_cat(row, n, origin); n = ta_catn(row, n, request_begin) 1333 n = ta_cat(row, n, e); n = ta_catn(row, n, begin) 1334 n = ta_cat(row, n, f); n = ta_catn(row, n, end) 1335 n = ta_cat(row, n, g); n = ta_catn(row, n, ta_timing_elapsed(begin, end)) 1336 n = ta_cat(row, n, h); n = ta_catn(row, n, code) 1337 n = ta_cat(row, n, k); n = ta_catn(row, n, bytes) 1338 n = ta_cat(row, n, tail) 1339 let result: i64 = ta_journal_append(path, row, n) 1340 sys_munmap(row, cap) 1341 return result 1342} 1343func ta_timing_emit(tool: *u8, tlen: i64, lane: *u8, phase: *u8, job: i64, begin: i64, end: i64, code: i64, bytes: i64) -> i64 { 1344 return ta_timing_emit_to(0 as *u8, tool, tlen, lane, phase, job, begin, end, code, bytes) 1345} 1346func ta_timing_begin() -> i64 { 1347 tt_tool = 0 as *u8; tt_tool_n = 0; tt_job = TT_UNKNOWN 1348 tt_request_pid = TT_UNKNOWN; tt_context_active = 1; tt_runner_present = 0 1349 tt_read_begin = ta_timing_now_us(); tt_read_end = TT_UNKNOWN 1350 tt_handle_begin = TT_UNKNOWN; tt_handle_end = TT_UNKNOWN 1351 tt_write_begin = TT_UNKNOWN; tt_write_end = TT_UNKNOWN; tt_write_rc = TT_UNKNOWN 1352 tt_reply_kind = "response_write_return" as *u8 1353 return 0 1354} 1355func ta_timing_bind(tool: *u8, n: i64) -> i64 { tt_tool = tool; tt_tool_n = n; return 0 } 1356func ta_timing_read_done() -> i64 { tt_read_end = ta_timing_now_us(); return 0 } 1357func ta_timing_handle_begin() -> i64 { tt_handle_begin = ta_timing_now_us(); return 0 } 1358func ta_timing_handle_done() -> i64 { tt_handle_end = ta_timing_now_us(); return 0 } 1359func ta_timing_write_begin() -> i64 { tt_write_begin = ta_timing_now_us(); return 0 } 1360func ta_timing_runner(begin: i64, end: i64, code: i64, bytes: i64) -> i64 { 1361 tt_runner_begin = begin; tt_runner_end = end; tt_runner_code = code; tt_runner_bytes = bytes 1362 tt_runner_present = 1; return 0 1363} 1364func ta_timing_reply_prepare(code: i64) -> i64 { 1365 tt_write_end = ta_timing_now_us(); tt_write_rc = code 1366 if ta_pp_pending == 1 { tt_job = ta_pp_jid; tt_reply_kind = "promoted_ack_write_return" as *u8 } 1367 if ta_ap_pending == 1 { tt_job = ta_ap_jid; tt_reply_kind = "async_ack_write_return" as *u8 } 1368 return 0 1369} 1370func ta_timing_reply_log(bytes: i64) -> i64 { 1371 // Run after existing deferred finish functions; tracing cannot delay drainer creation. 1372 if (tt_tool as i64) <= 0 { return 0 } 1373 if tt_tool_n <= 0 { return 0 } 1374 if tt_runner_present == 1 { 1375 var phase: *u8 = "sync_runner_return" as *u8 1376 if tt_runner_code == TR_PROMOTE { phase = "sync_runner_promoted" as *u8 } 1377 ta_timing_emit(tt_tool, tt_tool_n, "sync", phase, tt_job, tt_runner_begin, tt_runner_end, tt_runner_code, tt_runner_bytes) 1378 } 1379 ta_timing_emit(tt_tool, tt_tool_n, "server", "request_read_return", tt_job, tt_read_begin, tt_read_end, 0, TT_UNKNOWN) 1380 ta_timing_emit(tt_tool, tt_tool_n, "server", "handler_response_return", tt_job, tt_handle_begin, tt_handle_end, 0, TT_UNKNOWN) 1381 var accepted: i64 = TT_UNKNOWN 1382 if tt_write_rc == 0 { accepted = bytes } 1383 return ta_timing_emit(tt_tool, tt_tool_n, "server", tt_reply_kind, tt_job, tt_write_begin, tt_write_end, tt_write_rc, accepted) 1384} 1385 1386// DI4 CONTRACT SYMBOL (/compare/dataio, 2026-09-05): the Idempotency-Key presenter for tools/call. params._idem names 1387// the request; ta_mcp_call classifies it through nx_toolcall_idem_lib BEFORE any execution and records or releases 1388// the outcome at every exit. Returns 1 with out2 = {offset, len} into body when a key is present, else 0. 1389func ta_idempotency_key(body: *u8, bn: i64, out2: *i64) -> i64 { return ta_json_str(body, bn, "\"_idem\"" as *u8, out2) } 1390 1391func ta_mcp_call(prefix: *u8, req: *u8, req_n: i64, body: *u8, bn: i64, jb: *u8, bin: i64) -> i64 { 1392 var b: i64 = bin 1393 let nm2: *i64 = sys_mmap(16) as *i64 1394 if ta_json_str(body, bn, "\"name\"" as *u8, nm2) != 1 { 1395 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"missing params.name\"}}" as *u8) 1396 } 1397 let nmp: *u8 = ((body as i64) + nm2[0]) as *u8 1398 let nml: i64 = nm2[1] 1399 // load the cap-signing secret: prefer the vault-provisioned keyfile (production); else the dev/gate constant. 1400 let slb: *i64 = sys_mmap(16) as *i64 1401 let secret: *u8 = ta_load_cap_secret(slb) 1402 let secretlen: i64 = slb[0] 1403 let cap2: *i64 = sys_mmap(16) as *i64 1404 var granted: i64 = 0 - 9 // sentinel: no capability presented 1405 var capp: *u8 = 0 as *u8 1406 var capl: i64 = 0 1407 // ---- PRESENTER SELECTION: ANY-GRANTS (root fix 2026-07-30) ---------------------------------------------- 1408 // WAS a FIRST-PRESENT-WINS chain: if the X-Nishi-Cap header was present AT ALL, params._cap was never read -- 1409 // it sat inside the else. That contradicted the contract this file states in TWO places (ta_query_cap: "an 1410 // explicit per-call _cap always wins"; the deny text below: "params._cap ... per-call override, wins over all 1411 // others") and it made a session whose header carries a least-authority READ cap STRUCTURALLY unable to 1412 // escalate for even one call: the deliberate override was silently ignored and the caller got a -32001 1413 // indistinguishable from -- no such tool -- which is the exact trigger for the measured 44pct ssh/PowerShell 1414 // fallback that the ?cap= presenter was built to kill. Same session-starts-denied lockout, different door. 1415 // NOW: collect every presenter, try them in documented precedence order, and let the FIRST ONE THAT ACTUALLY 1416 // GRANTS THIS TOOL authorize the call. This CANNOT widen authority -- each candidate is still HMAC-verified, 1417 // expiry-checked, revocation-checked and least-authority-checked against THIS tool name -- so choosing WHICH 1418 // proven token authorizes can never grant what no presented token carries. It deletes exactly one state: a 1419 // caller holding a valid, granting capability refused because a weaker one happened to arrive first. 1420 // Slots in precedence order: 0 body params._cap (per-call override) | 1 X-Nishi-Cap | 2 Bearer | 3 ?cap= 1421 let ps: *i64 = sys_mmap(64) as *i64 1422 var pz: i64 = 0 1423 while pz < 8 { ps[pz] = 0; pz = pz + 1 } 1424 let pcb: *i64 = sys_mmap(16) as *i64 1425 if ta_json_str(body, bn, "\"_cap\"" as *u8, pcb) == 1 { ps[0] = (body as i64) + pcb[0]; ps[1] = pcb[1] } 1426 if ta_header(req, req_n, "X-Nishi-Cap:" as *u8, cap2) == 1 { ps[2] = (req as i64) + cap2[0]; ps[3] = cap2[1] } 1427 // OAuth 2.1 interop (R2): a STOCK MCP client presents the cap as `Authorization: Bearer <cap>` (RFC6750 1428 // header method) -- an ALTERNATE PRESENTER for the SAME object-capability, no ambient scope, still 1429 // HMAC-verified below, no confused-deputy. Scheme match is case-insensitive per RFC7235. 1430 if ta_header(req, req_n, "Authorization:" as *u8, cap2) == 1 { 1431 let bav: *u8 = ((req as i64) + cap2[0]) as *u8 1432 let bavl: i64 = cap2[1] 1433 if bavl > 7 { 1434 let pbl: *u8 = "bearer " as *u8 1435 var bj: i64 = 0 1436 var bok: i64 = 1 1437 while bj < 7 { 1438 var bc: i64 = bav[bj] as i64 1439 if bc >= 65 { if bc <= 90 { bc = bc + 32 } } 1440 if bc != (pbl[bj] as i64) { bok = 0 } 1441 bj = bj + 1 1442 } 1443 if bok == 1 { ps[4] = (bav as i64) + 7; ps[5] = bavl - 7 } 1444 } 1445 } 1446 // ?cap=<token> on the request line: the session BASELINE, and the one presenter every HTTP client provably 1447 // sends. Lowest precedence by construction -- see ta_query_cap for why this presenter exists. 1448 if ta_query_cap(req, req_n, cap2) == 1 { ps[6] = (req as i64) + cap2[0]; ps[7] = cap2[1] } 1449 var pk: i64 = 0 1450 while pk < 4 { 1451 let pcp: i64 = ps[pk + pk] 1452 let pcl: i64 = ps[pk + pk + 1] 1453 if pcl > 0 { 1454 // remember that SOMETHING was presented: drives data.presented and WHICH deny text the caller gets 1455 // (no-capability and wrong-capability have OPPOSITE remedies). 1456 if capl <= 0 { capp = pcp as *u8; capl = pcl } 1457 var pg: i64 = capt_verify(secret, secretlen, pcp as *u8, pcl, nmp, nml, sys_now_realtime_sec()) 1458 // revocation: even a valid, unexpired, tool-granting cap is refused if its nonce is on the denylist 1459 // (kill leaked caps). Checked PER PRESENTER so a revoked one cannot mask a live one behind it. 1460 if pg == CAPT_OK { if ta_nonce_revoked(capt_nonce_of(pcp as *u8, pcl)) == 1 { pg = CAPT_DENY_REVOKED } } 1461 if pg == CAPT_OK { capp = pcp as *u8; capl = pcl; granted = CAPT_OK; pk = 4 } 1462 else { if granted == (0 - 9) { granted = pg } } 1463 } 1464 pk = pk + 1 1465 } 1466 if granted == CAPT_OK { 1467 // Handler clock starts the instant authority is granted -- everything after this point is 1468 // time the CALLER is waiting, which is what the edge's window measures. 1469 let ta_t0: i64 = sys_now_ms() 1470 ta_timing_bind(nmp, nml) 1471 // ---- DI4 IDEMPOTENCY KEY (2026-09-05, /compare/dataio ta_idempotency_key): params._idem names the request; 1472 // the first applied outcome is recorded and a retry under the same name is REPLAYED, never re-executed. 1473 // Decided AFTER authority (a replay still needs a granting cap) and BEFORE any execution or dispatch. Every 1474 // outcome point below records (NEW -> applied) or releases (nothing applied); absent key = unchanged path. 1475 let idb: *i64 = sys_mmap(16) as *i64 1476 var idp: *u8 = 0 as *u8 1477 var idl: i64 = 0 1478 if ta_idempotency_key(body, bn, idb) == 1 { idp = ((body as i64) + idb[0]) as *u8; idl = idb[1] } 1479 let idhex: *u8 = sys_mmap(TI_HEX_CH + 8) 1480 let idrow: *u8 = sys_mmap(TI_ROW_CAP) 1481 idhex[0] = 0 as u8 1482 idrow[0] = 0 as u8 1483 let idst: i64 = ti_classify(TI_LEDGER, TI_DIR, idp, idl, idhex, idrow, TI_ROW_CAP, sys_now_realtime_sec()) 1484 if idst == TI_BADKEY { 1485 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"NX-IDEM REFUSED bad-key: params._idem must be 1..200 printable ASCII characters (33..126, no whitespace) -- a key is a token, not a payload. Nothing was executed.