nx_uat_run.nx source

1// nx_uat_run.nx -- THE CONSUMER UAT RUNNER (operator doctrine 2026-08-02: digital-twin, see it -> 2// log it -> work it -> UAT it, on cadence -- the loop a team of people AND consumers would run). 3// Walks knowledge/uat_journeys.conf (id|url|connect|latency_ms_max|must_contain), fetches each 4// journey through the REAL sovereign edge by forking the promoted nx_https_get.elf (the same bytes a 5// user's request traverses), measures WALL latency as a human feels it, checks HTTP 200 + the content 6// the human came for, and journals ONE frame per journey to knowledge/status/uat.jrnl (append-only). 7// A journey slower than its bar FAILS even if the bytes are perfect: the bar is the consumer's 8// patience, not the backend's throughput (seeded by the 8845ms SERP finding, 2026-08-02). 9// Bars/journeys live in DATA (rule 11): expanding UAT = adding a conf row, never a code change. 10// license_tier: ORIGINAL expect_exit: 0 when every journey passes 11import "nx_syscalls.nx" 12import "nx_estate_path.nx" // ep_anchor: the CWD must not decide this organ's verdict 13import "nx_gate_verdict.nx" 14 15// Negative by construction so it can never be mistaken for a wait-status: exit codes occupy 0..255 and 16// a signalled child already returns 128+sig from ua_fetch. 17const UA_FORK_FAILED: i64 = 0 - 1 18 19// THE FETCHER, NAMED ONCE. This organ forked "nx_https_get.elf" and that binary is SUPERSEDED: 20// MEASURED 2026-08-17 at the serving root, nx_https_get.elf = 468,929 B while the MCP registry 21// resolves the tool nx_https_get to nx_https_get_cli2.elf = 573,420 B (a third, nx_https_get_cli.elf 22// = 573,998 B, also exists). The stale one RUNS, EXITS 0, AND WRITES ZERO BYTES, which this runner 23// then recorded as `ms=0 http200=0 content=0 rc=0` -- i.e. as the ESTATE being down. 24// ★★★★★★A SUPERSEDED BINARY THAT STILL EXISTS IS WORSE THAN A DELETED ONE: A MISSING FORK TARGET AT 25// LEAST FAILS (exit 127), WHILE A STALE ONE SUCCEEDS SILENTLY AND ITS EMPTY OUTPUT IS RECORDED AS A 26// FACT ABOUT THE WORLD. That is how this monitor published "all four journeys FAIL" for ten days 27// while curl from the user's own vantage returned 200 in 42-54ms, four for four. 28// ⚠THE SAME STALE PATH IS FORKED BY AT LEAST FIVE SIBLINGS -- nx_route_diff, nx_ui_struct, 29// nx_ui_tdist, nx_ui_zss, nx_langintel_gh_fetch all name /volume1/.../nx_https_get.elf. Repointing 30// this one organ fixes THIS monitor and leaves that sweep owed; it is filed rather than assumed done. 31// ⚠AND HARDCODING cli2 ONLY MOVES THE PROBLEM TO cli3. The durable fix is for a forker to resolve the 32// fetcher the way the REGISTRY does (match the resolver you report on), which no organ can do today; 33// naming it in one constant is the smallest change that makes the next rename a one-line edit 34// instead of a silent ten-day outage. 