nx_wasm_promote.nx source

1// nx_wasm_promote.nx -- GATE-CHECKED promotion of the video client core: staged.wasm -> live wasm, 2// as an ECOSYSTEM ORGAN (operator 2026-07-02: no shell -- this retires Copy-Item + manual verify). 3// DEPLOY-GATING BUILT IN (rule: read agent/gate output before shipping, mechanically): 4// 1. the sovereign VM gate's LAST verdict must be GREEN (gg_gate_green over vc_wasm_vm.log) 5// 2. copy web_assets/nx_video_client.staged.wasm -> web_assets/nx_video_client.wasm 6// 3. RE-READ the destination and byte-compare (a promote that did not land is not a promote) 7// 4. append one receipt line -> knowledge/status/wasm_promote.log 8// A RED VM gate REFUSES the promote (the anti-blind-deploy control). expect_exit: 0 9// license_tier: ORIGINAL 10import "nx_syscalls.nx" 11import "nx_gate_green.nx" 12 13func pw3(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 14func pn3(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(fd,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(fd,bb,k); return 0 } 15 16func main() -> i64 { 17 pw3(1, "=== nx_wasm_promote: staged core -> live (VM-gate-checked, byte-verified) ===\n") 18 // 1. the VM gate must be GREEN -- otherwise REFUSE (no blind deploys) 19 if gg_gate_green("knowledge/status/vc_wasm_vm.log" as *u8, "VC-WASM-VM" as *u8, "verdict=GREEN" as *u8) != 1 { 20 pw3(1, "REFUSED: vc_wasm_vm.log last verdict is not GREEN -- run nx_video_client_wasm_vm_gate first\n") 21 let rf: i64 = sys_openat_append("knowledge/status/wasm_promote.log" as *u8, 420) 22 if rf >= 0 { pw3(rf, "WASMPROMOTE refused=vm-gate-not-green verdict=RED\n"); sys_close(rf) } 23 return 1 24 } 25 pw3(1, " VM gate: GREEN (last verdict)\n") 26 // 2. copy staged -> live 27 let box: *i64 = sys_mmap(16) as *i64 28 let src: *u8 = sys_read_file("web_assets/nx_video_client.staged.wasm" as *u8, box) 29 if (src as i64)==0 { pw3(1, "no staged.wasm\n"); return 1 } 30 let n: i64 = box[0] 31 let fd: i64 = sys_openat_wr("web_assets/nx_video_client.wasm" as *u8, 0x1a4) 32 if fd < 0 { pw3(1, "cannot open destination\n"); return 1 } 33 var wr: i64 = 0 34 while wr < n { 35 let w: i64 = sys_write(fd, src + wr, n - wr) 36 if w <= 0 { sys_close(fd); pw3(1, "short write\n"); return 1 } 37 wr = wr + w 38 } 39 sys_close(fd) 40 // 3. re-read + byte-verify 41 let box2: *i64 = sys_mmap(16) as *i64 42 let dst: *u8 = sys_read_file("web_assets/nx_video_client.wasm" as *u8, box2) 43 var same: i64 = 0 44 if (dst as i64) != 0 { if box2[0] == n { 45 same = 1 46 var i: i64 = 0 47 while i < n { if dst[i] != src[i] { same = 0; i = n } else { i = i + 1 } } 48 } } 49 pw3(1, " promoted "); pn3(1, n); pw3(1, "B, re-read byte-identical="); pn3(1, same); pw3(1, "\n") 50 // 4. receipt 51 let lf: i64 = sys_openat_append("knowledge/status/wasm_promote.log" as *u8, 420) 52 if lf >= 0 { 53 pw3(lf, "WASMPROMOTE epoch="); pn3(lf, sys_now_realtime_sec()); pw3(lf, " bytes="); pn3(lf, n); pw3(lf, " verified="); pn3(lf, same) 54 if same==1 { pw3(lf, " verdict=GREEN\n") } else { pw3(lf, " verdict=RED\n") } 55 sys_close(lf) 56 } 57 if same==1 { pw3(1, "WASM-PROMOTE verdict=GREEN -- next: nx_aw_push the live wasm to the NAS\n"); return 0 } 58 pw3(1, "WASM-PROMOTE verdict=RED\n") 59 return 1 60}