\"}],\"isError\":true,\"_meta\":{\"idem\":\"BADKEY\"}}}" as *u8) 1486 return b 1487 } 1488 if idst == TI_INFLIGHT { 1489 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"NX-IDEM IN-FLIGHT key=" as *u8) 1490 b = ta_json_esc(jb, b, idp, idl) 1491 b = ta_cat(jb, b, " -- another call holding this key has reserved it and not yet recorded an outcome (claim age " as *u8) 1492 b = ta_catn(jb, b, ti_claim_age(TI_DIR, idhex, sys_now_realtime_sec())) 1493 b = ta_cat(jb, b, " s). NOT re-executed. Retry with the same key once it records; if the age keeps growing the holder died between reserve and record: adjudicate the artifact and use a new key.\"}],\"isError\":false,\"_meta\":{\"idem\":\"INFLIGHT\"}}}" as *u8) 1494 return b 1495 } 1496 if idst == TI_EVIDENCE_ERROR { 1497 return ta_cat(jb,b,",\"error\":{\"code\":-32000,\"message\":\"idempotency evidence unavailable; request not executed\",\"data\":{\"state\":\"EVIDENCE_UNAVAILABLE\",\"dispatched\":false,\"next\":\"reconcile unreadable, incomplete or missing retained ledger before retry\"}}}") 1498 } 1499 if idst == TI_REPLAY { 1500 let rjid: i64 = ti_row_int(idrow, "job=" as *u8) 1501 if rjid >= 0 { 1502 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"NX-IDEM REPLAY key=" as *u8) 1503 b = ta_json_esc(jb, b, idp, idl) 1504 b = ta_cat(jb, b, " first_outcome=" as *u8) 1505 b = ta_json_esc(jb, b, idrow, ta_slen(idrow)) 1506 b = ta_cat(jb, b, " -- this key was already applied and its job is real: NOT re-executed. Read _jobs/job_<id>.claim then .out for that id exactly as for a JOB-STARTED reply.\"}],\"isError\":false,\"_meta\":{\"job\":" as *u8) 1507 b = ta_catn(jb, b, rjid) 1508 b = ta_cat(jb, b, ",\"state\":\"REPLAY\",\"idem\":\"REPLAY\"}}}" as *u8) 1509 return b 1510 } 1511 let rop: *u8 = sys_mmap(TI_PATH_CAP) 1512 ti_out_path(TI_DIR, idhex, rop) 1513 let rlb: *i64 = sys_mmap(16) as *i64 1514 let rbuf: *u8 = sys_read_file(rop, rlb) 1515 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"" as *u8) 1516 if (rbuf as i64) != 0 { b = ta_json_esc(jb, b, rbuf, rlb[0]) } 1517 b = ta_cat(jb, b, " [NX-IDEM REPLAY key=" as *u8) 1518 b = ta_json_esc(jb, b, idp, idl) 1519 b = ta_cat(jb, b, " first_outcome=" as *u8) 1520 b = ta_json_esc(jb, b, idrow, ta_slen(idrow)) 1521 if (rbuf as i64) == 0 { b = ta_cat(jb, b, " REPLAY-ARTIFACT-GONE: the recorded output file is no longer on disk, the outcome above is the whole record" as *u8) } 1522 b = ta_cat(jb, b, " -- NOT re-executed]\"}],\"isError\":false,\"_meta\":{\"exit_code\":" as *u8) 1523 b = ta_catn(jb, b, ti_row_int(idrow, "exit=" as *u8)) 1524 b = ta_cat(jb, b, ",\"idem\":\"REPLAY\"}}}" as *u8) 1525 return b 1526 } 1527 // ---- R2 EXECUTE: the capability said WHO may call; the execution allowlist (nx_tool_exec_allow) says 1528 // WHICH vetted, gate-GREEN ELF actually runs (defense in depth, fail-closed). Only a GREEN-allowlisted 1529 // tool is forked+captured; anything else is authorized-but-not-runnable. never-brick: name-only, no path, 1530 // no /bin/sh -- a bad/absent row can only refuse. Capture is bounded (64KB) so the escaped result always 1531 // fits the 1MB jb buffer. Args come from params.arguments.argv (parsed just below into a native argv). 1532 let xcap: i64 = TA_CAPTURE_CAP 1533 let xout: *u8 = sys_mmap(xcap) 1534 let xlen: *i64 = sys_mmap(16) as *i64 1535 let xrc: *i64 = sys_mmap(16) as *i64 1536 // R2 ARGS: parse optional params.arguments.argv (JSON string array) into a native argv vector so 1537 // multi-arg organs are callable over MCP. av[0] is reserved for the resolved ELF path (filled by 1538 // tea_run_argv); parsed args land at av[1..]. Absent/empty argv -> av = [path, 0] = argless, i.e. 1539 // byte-for-byte the prior behavior, so already-working no-arg tools are unaffected (back-compat). 1540 let av: *i64 = sys_mmap(TA_MAGIC_8192) as *i64 1541 // ARGV SCRATCH SIZED FROM THE BODY (2026-08-23): the unescaped argv can never exceed the body that 1542 // carried it, so bn + 1 is the exact bound. The former 64 KiB scratch let ta_json_str_array keep "what 1543 // fit": a file content above 65535 bytes arrived as its prefix and nx_fs_write wrote the truncated file 1544 // with an OK receipt -- silent data loss wearing a constant, behind the serve loop's 64 KiB read window. 1545 let sbcap: i64 = bn + 1 1546 let sb: *u8 = sys_mmap(sbcap) 1547 if (av as i64) <= 0 { 1548 if idst == TI_NEW { ti_release(TI_DIR, idhex) } 1549 return ta_cat(jb, b, ",\"error\":{\"code\":-32603,\"message\":\"argv allocation failed; nothing executed\"}}" as *u8) 1550 } 1551 if (sb as i64) <= 0 { 1552 if idst == TI_NEW { ti_release(TI_DIR, idhex) } 1553 return ta_cat(jb, b, ",\"error\":{\"code\":-32603,\"message\":\"argv allocation failed; nothing executed\"}}" as *u8) 1554 } 1555 let ac: i64 = ta_json_str_array(body, bn, "\"argv\"" as *u8, av, 1, 250, sb, sbcap) 1556 if ac < 0 { 1557 if idst == TI_NEW { ti_release(TI_DIR, idhex) } 1558 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"argv must be a complete string array with valid Unicode, no NUL and within argument/output capacity; nothing executed\"}}" as *u8) 1559 } 1560 av[1 + ac] = 0 1561 // ---- HTTP-BACKEND dispatch (data-driven, fail-closed, SSRF-safe): a tool declared in tool_backends.conf 1562 // is an already-running sovereign HTTP service reached IN-PROCESS over loopback -- no shim binary. Tried 1563 // BEFORE fork-exec; THB_NOROUTE (not a backend) falls straight through to the fork-exec path below, 1564 // byte-for-byte unchanged for organ tools (never-brick preserving). 1565 let hbcap: i64 = TA_MAGIC_1048576 1566 let hbout: *u8 = sys_mmap(hbcap) 1567 let hblen: *i64 = sys_mmap(16) as *i64 1568 let hbrc: i64 = thb_dispatch(nmp, nml, av, ac, hbout, hbcap, hblen) 1569 if hbrc == THB_OK { 1570 ta_actlog(nmp, nml, "http" as *u8, "ok" as *u8, 0, hblen[0], sys_now_ms() - ta_t0) 1571 // DI4: a keyed HTTP-backend call records its bytes and outcome so a retry under the same key replays them 1572 if idst == TI_NEW { let hop: *u8 = sys_mmap(TI_PATH_CAP); ti_out_path(TI_DIR, idhex, hop); ta_job_put(hop, hbout, hblen[0]); let hrow: *u8 = sys_mmap(TI_ROW_CAP); let hrl: i64 = ti_row_sync(hrow, TI_ROW_CAP, "http" as *u8, nmp, nml, 0, hblen[0], TI_DIR, idhex); ti_record(TI_LEDGER, idp, idl, hrow, hrl) } 1573 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"" as *u8) 1574 b = ta_json_esc(jb, b, hbout, hblen[0]) 1575 b = ta_cat(jb, b, "\"}],\"isError\":false,\"_meta\":{\"backend\":\"http\",\"bytes\":" as *u8) 1576 b = ta_catn(jb, b, hblen[0]) 1577 b = ta_cat(jb, b, "}}}" as *u8) 1578 return b 1579 } 1580 if hbrc == THB_ERR { 1581 if idst == TI_NEW { ti_release(TI_DIR, idhex) } // DI4: nothing was applied, so the key must be judged afresh 1582 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"tool '" as *u8) 1583 b = ta_json_esc(jb, b, nmp, nml) 1584 b = ta_cat(jb, b, "' HTTP backend is declared but unreachable\"}],\"isError\":true}}" as *u8) 1585 return b 1586 } 1587 // ---- ASYNC JOB LANE (rung 24; eats seq1273, defuses the seq1261 1588 // trigger): a long organ run cannot live inside the synchronous 1589 // response window -- the edge read-timeout drops the response and the 1590 // daemon then dies writing to the dead socket (the crash-loop class). 1591 // "_async":"1" anywhere in the body forks the SAME cap+allowlist-gated 1592 // pinned dispatch DETACHED (double-fork, no zombies): stdout lands in 1593 // _jobs/job_<id>.out, then _jobs/job_<id>.done lands ATOMICALLY 1594 // (tmp+rename, written LAST = the completion marker). The call returns 1595 // the job id IMMEDIATELY; poll with the already-registered nx_fs 1596 // (read _jobs/job_<id>.done then .out) -- no new poll surface. 1597 let asyb: *i64 = sys_mmap(16) as *i64 1598 var isasync: i64 = 0 1599 if ta_json_str(body, bn, "\"_async\"" as *u8, asyb) == 1 { if body[asyb[0]] == (49 as u8) { isasync = 1 } } 1600 // ---- ASYNC-ONLY ENFORCEMENT (seq1293, incident 2026-07-29): the DAEMON owns the envelope, 1601 // so the daemon decides -- a tool listed in async_only_tools.conf (one exact name per line, 1602 // hot-read per call like the cap) is FORCED onto the job lane even when the caller forgot 1603 // _async. The 2026-07-29 outage trigger was exactly a heavy sweep running sync, outrunning 1604 // the edge window, and being retried. Absent/empty conf = byte-identical prior behavior. 1605 if isasync == 0 { 1606 let aosz: *i64 = sys_mmap(16) as *i64 1607 let aob: *u8 = sys_read_file("async_only_tools.conf" as *u8, aosz) 1608 if (aob as i64) != 0 { if aosz[0] > 0 { 1609 if ta_async_match(aob, aosz[0], nmp, nml, av, ac) == 1 { isasync = 1 } 1610 } } 1611 } 1612 // Reserve before execution, including the sync lane that may later promote. 1613 // Budget is the existing edge reply reserve; collisions never imply ownership. 