35const UA_FETCHER: *u8 = "nx_https_get_cli2.elf" as *u8 36 37func ua_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 38 39func ua_find(hay: *u8, n: i64, needle: *u8) -> i64 { 40 let nl: i64 = ua_slen(needle) 41 if nl == 0 { return 0 - 1 } 42 var i: i64 = 0 43 while i + nl <= n { 44 var j: i64 = 0 45 var hit: i64 = 1 46 while j < nl { if hay[i+j] != needle[j] { hit = 0; j = nl } else { j = j + 1 } } 47 if hit == 1 { return i } 48 i = i + 1 49 } 50 return 0 - 1 51} 52 53func ua_atoi(s: *u8) -> i64 { 54 var v: i64 = 0 55 var i: i64 = 0 56 while s[i] != (0 as u8) { 57 let c: i64 = s[i] as i64 58 if c >= 48 { if c <= 57 { v = v * 10 + (c - 48) } } 59 i = i + 1 60 } 61 return v 62} 63 64// fork the promoted fetcher, stdout -> out_path; returns exit code (128+sig on signal) 65// A FORK THAT NEVER HAPPENED IS NOT A SITE THAT IS DOWN. 66// The fork result was NEVER CHECKED: on failure sys_fork() returns a negative pid, the child block is 67// skipped, and sys_wait4(<negative>, st, 0) waits for ANY child rather than the one we meant. st stays 68// 0, so this returned rc=0 -- SUCCESS -- having fetched nothing at all. 69// MEASURED 2026-08-17: every journey reported `ms=0 http200=0 content=0 rc=0` and the runner published 70// `passed 0/4 verdict=RED` while curl from the user's own vantage returned 200 in 42-54ms, four for 71// four. ms is REAL wall time (sys_now_us around this call), and no HTTPS round trip completes in under 72// a millisecond -- an execve failure would have surfaced as rc=127 and an unwritable out_path would 73// still have cost the ~850ms of a real fetch. Only an unchecked fork explains rc=0 AND ms=0 together. 74// WHY IT MATTERS MORE THAN THE MISSING RETURN VALUE: this organ is the estate's CONSUMER AVAILABILITY 75// MONITOR, and the host has been running at load_centi 1400-1700 with 2600+ processes, which is 76// precisely when fork fails -- so the instrument breaks in exactly the conditions it exists to observe, 77// and reports the estate as down when the truth is that the monitor could not run its own probe. 78// ★★★★★★AN INSTRUMENT THAT CANNOT RUN ITS PROBE MUST SAY SO, NOT REPORT THE SUBJECT AS DOWN -- 79// the third state is what separates "the site failed" from "I never asked it". 80// UA_FORK_FAILED is negative so it cannot collide with any of the 0..255 wait-status exit codes, and 81// with 128+sig, which this function already returns for a signalled child. 82func ua_fetch(url: *u8, conn: *u8, out_path: *u8) -> i64 { 83 let pid: i64 = sys_fork() 84 if pid < 0 { return UA_FORK_FAILED } 85 if pid == 0 { 86 let out: i64 = sys_openat_wr(out_path, 0x1a4) 87 if out >= 0 { sys_dup3(out, 1, 0) } 88 let argv: *i64 = sys_mmap(8 * 4) as *i64 89 argv[0] = UA_FETCHER as i64 90 argv[1] = url as i64 91 var na: i64 = 2 92 if conn[0] != (45 as u8) { argv[2] = conn as i64; na = 3 } 93 argv[na] = 0 94 let envp: *i64 = sys_mmap(16) as *i64 95 envp[0] = "PATH=/usr/bin:/bin" as *u8 as i64 96 envp[1] = 0 97 sys_execve(UA_FETCHER, argv, envp) 98 sys_exit(127) 99 } 100 let st: *i64 = sys_mmap(16) as *i64 101 sys_wait4(pid, st, 0) 102 if (st[0] & 0x7f) != 0 { return 128 + (st[0] & 0x7f) } 103 return (st[0] >> 8) & 0xff 104} 105 106func ua_journal(id: *u8, ok: i64, ms: i64) -> i64 { 107 let fd: i64 = sys_openat_append("knowledge/status/uat.jrnl" as *u8, 0x1a4) 108 if fd < 0 { return 0 } 109 let ln: *u8 = sys_mmap(512) 110 var o: i64 = gv_catn(ln, 0, sys_now_realtime_sec()) 111 ln[o] = 9 as u8; o = o + 1 112 o = gv_cat(ln, o, "uat" as *u8) 113 ln[o] = 9 as u8; o = o + 1 114 o = gv_cat(ln, o, id) 115 ln[o] = 9 as u8; o = o + 1 116 o = gv_cat(ln, o, "run" as *u8) 117 ln[o] = 9 as u8; o = o + 1 118 // THREE STATES, and UNOBSERVED is written as its own token rather than folded into FAIL. A reader 119 // tallying FAIL over this journal was, for the last ten days, counting probes that never ran as 120 // outages of the estate. ★UNKNOWN IS ITS OWN BUCKET -- the bucket an unrecognised value lands in 121 // becomes the number somebody plans against. Additive per rule 19: PASS and FAIL are unchanged, so 122 // every existing reader keeps parsing exactly what it did. 123 if ok == 1 { o = gv_cat(ln, o, "PASS" as *u8) } 124 if ok == 0 { o = gv_cat(ln, o, "FAIL" as *u8) } 125 if ok == UA_FORK_FAILED { o = gv_cat(ln, o, "UNOBSERVED" as *u8) } 126 ln[o] = 9 as u8; o = o + 1 127 o = gv_cat(ln, o, "ms=" as *u8) 128 o = gv_catn(ln, o, ms) 129 ln[o] = 10 as u8; o = o + 1 130 sys_write(fd, ln, o) 131 sys_close(fd) 132 return 0 133} 134 135func main() -> i64 { 136 // ANCHOR FIRST (2026-08-04, nx_cwdguard finding): this organ reads a RELATIVE 137 // knowledge/ path, so its answer depended on where it was launched. No-op when 138 // already at the estate root, so the cron/MCP context is unchanged. 139 ep_anchor() 140 gv_puts("=== NX-UAT-RUN: consumer journeys through the REAL edge (see it, log it, UAT it) ===\n" as *u8) 141 let box: *i64 = sys_mmap(16) as *i64 142 let cf: *u8 = sys_read_file("knowledge/uat_journeys.conf" as *u8, box) 143 if (cf as i64) == 0 { gv_puts("UAT-RUN RED: journeys conf ABSENT (a loop with no journeys is a wish)\n" as *u8); return 3 } 144 let cn: i64 = box[0] 145 let ctr: *i64 = gv_ctr() 146 let idb: *u8 = sys_mmap(128) 147 let urlb: *u8 = sys_mmap(512) 148 let connb: *u8 = sys_mmap(128) 149 let latb: *u8 = sys_mmap(64) 150 let needb: *u8 = sys_mmap(256) 151 let outp: *u8 = sys_mmap(64) 152 let obox: *i64 = sys_mmap(16) as *i64 153 var jn: i64 = 0 154 var unobs_n: i64 = 0 155 var i: i64 = 0 156 while i < cn { 157 var e: i64 = i 158 while e < cn { if cf[e] == (10 as u8) { break } e = e + 1 } 159 if e > i { if cf[i] != (35 as u8) { 160 // split on | into 5 fields 161 let fs: *i64 = sys_mmap(8*6) as *i64 162 var nf: i64 = 0 163 fs[0] = i 164 var p: i64 = i 165 while p < e { if cf[p] == (124 as u8) { if nf < 4 { nf = nf + 1; fs[nf] = p + 1 } } p = p + 1 } 166 if nf == 4 { 167 var q: i64 = 0 168 q = 0; var s: i64 = fs[0]; while s < fs[1]-1 { if q < 127 { idb[q]=cf[s]; q=q+1 } s=s+1 } idb[q]=0 as u8 169 q = 0; s = fs[1]; while s < fs[2]-1 { if q < 511 { urlb[q]=cf[s]; q=q+1 } s=s+1 } urlb[q]=0 as u8 170 q = 0; s = fs[2]; while s < fs[3]-1 { if q < 127 { connb[q]=cf[s]; q=q+1 } s=s+1 } connb[q]=0 as u8 171 q = 0; s = fs[3]; while s < fs[4]-1 { if q < 63 { latb[q]=cf[s]; q=q+1 } s=s+1 } latb[q]=0 as u8 172 q = 0; s = fs[4]; while s < e { if q < 255 { needb[q]=cf[s]; q=q+1 } s=s+1 } needb[q]=0 as u8 173 let latmax: i64 = ua_atoi(latb) 174 var o2: i64 = gv_cat(outp, 0, "/tmp/uat_j" as *u8) 175 o2 = gv_catn(outp, o2, jn) 176 o2 = gv_cat(outp, o2, ".out" as *u8) 177 outp[o2] = 0 as u8 178 let t0: i64 = sys_now_us() 179 let rc: i64 = ua_fetch(urlb, connb, outp) 180 let ms: i64 = (sys_now_us() - t0) / 1000 181 var http_ok: i64 = 0 182 var body_ok: i64 = 0 183 let ob: *u8 = sys_read_file(outp, obox) 184 if (ob as i64) != 0 { 185 if ua_find(ob, obox[0], "HTTP/1.1 200" as *u8) >= 0 { http_ok = 1 } 186 if ua_find(ob, obox[0], needb) >= 0 { body_ok = 1 } 187 } 188 var ok: i64 = 0 189 if rc == 0 { if http_ok == 1 { if body_ok == 1 { if ms <= latmax { ok = 1 } } } } 190 // UNOBSERVED IS ITS OWN BUCKET. A probe that could not be launched says NOTHING about 191 // the estate, so it must not be counted as a failing journey -- doing so is how a 192 // monitor that cannot fork publishes "the site is down" and, worse, becomes a detector 193 // that is permanently RED and therefore ignored. 194 var unobs: i64 = 0 195 if rc == UA_FORK_FAILED { unobs = 1; ok = UA_FORK_FAILED } 196 gv_puts(" journey " as *u8); gv_puts(idb) 197 gv_puts(": ms=" as *u8); gv_num(ms) 198 gv_puts(" bar=" as *u8); gv_num(latmax) 199 gv_puts(" http200=" as *u8); gv_num(http_ok) 200 gv_puts(" content=" as *u8); gv_num(body_ok) 201 gv_puts(" rc=" as *u8); gv_num(rc) 202 if unobs == 1 { gv_puts(" UNOBSERVED (fork refused -- the probe never ran; this is NOT a verdict about the site)" as *u8) } 203 gv_puts("\n" as *u8) 204 // The tooth counter only sees journeys that were actually attempted, so `passed n/m` 205 // keeps meaning "of the journeys I could run" rather than "of the journeys I meant to 206 // run". The unobserved ones are journalled under their own token and counted separately 207 // below, so they are never silently dropped either. 208 if unobs == 0 { gv_check(idb, ok, ctr) } 209 if unobs == 1 { unobs_n = unobs_n + 1 } 210 ua_journal(idb, ok, ms) 211 jn = jn + 1 212 } 213 } } 214 i = e + 1 215 } 216 if jn == 0 { gv_puts("UAT-RUN RED: zero journeys parsed\n" as *u8); return 3 } 217 // THE HORIZON, PRINTED. attempted/unobserved travels with the verdict so nobody has to infer which 218 // population `passed n/m` was over. If EVERY journey was unobservable the runner has measured 219 // nothing at all, and saying GREEN or RED there would both be lies -- so it refuses with its own 220 // exit code instead. ★AN AXIS THAT CANNOT SEE MUST ABSTAIN, NOT ACQUIT -- and not convict either. 221 gv_puts(" journeys=" as *u8); gv_num(jn) 222 gv_puts(" attempted=" as *u8); gv_num(jn - unobs_n) 223 gv_puts(" unobserved=" as *u8); gv_num(unobs_n) 224 gv_puts("\n" as *u8) 225 if unobs_n == jn { 226 gv_puts("UAT-RUN UNPROVEN: every probe failed to FORK -- the host refused to launch them, so this\n" as *u8) 227 gv_puts(" run is a statement about THIS HOST'S CAPACITY, not about the estate's availability.\n" as *u8) 228 gv_puts(" Re-run when load_centi is low; a monitor that cannot start its probe must never publish RED.\n" as *u8) 229 return 4 230 } 231 return gv_verdict("UAT-RUN" as *u8, ctr, "every consumer journey inside its human-patience bar with the content the human came for" as *u8) 232}