1614 let claim_begin:i64=sys_now_ms() 1615 let claim_budget:i64=tea_reply_reserve_ms() 1616 let claim_info:*i64=sys_mmap(32) as *i64 1617 claim_info[0]=0;claim_info[1]=0;claim_info[2]=0;claim_info[3]=0 1618 let jpath:*u8=sys_mmap(256);let jout2:*u8=sys_mmap(256);let jtmp:*u8=sys_mmap(256) 1619 let claim_line:*u8=sys_mmap(JR_LINE) 1620 var jid:i64=JR_ERR_INVALID 1621 let mkdir_rc:i64=sys_mkdir("_jobs",MODE_0755) 1622 if mkdir_rc==0 || mkdir_rc==JR_ERR_EXIST { 1623 if claim_budget>0 && claim_begin<=JR_ID_MAX-claim_budget { 1624 jid=jr_reserve(JR_JOBS,sys_now_realtime_sec(),claim_begin+claim_budget,jpath,256,claim_line,JR_LINE,claim_info) 1625 } 1626 }else{jid=mkdir_rc} 1627 let claim_elapsed:i64=sys_now_ms()-claim_begin 1628 if jid<=0 { 1629 if idst==TI_NEW{ti_release(TI_DIR,idhex)} 1630 b=ta_cat(jb,b,",\"error\":{\"code\":-32003,\"message\":\"Job reservation failed before execution; inspect filesystem errno or configured reply budget\",\"data\":{\"executed\":false,\"reservation_errno\":") 1631 b=ta_catn(jb,b,jid) 1632 b=ta_cat(jb,b,",\"reserved_unstarted_id\":");b=ta_catn(jb,b,claim_info[0]) 1633 b=ta_cat(jb,b,",\"reservation_elapsed_ms\":");b=ta_catn(jb,b,claim_elapsed) 1634 return ta_cat(jb,b,"}}}") 1635 } 1636 jr_mkpath(jout2,256,JR_JOBS,jid,JR_EXT_OUT) 1637 jr_mkpath(jtmp,256,JR_JOBS,jid,".tmp") 1638 if isasync == 1 { 1639 // DI4: the job id IS the outcome of a keyed async call -- recorded the instant it is reserved, BEFORE the fork 1640 // and before the reply, so a lost reply is replayed with the same id instead of a second execution. 1641 if idst == TI_NEW { let arow: *u8 = sys_mmap(TI_ROW_CAP); let arl: i64 = ti_row_job(arow, TI_ROW_CAP, "async" as *u8, nmp, nml, jid); ti_record(TI_LEDGER, idp, idl, arow, arl) } 1642 let pid1: i64 = sys_fork() 1643 if pid1 == 0 { 1644 // middle child: shed every inherited fd above stderr (listen + 1645 // conn sockets included) so a detached job can never pin the 1646 // daemon's ports; then detach the worker and exit at once. 1647 var fdc: i64 = 3 1648 while fdc < 256 { sys_close(fdc); fdc = fdc + 1 } 1649 // ★LEAVE THE DAEMON'S SESSION AND PROCESS GROUP (seq1611). 1650 // Closing fds and double-forking reparents the worker to init but 1651 // leaves it in the DAEMON'S process group, so any group-directed 1652 // signal -- a supervisor cycling the daemon, a request-child sweep 1653 // -- kills it mid-run. MEASURED: short jobs recorded exit=0 and 1654 // finished, while the multi-minute regen died after its first two 1655 // output lines EVERY time, with an EMPTY exit slot (= terminated by 1656 // a signal, not an exit). A detached job must own its own session, 1657 // exactly as hc_spawn_tapi already does for the daemon itself. 1658 nx_setsid() 1659 let pid2: i64 = sys_fork() 1660 if pid2 != 0 { sys_exit(0) } 1661 // seq1301: job output lands on DISK (no json-escape bound applies) -> full 1MiB capture, 1662 // and a clipped capture is MARKED inside the .out itself so a poller can never mistake 1663 // a truncated result for a complete one. 1664 let jbuf: *u8 = sys_mmap(TA_MAGIC_1048576) 1665 let jlen: *i64 = sys_mmap(16) as *i64 1666 let jrc: *i64 = sys_mmap(16) as *i64 1667 // tmo=0: NO TIMEOUT. A detached job exists precisely to outlive 1668 // the synchronous window; inheriting the 120s request timeout 1669 // killed every multi-minute regen at the 2-minute mark (seq1634). 1670 let tt_exec_begin: i64 = ta_timing_now_us() 1671 let jec: i64 = tea_run_pinned_to(nmp, nml, av, jbuf, TA_MAGIC_1048576, jlen, jrc, 0) 1672 let tt_exec_end: i64 = ta_timing_now_us() 1673 if jlen[0] >= TA_MAGIC_1048576 { 1674 let tm: *u8 = "\n[NX-JOB CAPTURE-TRUNCATED at 1048576 bytes -- output incomplete]\n" as *u8 1675 var tl: i64 = 0 1676 while tm[tl] != (0 as u8) { tl = tl + 1 } 1677 var cw: i64 = 0 1678 while cw < tl { if jlen[0] - tl + cw >= 0 { jbuf[jlen[0] - tl + cw] = tm[cw] } cw = cw + 1 } 1679 } 1680 let dbuf: *u8 = sys_mmap(256) 1681 var db: i64 = ta_cat(dbuf, 0, "state=DONE rc=" as *u8) 1682 db = ta_catn(dbuf, db, jrc[0]) 1683 db = ta_cat(dbuf, db, " exit=" as *u8) 1684 db = ta_catn(dbuf, db, jec) 1685 db = ta_cat(dbuf, db, " bytes=" as *u8) 1686 db = ta_catn(dbuf, db, jlen[0]) 1687 db = ta_cat(dbuf, db, "\n" as *u8) 1688 let tt_publish_begin: i64 = ta_timing_now_us() 1689 let published: i64 = ta_job_publish(jout2, jbuf, jlen[0], jtmp, dbuf, db, jpath) 1690 let tt_publish_end: i64 = ta_timing_now_us() 1691 ta_timing_emit(nmp, nml, "async", "async_runner_return", jid, tt_exec_begin, tt_exec_end, jec, jlen[0]) 1692 ta_timing_emit(nmp, nml, "async", "job_publish_return", jid, tt_publish_begin, tt_publish_end, published, jlen[0]) 1693 if published != 0 { 1694 sys_exit(1) 1695 return 0 1696 } 1697 sys_exit(0) 1698 return 0 1699 } 1700 // SEV-9 2026-09-05: REPLY FIRST. The job id is real (the claim is on disk) and the runner is forked; the 1701 // middle-child reap and the fsync'd actlog row are what outlived the edge window under a storm and cost 1702 // every seat its receipt. Under the serve loop's deferral contract they are parked and drained by 1703 // ta_async_finish() AFTER the JOB-STARTED bytes are on the wire; a caller that did not opt in keeps 1704 // the inline order byte-for-byte. 1705 if ta_defer_ok == 1 { 1706 ta_ap_pid = pid1; ta_ap_nmp = nmp as i64; ta_ap_nml = nml; ta_ap_jid = jid; ta_ap_t0 = ta_t0 1707 ta_ap_pending = 1 1708 } else { 1709 if pid1 > 0 { 1710 let jst: *i64 = sys_mmap(16) as *i64 1711 sys_wait4(pid1, jst, 0) 1712 } 1713 ta_actlog(nmp, nml, "async" as *u8, "started" as *u8, 0, jid, sys_now_ms() - ta_t0) 1714 } 1715 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"JOB-STARTED id=" as *u8) 1716 b = ta_catn(jb, b, jid) 1717 b = ta_cat(jb, b, " tool=" as *u8) 1718 b = ta_json_esc(jb, b, nmp, nml) 1719 b = ta_cat(jb, b, " poll: _jobs/job_<id>.out is the OUTPUT, and _jobs/job_<id>.claim is the TERMINAL MARKER this lane writes atomically (temp+rename) when the job ends: ABSENT = still running; state=DONE rc= exit= bytes= = FINISHED, and bytes=0 there means the tool genuinely produced NOTHING rather than that it is still working. READ .claim BEFORE treating an empty .out as RUNNING -- that ambiguity is how a job that died and a job still thinking became the same observation. .done is never written.\"}],\"isError\":false,\"_meta\":{\"job\":" as *u8) 1720 b = ta_catn(jb, b, jid) 1721 b = ta_cat(jb, b, ",\"state\":\"RUNNING\"}}}" as *u8) 1722 return b 1723 } 1724 // SYNCHRONOUS LANE (root fix 2026-07-30, ws=sev-eater). A client is waiting behind the 1725 // edge's MEASURED 15.02s window, so this call gets the SYNC budget -- not the 120s default 1726 // that tea_run_pinned carries for the async lane. Holding a worker slot past the window 1727 // cannot deliver an answer to anyone; it only starves the bounded 16-worker pool, which is 1728 // exactly how a trickle of hung calls took the whole agent surface down for every seat 1729 // (measured: handler in pipe_wait behind an nx_mgmt_call parked in sk_wait_data, 10 stuck 1730 // handler pairs, 4 of 8 requests 503ing). This is the SYNC half of the seq1611/1634 fix: 1731 // that arc correctly gave the DETACHED lane an unbounded budget; the synchronous lane still 1732 // needed one BOUNDED BY THE CALLER'S PATIENCE. Same primitive, opposite direction. 1733 // PROMOTABLE (2026-08-22). The old sync lane, at its deadline, forked a watchdog that SIGKILLed 1734 // the worker -- DESTROYING THE ANSWER of every call that outran the edge window while the work 1735 // ran on and its side effects landed. Two lies followed: the edge synthesised a 503 (work landed, 1736 // caller told it failed), and -- worse -- this handler emitted isError:false with a -5 exit for a 1737 // KILLED organ (success reported for destroyed work). Now the deadline PROMOTES: tr_run_capture_ 1738 // deadline hands back the LIVE worker + pipe and we adopt it onto the SAME job lane the async path 1739 // uses, so the caller gets a JOB-STARTED handle instead of a 503 and the worker finishes. 1740 // Leak-free BY THE SERVE MODEL: tsv_serve is fork-per-request and the request child exit_group's 1741 // after responding, so the worker and the detached drainer reparent to init, which reaps them. 1742 // The deadline is DERIVED live from edge_window.conf (window - reserve), never a typed literal. 1743 let promsrc: *i64 = sys_mmap(16) as *i64 1744 let promote_at: i64 = tea_sync_promote_ms(promsrc) 1745 let wpid: *i64 = sys_mmap(16) as *i64 1746 let wrfd: *i64 = sys_mmap(16) as *i64 1747 let tt_exec_begin: i64 = ta_timing_now_us() 1748 let ec: i64 = tea_run_pinned_deadline(nmp, nml, av, xout, xcap, xlen, xrc, promote_at, wpid, wrfd) 1749 let tt_exec_end: i64 = ta_timing_now_us() 1750 ta_timing_runner(tt_exec_begin, tt_exec_end, ec, xlen[0]) 1751 // Inline runs finalize their already-owned claim, preserving the same result handle 1752 // used by async/promotion. A publication error cannot relabel executed work unexecuted. 1753 var inline_published:i64=0 1754 if ec!=TR_PROMOTE { 1755 var cn:i64=ta_cat(claim_line,0,"state=DONE rc=");cn=ta_catn(claim_line,cn,xrc[0]) 1756 cn=ta_cat(claim_line,cn," exit=");cn=ta_catn(claim_line,cn,ec) 1757 cn=ta_cat(claim_line,cn," bytes=");cn=ta_catn(claim_line,cn,xlen[0]);claim_line[cn]=10;cn=cn+1 1758 if ta_job_publish(jout2,xout,xlen[0],jtmp,claim_line,cn,jpath)==0{inline_published=1} 1759 } 1760 if xrc[0] == TEA_OK { 1761 if ec == TR_PROMOTE { 1762 let jidp:i64=jid 1763 let jpathp:*u8=jpath 1764 let joutp:*u8=jout2 1765 let jtmpp:*u8=jtmp 1766 let precap: i64 = xlen[0] // bytes captured BEFORE promotion; the drainer prepends them to the tail 1767 // DI4: a keyed sync call that outran the window is now a job -- its id is the outcome, recorded before the reply 1768 if idst == TI_NEW { let prow: *u8 = sys_mmap(TI_ROW_CAP); let prl: i64 = ti_row_job(prow, TI_ROW_CAP, "promote" as *u8, nmp, nml, jidp); ti_record(TI_LEDGER, idp, idl, prow, prl) } 1769 // REPLY FIRST (debt 1787505278). Everything above this line is what the reply NEEDS (a 1770 // reserved, real job id). Everything the drainer needs is parked; the fork/wait4/actlog 1771 // run in ta_promote_finish() AFTER the serve loop has put the JOB-STARTED bytes on the 1772 // wire. A caller that did not sign the contract gets the old inline ordering, unchanged. 1773 let tdecide: i64 = sys_now_ms() 1774 if ta_defer_ok == 1 { 1775 ta_pp_nmp = nmp as i64; ta_pp_nml = nml; ta_pp_jid = jidp 1776 ta_pp_jpath = jpathp as i64; ta_pp_jout = joutp as i64; ta_pp_jtmp = jtmpp as i64 1777 ta_pp_xout = xout as i64; ta_pp_precap = precap; ta_pp_wrfd = wrfd[0] 1778 ta_pp_t0 = ta_t0; ta_pp_tdecide = tdecide 1779 ta_pp_pending = 1 1780 } else { 1781 ta_promote_bookkeep(nmp, nml, jidp, jpathp, joutp, jtmpp, xout, precap, wrfd[0], ta_t0, TA_REPLY_MS_UNOBSERVED) 1782 } 1783 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"JOB-STARTED id=" as *u8) 1784 b = ta_catn(jb, b, jidp) 1785 b = ta_cat(jb, b, " tool=" as *u8) 1786 b = ta_json_esc(jb, b, nmp, nml) 1787 b = ta_cat(jb, b, " -- this sync call outran the edge window and was PROMOTED to the job lane, NOT killed. Completion marker: _jobs/job_<id>.claim (state=CLAIMED -> state=DONE); payload: _jobs/job_<id>.out.\"}],\"isError\":false,\"_meta\":{\"job\":" as *u8) 1788 b = ta_catn(jb, b, jidp) 1789 b = ta_cat(jb, b, ",\"state\":\"RUNNING\",\"promoted\":1,\"budget_ms\":" as *u8) 1790 b = ta_catn(jb, b, promote_at) 1791 b = ta_cat(jb, b, ",\"budget_src\":" as *u8) 1792 if promsrc[0] == TEA_SRC_CONF { b = ta_cat(jb, b, "\"conf\"" as *u8) } else { b = ta_cat(jb, b, "\"default\"" as *u8) } 1793 b = ta_cat(jb, b, "}}}" as *u8) 1794 return b 1795 } 1796 // 2a THE SUCCESS-ENVELOPE HONESTY FIX. ec is the RETURN value (child exit 0..255, or a NEGATIVE 1797 // harness sentinel: -2 pipe, -3 fork, -4 wait, -5 timeout, -6 chdir). The old code branched only 1798 // on xrc[0] (the RESOLVE code, set BEFORE the fork), so a killed/failed run was emitted as 1799 // isError:false with a negative exit_code -- the daemon reporting SUCCESS for work it DESTROYED. 1800 // isError keys on the harness sentinels (ec < 0), NEVER on the organ's own exit: a gate exiting 1801 // 1 for RED is a correct answer, not an error. TR_PROMOTE (-7) is handled above, so it is not here. 1802 if ec < 0 { 1803 ta_actlog(nmp, nml, "sync" as *u8, "harness-fail" as *u8, ec, xlen[0], sys_now_ms() - ta_t0) 1804 if idst == TI_NEW { ti_release(TI_DIR, idhex) } // DI4: the harness failed, nothing is known to have applied -- the key is judged afresh 1805 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"the tool run did not complete inside the daemon (harness code " as *u8) 1806 b = ta_catn(jb, b, ec) 1807 b = ta_cat(jb, b, ": -5 deadline, -2 pipe, -3 fork, -4 wait, -6 chdir). This is NOT the organ exit code and NOT a success -- re-run on the async lane (_async=1) for unbounded work.\"}],\"isError\":true,\"_meta\":{\"harness_code\":" as *u8) 1808 b = ta_catn(jb, b, ec) 1809 b = ta_cat(jb, b, "}}}" as *u8) 1810 return ta_claim_meta(jb,b,jid,claim_elapsed,inline_published,1) 1811 } 1812 ta_actlog(nmp, nml, "sync" as *u8, "ok" as *u8, ec, xlen[0], sys_now_ms() - ta_t0) 1813 // DI4: a keyed sync call keeps its bytes beside the job artifacts and records exit+bytes+path, so a retry under 1814 // the same key answers the same text (the organ's own exit code, RED included, is an outcome -- it is recorded) 1815 if idst == TI_NEW { let sop: *u8 = sys_mmap(TI_PATH_CAP); ti_out_path(TI_DIR, idhex, sop); ta_job_put(sop, xout, xlen[0]); let srow: *u8 = sys_mmap(TI_ROW_CAP); let srl: i64 = ti_row_sync(srow, TI_ROW_CAP, "sync" as *u8, nmp, nml, ec, xlen[0], TI_DIR, idhex); ti_record(TI_LEDGER, idp, idl, srow, srl) } 1816 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"" as *u8) 1817 b = ta_json_esc(jb, b, xout, xlen[0]) 1818 // seq1301 put capture_truncated in _meta -- correct, and it is STILL emitted below. But MCP 1819 // CLIENTS DO NOT SURFACE _meta: they render result.content[].text ONLY. So the one consumer who 1820 // acts on a truncated result never saw the warning, and the sole symptom was ABSENCE of the 1821 // tool's own trailing footer -- a negative signal no caller knows to look for. Say it IN THE 1822 // TEXT, where every client actually reads. Guarded by the same condition, so untruncated output 1823 // stays byte-identical to before (rule 19). No backslash escapes here on purpose. 1824 if xlen[0] >= xcap { 1825 b = ta_cat(jb, b, " [NX-TRUNCATED OUTPUT-IS-PARTIAL capture_cap=" as *u8) 1826 b = ta_catn(jb, b, xcap) 1827 b = ta_cat(jb, b, " -- narrow the query or re-run with _async=1]" as *u8) 1828 } 1829 b = ta_cat(jb, b, "\"}],\"isError\":false,\"_meta\":{\"exit_code\":" as *u8) 1830 b = ta_catn(jb, b, ec) 1831 b = ta_cat(jb, b, ",\"bytes\":" as *u8) 1832 b = ta_catn(jb, b, xlen[0]) 1833 // seq1301: a full capture buffer means the organ's stdout was (or may have been) CLIPPED -- 1834 // silence here is how a truncated source nearly shipped. Say so, machine-readably. 1835 if xlen[0] >= xcap { 1836 b = ta_cat(jb, b, ",\"capture_truncated\":1,\"capture_cap\":" as *u8) 1837 b = ta_catn(jb, b, xcap) 1838 } 1839 b = ta_cat(jb, b, "}}}" as *u8) 1840 return ta_claim_meta(jb,b,jid,claim_elapsed,inline_published,1) 1841 } 1842 if idst == TI_NEW { ti_release(TI_DIR, idhex) } // DI4: nothing ran, so a keyed retry must be judged afresh 1843 // capability-valid but NOT on the GREEN execution allowlist -> clean TOOL-level error (not a protocol 1844 // error). rc magnitude: 0=blocked(present,non-GREEN) 1=not-in-allowlist 2=no-allowlist-file. 1845 b = ta_cat(jb, b, ",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"tool '" as *u8) 1846 b = ta_json_esc(jb, b, nmp, nml) 1847 b = ta_cat(jb, b, "' is capability-authorized but not on the GREEN execution allowlist (rc=" as *u8) 1848 b = ta_catn(jb, b, 0 - xrc[0]) 1849 b = ta_cat(jb, b, ")\"}],\"isError\":true}}" as *u8) 1850 return ta_claim_meta(jb,b,jid,claim_elapsed,inline_published,0) 1851 } 1852 // ACTIONABLE DENY (rule 18: say WHAT happened, WHY it matters, WHAT to do). The old text was a bare 1853 // capability-denied-is-required, which a caller cannot distinguish from -- this tool does not exist -- 1854 // measured as the trigger for the ssh/PowerShell fallback cascade (debt seq1235). The two cases have 1855 // OPPOSITE remedies, so they get OPPOSITE messages, and the presented flag states which one you are in. 1856 b = ta_cat(jb, b, ",\"error\":{\"code\":-32001,\"message\":\"capability denied for tool '" as *u8) 1857 b = ta_json_esc(jb, b, nmp, nml) 1858 if capl <= 0 { 1859 b = ta_cat(jb, b, "': NO capability was presented. This tool EXISTS and is callable -- this is an auth gap, NOT a missing tool, so do NOT fall back to shell/ssh. Present one of: ?cap=<token> on the MCP URL (session baseline, survives clients that drop custom headers), X-Nishi-Cap: <token>, Authorization: Bearer <token>, or params._cap in the call arguments (per-call override, wins over all others). Mint one with the management API POST /api/cap/mint allow=<tool>&confirm=yes with authorized admin credentials; optional days=<lifetime-days> and nonce=<positive-integer>. Signing-key status is GET /api/cap/status on this public tools API origin, not the management API." as *u8) 1860 } else { 1861 b = ta_cat(jb, b, "': the capability you DID present does not grant this tool, or is expired, forged, or revoked. Check its allow-list covers this exact tool name; mint a scoped one with the management API POST /api/cap/mint allow=<tool>&confirm=yes with authorized admin credentials; optional days=<lifetime-days> and nonce=<positive-integer>. Confirm signing-key status with GET /api/cap/status on this public tools API origin, not the management API. The tool itself exists -- do NOT fall back to shell/ssh." as *u8) 1862 } 1863 b = ta_cat(jb, b, "\",\"data\":{\"reason\":" as *u8) 1864 b = ta_catn(jb, b, 0 - granted) 1865 b = ta_cat(jb, b, ",\"presented\":" as *u8) 1866 if capl > 0 { b = ta_cat(jb, b, "1" as *u8) } else { b = ta_cat(jb, b, "0" as *u8) } 1867 b = ta_cat(jb, b, ",\"tool\":\"" as *u8) 1868 b = ta_json_esc(jb, b, nmp, nml) 1869 b = ta_cat(jb, b, "\",\"presenters\":[\"query:?cap=\",\"header:X-Nishi-Cap\",\"header:Authorization Bearer\",\"body:params._cap\"]" as *u8) 1870 b = ta_cat(jb, b, "}}}" as *u8) 1871 return b 1872} 1873 1874// R3: MCP resources/read -- serve READABLE content (not tool execution). Two resources: the LIVE ecosystem maturity 1875// grade (forks the allowlisted rollup, escapes its output) and the operating doctrine (embedded). Public read-only 1876// (non-sensitive, no side effects); resource not found -> -32002. Composes with the nx_ecosystem_maturity_rollup tool. 1877func ta_mcp_resread(body: *u8, bn: i64, jb: *u8, b0: i64) -> i64 { 1878 var b: i64 = b0 1879 let u2: *i64 = sys_mmap(16) as *i64 1880 if ta_json_str(body, bn, "\"uri\"" as *u8, u2) == 0 { 1881 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"resources/read requires params.uri\"}}" as *u8) 1882 } 1883 let up: *u8 = ((body as i64) + u2[0]) as *u8 1884 let ul: i64 = u2[1] 1885 if ta_indexof(up, ul, "ecosystem-maturity" as *u8) >= 0 { 1886 let xcap: i64 = TA_MAGIC_65536 1887 let xout: *u8 = sys_mmap(xcap) 1888 let xlen: *i64 = sys_mmap(16) as *i64 1889 let xrc: *i64 = sys_mmap(16) as *i64 1890 let av: *i64 = sys_mmap(64) as *i64 1891 av[1] = 0 1892 tea_run_pinned("nx_ecosystem_maturity_rollup" as *u8, 28, av, xout, xcap, xlen, xrc) 1893 b = ta_cat(jb, b, ",\"result\":{\"contents\":[{\"uri\":\"nishi://sota/ecosystem-maturity\",\"mimeType\":\"text/plain\",\"text\":\"" as *u8) 1894 if xrc[0] == TEA_OK { b = ta_json_esc(jb, b, xout, xlen[0]) } else { b = ta_cat(jb, b, "(maturity rollup unavailable)" as *u8) } 1895 return ta_cat(jb, b, "\"}]}}" as *u8) 1896 } 1897 if ta_indexof(up, ul, "doctrine/operating" as *u8) >= 0 { 1898 b = ta_cat(jb, b, ",\"result\":{\"contents\":[{\"uri\":\"nishi://doctrine/operating\",\"mimeType\":\"text/plain\",\"text\":\"" as *u8) 1899 b = ta_cat(jb, b, "Operate Nishi over sovereign MCP. Tools: nishi_search/nishi_doc (search); nx_status/nx_services/nx_health (status); nx_mgmt (admin: build/deploy/reconcile/restart); nx_ecosystem_maturity_rollup (live grade). Auth: ?cap=token on the MCP URL (session baseline -- use this if your client drops custom headers), X-Nishi-Cap header, Authorization: Bearer cap, or params._cap (per-call, wins over the rest). Build+deploy on the NAS via /api/build + /api/deploy (never-brick, auto-rollback). One-command edit-to-build: nx_ship target tokenfile srcdir." as *u8) 1900 return ta_cat(jb, b, "\"}]}}" as *u8) 1901 } 1902 return ta_cat(jb, b, ",\"error\":{\"code\":-32002,\"message\":\"resource not found\"}}" as *u8) 1903} 1904// R3: MCP prompts/get -- return a reusable prompt template, arguments filled. `operate-nishi` primes an agent on the 1905// sovereign toolset; `ship-target` (arg: target) is a build+deploy prompt. unknown -> -32602. 1906func ta_mcp_promget(body: *u8, bn: i64, jb: *u8, b0: i64) -> i64 { 1907 var b: i64 = b0 1908 let n2: *i64 = sys_mmap(16) as *i64 1909 if ta_json_str(body, bn, "\"name\"" as *u8, n2) == 0 { 1910 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"prompts/get requires params.name\"}}" as *u8) 1911 } 1912 let np: *u8 = ((body as i64) + n2[0]) as *u8 1913 let nl: i64 = n2[1] 1914 if ta_streq_n(np, nl, "operate-nishi" as *u8) == 1 { 1915 b = ta_cat(jb, b, ",\"result\":{\"description\":\"Prime an agent to operate the Nishi ecosystem over sovereign MCP\",\"messages\":[{\"role\":\"user\",\"content\":{\"type\":\"text\",\"text\":\"" as *u8) 1916 b = ta_cat(jb, b, "You operate the Nishi sovereign ecosystem over MCP; prefer these tools over shell. Search: nishi_search/nishi_doc. Status: nx_status/nx_services/nx_health. Admin build/deploy/reconcile/restart (never-brick): nx_mgmt. Live SOTA grade: nx_ecosystem_maturity_rollup. One-command edit-to-build: nx_ship. Read the resource nishi://doctrine/operating first." as *u8) 1917 return ta_cat(jb, b, "\"}}]}}" as *u8) 1918 } 1919 if ta_streq_n(np, nl, "ship-target" as *u8) == 1 { 1920 let t2: *i64 = sys_mmap(16) as *i64 1921 var tp: *u8 = "TARGET" as *u8 1922 var tl: i64 = 6 1923 if ta_json_str(body, bn, "\"target\"" as *u8, t2) == 1 { tp = ((body as i64) + t2[0]) as *u8; tl = t2[1] } 1924 b = ta_cat(jb, b, ",\"result\":{\"description\":\"Build and deploy a target on the NAS over sovereign APIs\",\"messages\":[{\"role\":\"user\",\"content\":{\"type\":\"text\",\"text\":\"Build and deploy the target '" as *u8) 1925 b = ta_json_esc(jb, b, tp, tl) 1926 b = ta_cat(jb, b, "' on the NAS with ZERO shell: sync+compile via nx_ship (or nx_mgmt POST /api/build target=" as *u8) 1927 b = ta_json_esc(jb, b, tp, tl) 1928 b = ta_cat(jb, b, "), then promote via nx_mgmt POST /api/deploy (never-brick, auto-rollback), and verify with nx_health.\"}}]}}" as *u8) 1929 return b 1930 } 1931 return ta_cat(jb, b, ",\"error\":{\"code\":-32602,\"message\":\"unknown prompt\"}}" as *u8) 1932} 1933func ta_mcp(prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64 { 1934 let bo: i64 = ta_body_off(req, req_n) 1935 let body: *u8 = ((req as i64) + bo) as *u8 1936 let bn: i64 = req_n - bo 1937 let envelope: *NxMcpEnvelope = sys_mmap(NX_MCP_ENVELOPE_BYTES) as *NxMcpEnvelope 1938 let envelope_kind: i64 = nme_read(body, bn, envelope) 1939 if envelope_kind == 2 { return ta_emit_lit(out, "HTTP/1.1 202 Accepted" as *u8, "" as *u8) } 1940 if envelope_kind != 1 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "" as *u8) } 1941 let idbuf: *u8 = ((body as i64) + envelope.id_off) as *u8 1942 let idlen: i64 = envelope.id_len 1943 var meth: i64 = 0 1944 if envelope_kind == 1 { 1945 let mp: *u8 = ((body as i64) + envelope.method_off) as *u8 1946 let ml: i64 = envelope.method_len 1947 if ta_streq_n(mp, ml, "tools/list" as *u8) == 1 { meth = 2 } else { if ta_streq_n(mp, ml, "initialize" as *u8) == 1 { meth = 1 } else { if ta_streq_n(mp, ml, "tools/call" as *u8) == 1 { meth = 3 } else { if ta_streq_n(mp, ml, "resources/list" as *u8) == 1 { meth = 4 } else { if ta_streq_n(mp, ml, "resources/read" as *u8) == 1 { meth = 5 } else { if ta_streq_n(mp, ml, "prompts/list" as *u8) == 1 { meth = 6 } else { if ta_streq_n(mp, ml, "prompts/get" as *u8) == 1 { meth = 7 } } } } } } } 1948 } 1949 let jb: *u8 = sys_mmap(TA_MAGIC_1048576) 1950 var b: i64 = ta_cat(jb, 0, "{\"jsonrpc\":\"2.0\",\"id\":" as *u8) 1951 b = ta_catb(jb, b, idbuf, idlen) 1952 if meth == 1 { 1953 b = ta_cat(jb, b, ",\"result\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{\"tools\":{\"listChanged\":false},\"resources\":{\"listChanged\":false},\"prompts\":{\"listChanged\":false}},\"serverInfo\":{\"name\":\"nishi-tools\",\"version\":\"1\"}}}" as *u8) 1954 } else { if meth == 2 { 1955 // MCP cursor pagination: params.cursor is a numeric offset; emit a page + nextCursor iff more remain. 1956 var pgoff: i64 = 0 1957 let cb2: *i64 = sys_mmap(16) as *i64 1958 if ta_json_raw(body, bn, "\"cursor\"" as *u8, cb2) == 1 { pgoff = tr_atoi(body, cb2[0], cb2[1]) } 1959 let moreb: *i64 = sys_mmap(16) as *i64 1960 moreb[0] = 0 1961 b = ta_cat(jb, b, ",\"result\":{\"tools\":[" as *u8) 1962 b = ta_emit_tools(prefix, jb, b, 1, pgoff, TA_MCP_PAGE, moreb) 1963 b = ta_cat(jb, b, "]" as *u8) 1964 if moreb[0] == 1 { b = ta_cat(jb, b, ",\"nextCursor\":\"" as *u8); b = ta_catn(jb, b, pgoff + TA_MCP_PAGE); b = ta_cat(jb, b, "\"" as *u8) } 1965 b = ta_cat(jb, b, "}}" as *u8) 1966 } else { if meth == 3 { 1967 b = ta_mcp_call(prefix, req, req_n, body, bn, jb, b) 1968 } else { if meth == 4 { 1969 b = ta_cat(jb, b, ",\"result\":{\"resources\":[{\"uri\":\"nishi://sota/ecosystem-maturity\",\"name\":\"Ecosystem Maturity Grade\",\"description\":\"live liar-killed per-domain maturity toward S-class, measured from the sovereign seg_store\",\"mimeType\":\"text/plain\"},{\"uri\":\"nishi://doctrine/operating\",\"name\":\"Nishi Operating Doctrine\",\"description\":\"how to operate the ecosystem over sovereign MCP + APIs\",\"mimeType\":\"text/plain\"}]}}" as *u8) 1970 } else { if meth == 5 { 1971 b = ta_mcp_resread(body, bn, jb, b) 1972 } else { if meth == 6 { 1973 b = ta_cat(jb, b, ",\"result\":{\"prompts\":[{\"name\":\"operate-nishi\",\"description\":\"Prime an agent to operate the Nishi ecosystem over sovereign MCP\"},{\"name\":\"ship-target\",\"description\":\"Build and deploy a target on the NAS over sovereign APIs\",\"arguments\":[{\"name\":\"target\",\"description\":\"the runtime organ to build and deploy\",\"required\":true}]}]}}" as *u8) 1974 } else { if meth == 7 { 1975 b = ta_mcp_promget(body, bn, jb, b) 1976 } else { 1977 b = ta_cat(jb, b, ",\"error\":{\"code\":-32601,\"message\":\"method not found\"}}" as *u8) 1978 } } } } } } } 1979 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 1980} 1981 1982// ---- THE router: pure request bytes -> response bytes (gate drives this directly, no socket) --------- 1983// POST /api/cap/issue -- SELF-SERVICE capability DELEGATION (pure ocap, no ambient identity). Present YOUR capability 1984// (X-Nishi-Cap header or params._cap) + a narrower "allow" (+ optional "exp"); get back a delegated capability that is a 1985// SUBSET of yours (capt_attenuate refuses any widening AND an invalid/forged input -> you can never delegate more than 1986// you hold). Root minting from the secret stays operator-side (nx_cap_mint). Ratchet: clamp exp' <= parent exp. 1987// R4 per-client consent ledger: cap_consent.log (append-only). One line per delegation: 1988// now <TAB> client <TAB> allow <TAB> exp <TAB> parent_nonce <TAB> child_nonce 1989// In the ocap model the operator's SCOPED, attenuated mint IS the per-client consent (a deliberate least-authority 1990// grant, superior to a yes/no consent screen); this makes that intent EXPLICIT (client-attributed) + AUDITABLE. 1991const TA_CONSENT_LOG: *u8 = "cap_consent.log" as *u8 1992func ta_append_consent(client: *u8, cl: i64, allowp: *u8, allowl: i64, exp: i64, pnonce: i64, cnonce: i64) -> i64 { 1993 let fd: i64 = ta_openat_append(TA_CONSENT_LOG) 1994 if fd < 0 { return 0 - 1 } 1995 let line: *u8 = sys_mmap(TA_MAGIC_8192) 1996 var o: i64 = ta_catn(line, 0, sys_now_realtime_sec()) 1997 line[o] = 9 as u8; o = o + 1 1998 o = ta_catb(line, o, client, cl) 1999 line[o] = 9 as u8; o = o + 1 2000 o = ta_catb(line, o, allowp, allowl) 2001 line[o] = 9 as u8; o = o + 1 2002 o = ta_catn(line, o, exp) 2003 line[o] = 9 as u8; o = o + 1 2004 o = ta_catn(line, o, pnonce) 2005 line[o] = 9 as u8; o = o + 1 2006 o = ta_catn(line, o, cnonce) 2007 line[o] = 10 as u8; o = o + 1 2008 sys_write(fd, line, o) 2009 sys_close(fd) 2010 return 0 2011} 2012// GET /api/cap/consent-log -- PUBLIC audit trail of who-delegated-what-to-which-client (no secrets: nonces + scope only). 2013func ta_cap_consent_log(out: *u8) -> i64 { 2014 let szp: *i64 = sys_mmap(16) as *i64 2015 let buf: *u8 = sys_read_file(TA_CONSENT_LOG, szp) 2016 let jb: *u8 = sys_mmap(TA_MAGIC_1048576) 2017 var b: i64 = ta_cat(jb, 0, "{\"consent_log\":\"" as *u8) 2018 if (buf as i64) != 0 { b = ta_json_esc(jb, b, buf, szp[0]) } 2019 b = ta_cat(jb, b, "\",\"schema\":\"now\\tclient\\tallow\\texp\\tparent_nonce\\tchild_nonce\",\"note\":\"append-only; ocap scoped+attenuated delegation IS the per-client consent, recorded here for audit + revocable via /api/cap/revoke\"}" as *u8) 2020 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 2021} 2022func ta_cap_issue(req: *u8, req_n: i64, out: *u8) -> i64 { 2023 let bo: i64 = ta_body_off(req, req_n) 2024 let body: *u8 = ((req as i64) + bo) as *u8 2025 let bn: i64 = req_n - bo 2026 let slb: *i64 = sys_mmap(16) as *i64 2027 let secret: *u8 = ta_load_cap_secret(slb) 2028 let secretlen: i64 = slb[0] 2029 let cap2: *i64 = sys_mmap(16) as *i64 2030 var pp: *u8 = 0 as *u8 2031 var pl: i64 = 0 2032 if ta_header(req, req_n, "X-Nishi-Cap:" as *u8, cap2) == 1 { pp = ((req as i64) + cap2[0]) as *u8; pl = cap2[1] } 2033 else { let cb: *i64 = sys_mmap(16) as *i64; if ta_json_str(body, bn, "\"_cap\"" as *u8, cb) == 1 { pp = ((body as i64) + cb[0]) as *u8; pl = cb[1] } } 2034 if pl <= 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"present your capability (X-Nishi-Cap header or params._cap)\"}" as *u8) } 2035 let ab: *i64 = sys_mmap(16) as *i64 2036 var allowp: *u8 = 0 as *u8 2037 var allowl: i64 = 0 2038 if ta_json_str(body, bn, "\"allow\"" as *u8, ab) == 1 { allowp = ((body as i64) + ab[0]) as *u8; allowl = ab[1] } 2039 if allowl <= 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"specify a narrower \\\"allow\\\" tool-set (comma-separated)\"}" as *u8) } 2040 var exp: i64 = TA_MAGIC_9999999999 2041 let eb: *i64 = sys_mmap(16) as *i64 2042 if ta_json_raw(body, bn, "\"exp\"" as *u8, eb) == 1 { exp = tr_atoi(body, eb[0], eb[1]) } 2043 // caller-supplied nonce -> a UNIQUE identity per delegated cap so it can be revoked individually (default 7 if omitted) 2044 var dnonce: i64 = 7 2045 let nb: *i64 = sys_mmap(16) as *i64 2046 if ta_json_raw(body, bn, "\"nonce\"" as *u8, nb) == 1 { dnonce = tr_atoi(body, nb[0], nb[1]) } 2047 let ntok: *u8 = sys_mmap(TA_MAGIC_2048) 2048 let ntn: i64 = capt_attenuate(secret, secretlen, pp, pl, allowp, allowl, exp, dnonce, ntok, TA_MAGIC_2048) 2049 if ntn > 0 { 2050 // R4: record the per-client consent (who consented by holding the parent, to which client, what scope, when). 2051 let clb: *i64 = sys_mmap(16) as *i64 2052 var clientp: *u8 = "anonymous" as *u8 2053 var clientl: i64 = 9 2054 if ta_json_str(body, bn, "\"client\"" as *u8, clb) == 1 { clientp = ((body as i64) + clb[0]) as *u8; clientl = clb[1] } 2055 ta_append_consent(clientp, clientl, allowp, allowl, exp, capt_nonce_of(pp, pl), dnonce) 2056 let jb: *u8 = sys_mmap(TA_MAGIC_4096) 2057 var b: i64 = ta_cat(jb, 0, "{\"cap\":\"" as *u8) 2058 b = ta_catb(jb, b, ntok, ntn) 2059 b = ta_cat(jb, b, "\",\"consent_recorded\":true,\"note\":\"delegated capability -- a SUBSET of yours (attenuation is subset-only; widening is refused); per-client consent logged (see GET /api/cap/consent-log)\"}" as *u8) 2060 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 2061 } 2062 return ta_emit_lit(out, "HTTP/1.1 403 Forbidden" as *u8, "{\"error\":\"cannot delegate: your capability is invalid/forged, or the requested tools exceed your grant (no widening)\"}" as *u8) 2063} 2064 2065// POST /api/cap/revoke -- REVOKE a capability you hold: present it (X-Nishi-Cap / params._cap); if its MAC is valid its 2066// nonce is added to the denylist and it (plus any cap sharing that nonce) is refused thereafter. Fail-closed: only a 2067// MAC-valid cap can be revoked (the denylist can't be spammed with garbage). Cascading parent->child is a ratchet. 2068func ta_cap_revoke(req: *u8, req_n: i64, out: *u8) -> i64 { 2069 let bo: i64 = ta_body_off(req, req_n) 2070 let body: *u8 = ((req as i64) + bo) as *u8 2071 let bn: i64 = req_n - bo 2072 let slb: *i64 = sys_mmap(16) as *i64 2073 let secret: *u8 = ta_load_cap_secret(slb) 2074 let secretlen: i64 = slb[0] 2075 let cap2: *i64 = sys_mmap(16) as *i64 2076 var pp: *u8 = 0 as *u8 2077 var pl: i64 = 0 2078 if ta_header(req, req_n, "X-Nishi-Cap:" as *u8, cap2) == 1 { pp = ((req as i64) + cap2[0]) as *u8; pl = cap2[1] } 2079 else { let cb: *i64 = sys_mmap(16) as *i64; if ta_json_str(body, bn, "\"_cap\"" as *u8, cb) == 1 { pp = ((body as i64) + cb[0]) as *u8; pl = cb[1] } } 2080 if pl <= 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"present the capability to revoke (X-Nishi-Cap or params._cap)\"}" as *u8) } 2081 let plb: *i64 = sys_mmap(16) as *i64 2082 if capt_mac_ok(secret, secretlen, pp, pl, plb) == 0 { return ta_emit_lit(out, "HTTP/1.1 403 Forbidden" as *u8, "{\"error\":\"invalid/forged capability -- nothing revoked\"}" as *u8) } 2083 let nn: i64 = capt_nonce_of(pp, pl) 2084 ta_append_revoked(nn) 2085 let jb: *u8 = sys_mmap(256) 2086 var b: i64 = ta_cat(jb, 0, "{\"revoked_nonce\":" as *u8) 2087 b = ta_catn(jb, b, nn) 2088 b = ta_cat(jb, b, ",\"note\":\"denylisted; this capability (and any sharing its nonce) is refused from now on\"}" as *u8) 2089 return ta_emit(out, "HTTP/1.1 200 OK" as *u8, jb, b) 2090} 2091 2092// GET /api/cap/status -- PUBLIC config-health readout for the capability-grant bootstrap: reports whether the server 2093// loaded a REAL signing keyfile or is still on the FORGEABLE baked placeholder. Reveals NO secret (only the boolean 2094// state) -- and if it says placeholder, that secret is already public in the source, so nothing leaks. This is what 2095// lets an operator confirm `nx_cap_keygen` + restart took effect BEFORE minting (otherwise a real token fails with an 2096// opaque -32001 and there is no way to tell why). Needs no capability -- it must be checkable before any cap exists. 2097func ta_cap_status(out: *u8) -> i64 { 2098 if ta_cap_provisioned() == 1 { 2099 return ta_emit_lit(out, "HTTP/1.1 200 OK" as *u8, "{\"cap_signing\":\"provisioned\",\"secure\":true,\"note\":\"a real keyfile is loaded; minted tokens will verify\"}" as *u8) 2100 } 2101 return ta_emit_lit(out, "HTTP/1.1 200 OK" as *u8, "{\"cap_signing\":\"insecure_placeholder\",\"secure\":false,\"note\":\"forgeable baked secret in use -- run nx_cap_keygen in the server CWD and restart nx_tools_api, then re-check\"}" as *u8) 2102} 2103 2104// RFC 9728 Protected Resource Metadata -- lets a stock MCP client DISCOVER how to authenticate to this resource 2105// (bearer token in the Authorization header) and where the authorization server is. GET /.well-known/oauth-protected- 2106// resource. Advertises the ocap-as-bearer interop (R2); native X-Nishi-Cap / _cap remain first-class. 2107func ta_oauth_prm(out: *u8) -> i64 { 2108 return ta_emit_lit(out, "HTTP/1.1 200 OK" as *u8, "{\"resource\":\"https://nishifamily.com/mcp\",\"authorization_servers\":[\"https://nishifamily.com\"],\"bearer_methods_supported\":[\"header\"],\"resource_name\":\"Nishi Sovereign MCP\",\"resource_documentation\":\"https://nishifamily.com/api\"}" as *u8) 2109} 2110// ============================================================================================================ 2111// OAuth 2.1 AUTHORIZATION SERVER (RFC 6749/8252 + PKCE RFC 7636 S256 + AS-metadata RFC 8414 + dynamic client 2112// registration RFC 7591). Interactive consent at /oauth/authorize. STATELESS signed tokens: client_id + auth-code 2113// are capt_issue-signed (no client/token DB); access_token is a real scoped cap. One-time-use codes tracked in a 2114// BOUNDED static-pointer table (like the rate limiter). The issued bearer IS an X-Nishi-Cap -> the resource server 2115// (tools/call) already accepts it (Authorization: Bearer). ocap remains superior; this is for stock OAuth clients. 2116// ============================================================================================================ 2117const OC_SLOTS: i64 = 256 2118static oc_nonce: *i64 // one-time auth-code nonce (0 = free slot) 2119static oc_rhash: *i64 // bound redirect_uri hash 2120static oc_exp: *i64 // code expiry (epoch) 2121static oc_bind: *u8 // OC_SLOTS*160: [0..48)=code_challenge(S256, 43ch) , [48..160)=granted scope (tool CSV) 2122func oauth_state_init() -> i64 { 2123 if (oc_nonce as i64) == 0 { 2124 oc_nonce = sys_mmap(OC_SLOTS * 8) as *i64 2125 oc_rhash = sys_mmap(OC_SLOTS * 8) as *i64 2126 oc_exp = sys_mmap(OC_SLOTS * 8) as *i64 2127 oc_bind = sys_mmap(OC_SLOTS * 160) 2128 } 2129 return 0 2130} 2131func oauth_slotv(h: i64, slots: i64) -> i64 { var x: i64 = h; if x < 0 { x = 0 - x } return x - (x / slots) * slots } 2132func oauth_strhash(s: *u8, n: i64) -> i64 { var h: i64 = TA_MAGIC_1469598; var i: i64 = 0; while i < n { h = h * 31 + (s[i] as i64); i = i + 1 } if h == 0 { h = 1 } return h } 2133// extract param "key=" from a query/form string -> value [off,len) into out2 (0 if absent). Boundary = start or '&'. 2134func oauth_param(src: *u8, slen: i64, key: *u8, klen: i64, out2: *i64) -> i64 { 2135 var i: i64 = 0 2136 while i + klen <= slen { 2137 var atb: i64 = 0 2138 if i == 0 { atb = 1 } else { if src[i - 1] == (38 as u8) { atb = 1 } } 2139 if atb == 1 { 2140 var k: i64 = 0 2141 while k < klen { if src[i + k] != key[k] { k = klen + 9 } else { k = k + 1 } } 2142 if k == klen { if i + klen < slen { if src[i + klen] == (61 as u8) { 2143 let v: i64 = i + klen + 1 2144 var e: i64 = v 2145 var go: i64 = 1 2146 while go == 1 { if e >= slen { go = 0 } else { if src[e] == (38 as u8) { go = 0 } else { e = e + 1 } } } 2147 out2[0] = v 2148 out2[1] = e - v 2149 return 1 2150 } } } 2151 } 2152 i = i + 1 2153 } 2154 return 0 2155} 2156// minimal percent-decode (+ -> space, %XX -> byte) for building the redirect Location. Returns decoded length. 2157func oauth_hexv(c: i64) -> i64 { if c >= 48 { if c <= 57 { return c - 48 } } if c >= 65 { if c <= 70 { return c - 55 } } if c >= 97 { if c <= 102 { return c - 87 } } return 0 } 2158func oauth_urldec(src: *u8, n: i64, dst: *u8) -> i64 { 2159 var i: i64 = 0 2160 var o: i64 = 0 2161 while i < n { 2162 let c: i64 = src[i] as i64 2163 if c == 37 { if i + 2 < n { dst[o] = ((oauth_hexv(src[i+1] as i64) * 16) + oauth_hexv(src[i+2] as i64)) as u8; o = o + 1; i = i + 3 } else { dst[o] = 37 as u8; o = o + 1; i = i + 1 } } 2164 else { if c == 43 { dst[o] = 32 as u8; o = o + 1; i = i + 1 } else { dst[o] = c as u8; o = o + 1; i = i + 1 } } 2165 } 2166 return o 2167} 2168// base64url (no padding) of raw bytes -> out. For 32-byte SHA-256 -> 43 chars (PKCE S256 challenge form). 2169func oauth_b64url(inb: *u8, n: i64, out: *u8) -> i64 { 2170 var o: i64 = 0 2171 var i: i64 = 0 2172 while i + 3 <= n { 2173 let x: i64 = ((inb[i] as i64) << 16) | ((inb[i+1] as i64) << 8) | (inb[i+2] as i64) 2174 out[o] = b64url_enc_char((x >> 18) & 63) as u8; o = o + 1 2175 out[o] = b64url_enc_char((x >> 12) & 63) as u8; o = o + 1 2176 out[o] = b64url_enc_char((x >> 6) & 63) as u8; o = o + 1 2177 out[o] = b64url_enc_char(x & 63) as u8; o = o + 1 2178 i = i + 3 2179 } 2180 let rem: i64 = n - i 2181 if rem == 1 { 2182 let x: i64 = (inb[i] as i64) << 16 2183 out[o] = b64url_enc_char((x >> 18) & 63) as u8; o = o + 1 2184 out[o] = b64url_enc_char((x >> 12) & 63) as u8; o = o + 1 2185 } else { if rem == 2 { 2186 let x: i64 = ((inb[i] as i64) << 16) | ((inb[i+1] as i64) << 8) 2187 out[o] = b64url_enc_char((x >> 18) & 63) as u8; o = o + 1 2188 out[o] = b64url_enc_char((x >> 12) & 63) as u8; o = o + 1 2189 out[o] = b64url_enc_char((x >> 6) & 63) as u8; o = o + 1 2190 } } 2191 return o 2192} 2193func oauth_resp(out: *u8, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64 { 2194 var o: i64 = ta_cat(out, 0, "HTTP/1.1 " as *u8) 2195 o = ta_cat(out, o, status) 2196 o = ta_cat(out, o, "\r\nContent-Type: " as *u8) 2197 o = ta_cat(out, o, ctype) 2198 o = ta_cat(out, o, "\r\nCache-Control: no-store\r\nConnection: close\r\nContent-Length: " as *u8) 2199 o = capt_catn(out, o, blen) 2200 o = ta_cat(out, o, "\r\n\r\n" as *u8) 2201 o = ta_catb(out, o, body, blen) 2202 return o 2203} 2204// GET /.well-known/oauth-authorization-server (RFC 8414) 2205func ta_oauth_asmeta(out: *u8) -> i64 { 2206 let body: *u8 = "{\"issuer\":\"https://nishifamily.com\",\"authorization_endpoint\":\"https://nishifamily.com/oauth/authorize\",\"token_endpoint\":\"https://nishifamily.com/oauth/token\",\"registration_endpoint\":\"https://nishifamily.com/oauth/register\",\"response_types_supported\":[\"code\"],\"grant_types_supported\":[\"authorization_code\"],\"code_challenge_methods_supported\":[\"S256\"],\"token_endpoint_auth_methods_supported\":[\"none\"],\"scopes_supported\":[\"nishi_search\",\"nishi_doc\",\"nx_status\",\"nx_health\",\"nx_services\"]}" as *u8 2207 return oauth_resp(out, "200 OK" as *u8, "application/json" as *u8, body, capt_slen(body)) 2208} 2209// POST /oauth/register (RFC 7591 dynamic client registration). body JSON {redirect_uri, client_name}. client_id is a 2210// STATELESS capt-signed token binding the redirect_uri (its nonce = hash(redirect_uri)) -> no client DB. 2211func ta_oauth_register(req: *u8, req_n: i64, out: *u8) -> i64 { 2212 let bo: i64 = ta_body_off(req, req_n) 2213 let body: *u8 = ((req as i64) + bo) as *u8 2214 let bn: i64 = req_n - bo 2215 let slb: *i64 = sys_mmap(16) as *i64 2216 let secret: *u8 = ta_load_cap_secret(slb) 2217 let rb: *i64 = sys_mmap(16) as *i64 2218 if ta_json_str(body, bn, "\"redirect_uri\"" as *u8, rb) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_client_metadata\",\"error_description\":\"redirect_uri required\"}" as *u8) } 2219 let rp: *u8 = ((body as i64) + rb[0]) as *u8 2220 let rl: i64 = rb[1] 2221 let cidtok: *u8 = sys_mmap(TA_MAGIC_2048) 2222 let cidn: i64 = capt_issue(secret, slb[0], "oauth_client" as *u8, 12, TA_MAGIC_9999999999, oauth_strhash(rp, rl), cidtok, TA_MAGIC_2048) 2223 let jb: *u8 = sys_mmap(TA_MAGIC_4096) 2224 var b: i64 = ta_cat(jb, 0, "{\"client_id\":\"" as *u8) 2225 b = ta_catb(jb, b, cidtok, cidn) 2226 b = ta_cat(jb, b, "\",\"token_endpoint_auth_method\":\"none\",\"grant_types\":[\"authorization_code\"],\"response_types\":[\"code\"],\"redirect_uris\":[\"" as *u8) 2227 b = ta_catb(jb, b, rp, rl) 2228 b = ta_cat(jb, b, "\"]}" as *u8) 2229 return oauth_resp(out, "201 Created" as *u8, "application/json" as *u8, jb, b) 2230} 2231// GET /oauth/authorize?response_type=code&client_id&redirect_uri&scope&state&code_challenge&code_challenge_method=S256 2232// -> INTERACTIVE CONSENT page (the human approves the scope). Approve POSTs to /oauth/approve. 2233func ta_oauth_authorize(req: *u8, req_n: i64, out: *u8) -> i64 { 2234 let mo: *i64 = sys_mmap(16) as *i64 2235 let po: *i64 = sys_mmap(16) as *i64 2236 ta_reqline(req, req_n, mo, po) 2237 let full: *u8 = ((req as i64) + po[0]) as *u8 2238 let flen: i64 = po[1] 2239 var qpos: i64 = 0 - 1 2240 var qi: i64 = 0 2241 while qi < flen { if qpos < 0 { if full[qi] == (63 as u8) { qpos = qi } } qi = qi + 1 } 2242 if qpos < 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"missing query\"}" as *u8, 62) } 2243 let query: *u8 = ((full as i64) + qpos + 1) as *u8 2244 let qlen: i64 = flen - qpos - 1 2245 let aslb: *i64 = sys_mmap(16) as *i64 2246 let secret: *u8 = ta_load_cap_secret(aslb) 2247 let cib: *i64 = sys_mmap(16) as *i64 2248 let rib: *i64 = sys_mmap(16) as *i64 2249 let ccb: *i64 = sys_mmap(16) as *i64 2250 let scb: *i64 = sys_mmap(16) as *i64 2251 if oauth_param(query, qlen, "client_id" as *u8, 9, cib) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\"}" as *u8, 27) } 2252 if oauth_param(query, qlen, "redirect_uri" as *u8, 12, rib) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\"}" as *u8, 27) } 2253 if oauth_param(query, qlen, "code_challenge" as *u8, 14, ccb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"PKCE code_challenge required (S256)\"}" as *u8, 82) } 2254 let cip: *u8 = ((query as i64) + cib[0]) as *u8 2255 let rip: *u8 = ((query as i64) + rib[0]) as *u8 2256 let plb: *i64 = sys_mmap(16) as *i64 2257 if capt_mac_ok(secret, aslb[0], cip, cib[1], plb) == 0 { return oauth_resp(out, "401 Unauthorized" as *u8, "application/json" as *u8, "{\"error\":\"invalid_client\"}" as *u8, 26) } 2258 if capt_nonce_of(cip, cib[1]) != oauth_strhash(rip, rib[1]) { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"redirect_uri not registered for this client\"}" as *u8, 90) } 2259 var scp: *u8 = "nishi_search" as *u8 2260 var scl: i64 = 12 2261 if oauth_param(query, qlen, "scope" as *u8, 5, scb) == 1 { scp = ((query as i64) + scb[0]) as *u8; scl = scb[1] } 2262 // consent page: nishi-native, self-contained. Approve form re-submits the exact params to /oauth/approve. 2263 let jb: *u8 = sys_mmap(TA_MAGIC_16384) 2264 var b: i64 = ta_cat(jb, 0, "<html><head><meta charset=utf-8><title>Authorize</title><style>body{font-family:system-ui;max-width:34em;margin:3em auto;padding:0 1em;color:midnightblue}h1{color:seagreen}.s{background:honeydew;border-left:4px solid seagreen;padding:.5em 1em;border-radius:5px;margin:1em 0}button{font-size:1em;padding:.5em 1.4em;border:0;border-radius:6px;cursor:pointer}.a{background:seagreen;color:white}.d{background:gainsboro}</style></head><body><h1>Authorize access</h1><p>An application is requesting a Nishi capability. Review the scope you are granting.</p><div class=s><b>Scope:</b> <code>" as *u8) 2265 b = ta_catb(jb, b, scp, scl) 2266 b = ta_cat(jb, b, "</code></div><form method=post action=/oauth/approve>" as *u8) 2267 b = ta_cat(jb, b, "<input type=hidden name=client_id value=\"" as *u8); b = ta_catb(jb, b, cip, cib[1]); b = ta_cat(jb, b, "\">" as *u8) 2268 b = ta_cat(jb, b, "<input type=hidden name=redirect_uri value=\"" as *u8); b = ta_catb(jb, b, rip, rib[1]); b = ta_cat(jb, b, "\">" as *u8) 2269 b = ta_cat(jb, b, "<input type=hidden name=code_challenge value=\"" as *u8); b = ta_catb(jb, b, ((query as i64) + ccb[0]) as *u8, ccb[1]); b = ta_cat(jb, b, "\">" as *u8) 2270 b = ta_cat(jb, b, "<input type=hidden name=scope value=\"" as *u8); b = ta_catb(jb, b, scp, scl); b = ta_cat(jb, b, "\">" as *u8) 2271 let stb: *i64 = sys_mmap(16) as *i64 2272 if oauth_param(query, qlen, "state" as *u8, 5, stb) == 1 { b = ta_cat(jb, b, "<input type=hidden name=state value=\"" as *u8); b = ta_catb(jb, b, ((query as i64) + stb[0]) as *u8, stb[1]); b = ta_cat(jb, b, "\">" as *u8) } 2273 b = ta_cat(jb, b, "<button class=a type=submit>Approve</button></form><p style=color:slategray>Powered by the Nishi sovereign auth plane -- OPAQUE + object-capability. The issued bearer is an attenuated cap.</p></body></html>" as *u8) 2274 return oauth_resp(out, "200 OK" as *u8, "text/html; charset=utf-8" as *u8, jb, b) 2275} 2276// POST /oauth/approve (the consent GRANT). Issues a one-time auth code bound to {redirect_uri, code_challenge, scope} 2277// and 302-redirects to redirect_uri?code=..&state=.. 2278func ta_oauth_approve(req: *u8, req_n: i64, out: *u8) -> i64 { 2279 oauth_state_init() 2280 let bo: i64 = ta_body_off(req, req_n) 2281 let body: *u8 = ((req as i64) + bo) as *u8 2282 let bn: i64 = req_n - bo 2283 let pslb: *i64 = sys_mmap(16) as *i64 2284 let secret: *u8 = ta_load_cap_secret(pslb) 2285 let cib: *i64 = sys_mmap(16) as *i64 2286 let rib: *i64 = sys_mmap(16) as *i64 2287 let ccb: *i64 = sys_mmap(16) as *i64 2288 let scb: *i64 = sys_mmap(16) as *i64 2289 if oauth_param(body, bn, "client_id" as *u8, 9, cib) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_request\"}" as *u8) } 2290 if oauth_param(body, bn, "redirect_uri" as *u8, 12, rib) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_request\"}" as *u8) } 2291 if oauth_param(body, bn, "code_challenge" as *u8, 14, ccb) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_request\"}" as *u8) } 2292 let cip: *u8 = ((body as i64) + cib[0]) as *u8 2293 let rip: *u8 = ((body as i64) + rib[0]) as *u8 2294 let plb: *i64 = sys_mmap(16) as *i64 2295 if capt_mac_ok(secret, pslb[0], cip, cib[1], plb) == 0 { return ta_emit_lit(out, "HTTP/1.1 401 Unauthorized" as *u8, "{\"error\":\"invalid_client\"}" as *u8) } 2296 if capt_nonce_of(cip, cib[1]) != oauth_strhash(rip, rib[1]) { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"invalid_request\"}" as *u8) } 2297 var scp: *u8 = "nishi_search" as *u8 2298 var scl: i64 = 12 2299 if oauth_param(body, bn, "scope" as *u8, 5, scb) == 1 { scp = ((body as i64) + scb[0]) as *u8; scl = scb[1] } 2300 let ccp: *u8 = ((body as i64) + ccb[0]) as *u8 2301 let ccl: i64 = ccb[1] 2302 let now: i64 = sys_now_realtime_sec() 2303 var cnonce: i64 = (oauth_strhash(ccp, ccl) ^ (now * 131 + 7)) & TA_MAGIC_4294967295 // positive 32-bit -> capt_catn writes it 2304 if cnonce == 0 { cnonce = 1 } 2305 let s: i64 = oauth_slotv(cnonce, OC_SLOTS) 2306 oc_nonce[s] = cnonce 2307 oc_rhash[s] = oauth_strhash(rip, rib[1]) 2308 oc_exp[s] = now + 60 2309 var z: i64 = 0 2310 while z < ccl { if z < 47 { oc_bind[s * 160 + z] = ccp[z] } z = z + 1 } 2311 oc_bind[s * 160 + 47] = 0 as u8 2312 z = 0 2313 while z < scl { if z < 111 { oc_bind[s * 160 + 48 + z] = scp[z] } z = z + 1 } 2314 oc_bind[s * 160 + 48 + scl] = 0 as u8 2315 let code: *u8 = sys_mmap(TA_MAGIC_2048) 2316 let codn: i64 = capt_issue(secret, pslb[0], "oauth_code" as *u8, 10, now + 60, cnonce, code, TA_MAGIC_2048) 2317 // build Location = <decoded redirect_uri>?code=<code>&state=<state> 2318 let loc: *u8 = sys_mmap(TA_MAGIC_4096) 2319 var lo: i64 = oauth_urldec(rip, rib[1], loc) 2320 loc[lo] = 63 as u8; lo = lo + 1 2321 lo = ta_cat(loc, lo, "code=" as *u8) 2322 lo = ta_catb(loc, lo, code, codn) 2323 let stb: *i64 = sys_mmap(16) as *i64 2324 if oauth_param(body, bn, "state" as *u8, 5, stb) == 1 { 2325 lo = ta_cat(loc, lo, "&state=" as *u8) 2326 lo = ta_catb(loc, lo, ((body as i64) + stb[0]) as *u8, stb[1]) 2327 } 2328 var o: i64 = ta_cat(out, 0, "HTTP/1.1 302 Found\r\nLocation: " as *u8) 2329 o = ta_catb(out, o, loc, lo) 2330 o = ta_cat(out, o, "\r\nCache-Control: no-store\r\nConnection: close\r\nContent-Length: 0\r\n\r\n" as *u8) 2331 return o 2332} 2333// POST /oauth/token grant_type=authorization_code&code&redirect_uri&code_verifier -> verify code sig + one-time-use + 2334// redirect binding + PKCE(S256) -> mint a scoped access cap. RFC 6749 s5.1 JSON. 2335func ta_oauth_token(req: *u8, req_n: i64, out: *u8) -> i64 { 2336 oauth_state_init() 2337 let bo: i64 = ta_body_off(req, req_n) 2338 let body: *u8 = ((req as i64) + bo) as *u8 2339 let bn: i64 = req_n - bo 2340 let slb: *i64 = sys_mmap(16) as *i64 2341 let secret: *u8 = ta_load_cap_secret(slb) 2342 let gtb: *i64 = sys_mmap(16) as *i64 2343 let cdb: *i64 = sys_mmap(16) as *i64 2344 let rib: *i64 = sys_mmap(16) as *i64 2345 let cvb: *i64 = sys_mmap(16) as *i64 2346 if oauth_param(body, bn, "grant_type" as *u8, 10, gtb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\"}" as *u8, 27) } 2347 if oauth_param(body, bn, "code" as *u8, 4, cdb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"code required\"}" as *u8, 60) } 2348 if oauth_param(body, bn, "redirect_uri" as *u8, 12, rib) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\"}" as *u8, 27) } 2349 if oauth_param(body, bn, "code_verifier" as *u8, 13, cvb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_request\",\"error_description\":\"PKCE code_verifier required\"}" as *u8, 76) } 2350 let cdp: *u8 = ((body as i64) + cdb[0]) as *u8 2351 let plb: *i64 = sys_mmap(16) as *i64 2352 if capt_mac_ok(secret, slb[0], cdp, cdb[1], plb) == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"bad code signature\"}" as *u8, 64) } 2353 let cnonce: i64 = capt_nonce_of(cdp, cdb[1]) 2354 let s: i64 = oauth_slotv(cnonce, OC_SLOTS) 2355 let now: i64 = sys_now_realtime_sec() 2356 if oc_nonce[s] != cnonce { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"code unknown/already used\"}" as *u8, 72) } 2357 if now >= oc_exp[s] { oc_nonce[s] = 0; return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"code expired\"}" as *u8, 58) } 2358 let rip: *u8 = ((body as i64) + rib[0]) as *u8 2359 if oc_rhash[s] != oauth_strhash(rip, rib[1]) { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"redirect_uri mismatch\"}" as *u8, 68) } 2360 // PKCE S256: base64url(sha256(code_verifier)) == stored code_challenge 2361 let cvp: *u8 = ((body as i64) + cvb[0]) as *u8 2362 let dg: *u8 = sys_mmap(64) 2363 sha256_digest(cvp, cvb[1], dg) 2364 let calc: *u8 = sys_mmap(128) 2365 let cln: i64 = oauth_b64url(dg, 32, calc) 2366 let chal: *u8 = ((oc_bind as i64) + s * 160) as *u8 2367 var chn: i64 = 0 2368 var cdone: i64 = 0 2369 while cdone == 0 { if chn >= 47 { cdone = 1 } else { if chal[chn] == (0 as u8) { cdone = 1 } else { chn = chn + 1 } } } 2370 var pkok: i64 = 1 2371 if cln != chn { pkok = 0 } 2372 var mi: i64 = 0 2373 while mi < cln { if calc[mi] != chal[mi] { pkok = 0 } mi = mi + 1 } 2374 if pkok == 0 { return oauth_resp(out, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"invalid_grant\",\"error_description\":\"PKCE verification failed\"}" as *u8, 70) } 2375 oc_nonce[s] = 0 // ONE-TIME USE: burn the code 2376 let scope: *u8 = ((oc_bind as i64) + s * 160 + 48) as *u8 2377 var scln: i64 = 0 2378 var sdone: i64 = 0 2379 while sdone == 0 { if scln >= 111 { sdone = 1 } else { if scope[scln] == (0 as u8) { sdone = 1 } else { scln = scln + 1 } } } 2380 let atok: *u8 = sys_mmap(TA_MAGIC_2048) 2381 let atn: i64 = capt_issue(secret, slb[0], scope, scln, now + TA_MAGIC_3600, (cnonce ^ TA_MAGIC_88161) & TA_MAGIC_4294967295, atok, TA_MAGIC_2048) 2382 let jb: *u8 = sys_mmap(TA_MAGIC_4096) 2383 var b: i64 = ta_cat(jb, 0, "{\"access_token\":\"" as *u8) 2384 b = ta_catb(jb, b, atok, atn) 2385 b = ta_cat(jb, b, "\",\"token_type\":\"Bearer\",\"expires_in\":3600,\"scope\":\"" as *u8) 2386 b = ta_catb(jb, b, scope, scln) 2387 b = ta_cat(jb, b, "\"}" as *u8) 2388 return oauth_resp(out, "200 OK" as *u8, "application/json" as *u8, jb, b) 2389} 2390 2391func ta_handle_pfx(prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64 { 2392 let mo: *i64 = sys_mmap(16) as *i64 2393 let po: *i64 = sys_mmap(16) as *i64 2394 if ta_reqline(req, req_n, mo, po) == 0 { return ta_emit_lit(out, "HTTP/1.1 400 Bad Request" as *u8, "{\"error\":\"bad_request_line\"}" as *u8) } 2395 let path: *u8 = ((req as i64) + po[0]) as *u8 2396 var plen: i64 = po[1] 2397 var qi: i64 = 0 2398 var qfound: i64 = 0 - 1 2399 while qi < po[1] { if qfound < 0 { if path[qi] == (63 as u8) { qfound = qi } } qi = qi + 1 } 2400 if qfound >= 0 { plen = qfound } 2401 let mp: *u8 = ((req as i64) + mo[0]) as *u8 2402 let ml: i64 = mo[1] 2403 let is_get: i64 = ta_streq_n(mp, ml, "GET" as *u8) 2404 let is_post: i64 = ta_streq_n(mp, ml, "POST" as *u8) 2405 if ta_streq_n(path, plen, "/api/tools" as *u8) == 1 { if is_get == 1 { return ta_tools(prefix, out) } } 2406 if ta_streq_n(path, plen, "/tools" as *u8) == 1 { if is_get == 1 { return ta_html_tools(out) } } 2407 if ta_streq_n(path, plen, "/mcp" as *u8) == 1 { if is_post == 1 { return ta_mcp(prefix, req, req_n, out) } return ta_cat(out, 0, "HTTP/1.1 405 Method Not Allowed\r\nAllow: POST, OPTIONS\r\nContent-Length: 0\r\nConnection: close\r\n\r\n" as *u8) } 2408 if ta_streq_n(path, plen, "/api/cap/issue" as *u8) == 1 { if is_post == 1 { return ta_cap_issue(req, req_n, out) } } 2409 if ta_streq_n(path, plen, "/api/cap/revoke" as *u8) == 1 { if is_post == 1 { return ta_cap_revoke(req, req_n, out) } } 2410 if ta_streq_n(path, plen, "/api/cap/status" as *u8) == 1 { if is_get == 1 { return ta_cap_status(out) } } 2411 if ta_streq_n(path, plen, "/api/cap/consent-log" as *u8) == 1 { if is_get == 1 { return ta_cap_consent_log(out) } } 2412 if ta_streq_n(path, plen, "/.well-known/oauth-protected-resource" as *u8) == 1 { if is_get == 1 { return ta_oauth_prm(out) } } 2413 if ta_streq_n(path, plen, "/.well-known/oauth-authorization-server" as *u8) == 1 { if is_get == 1 { return ta_oauth_asmeta(out) } } 2414 if ta_streq_n(path, plen, "/oauth/register" as *u8) == 1 { if is_post == 1 { return ta_oauth_register(req, req_n, out) } } 2415 if ta_streq_n(path, plen, "/oauth/authorize" as *u8) == 1 { if is_get == 1 { return ta_oauth_authorize(req, req_n, out) } } 2416 if ta_streq_n(path, plen, "/oauth/approve" as *u8) == 1 { if is_post == 1 { return ta_oauth_approve(req, req_n, out) } } 2417 if ta_streq_n(path, plen, "/oauth/token" as *u8) == 1 { if is_post == 1 { return ta_oauth_token(req, req_n, out) } } 2418 if ta_streq_n(path, plen, "/api" as *u8) == 1 { if is_get == 1 { return ta_index(out) } } 2419 if ta_streq_n(path, plen, "/" as *u8) == 1 { if is_get == 1 { return ta_index(out) } } 2420 return ta_emit_lit(out, "HTTP/1.1 404 Not Found" as *u8, "{\"error\":\"not_found\"}" as *u8) 2421} 2422// production-prefix convenience wrapper (the real registry). 2423func ta_handle(req: *u8, req_n: i64, out: *u8) -> i64 { return ta_handle_pfx(TA_TOOLPFX, req, req_n, out) } 2424 2425func ta_claim_meta(jb:*u8,b:i64,jid:i64,elapsed:i64,published:i64,has_meta:i64)->i64{ 2426 // These callers have just closed result._meta/result/root (or result/root 2427 // for an allowlist refusal). Extend the existing metadata without replacing it. 2428 var p:i64=b-2-has_meta 2429 if p<0{return b} 2430 if has_meta==1{p=ta_cat(jb,p,",")}else{p=ta_cat(jb,p,",\"_meta\":{")} 2431 p=ta_cat(jb,p,"\"job\":");p=ta_catn(jb,p,jid) 2432 p=ta_cat(jb,p,",\"reservation_elapsed_ms\":");p=ta_catn(jb,p,elapsed) 2433 p=ta_cat(jb,p,",\"publication_verified\":") 2434 if published==1{p=ta_cat(jb,p,"true")}else{p=ta_cat(jb,p,"false")} 2435 return ta_cat(jb,p,"}}}") 2436}