numos/seed.py

back to source

# SPDX-License-Identifier: MIT
"""Seed data for the NumericalOS graph quartet.

ARCH_TARGETS is the multi-arch registry. zig_triple is None where no static
build is published yet; the busybox fallback carries those arches, which is
the mechanism by which "all chip infrastructures" stays honest.
"""


def _arch(canonical, aliases, zig_triple, floor_variant):
    # Wire field remains busybox_variant for numos.state A-record compat; the
    # product name is numos-floor (see numos.distro). Values are floor ids.
    return {"canonical": canonical, "aliases": aliases, "zig_triple": zig_triple,
            "busybox_variant": floor_variant, "artifact_sha256": None}


ARCH_TARGETS = [
    _arch("x86_64", ["x86_64", "amd64"], "x86_64-linux-musl", "numos-floor-x86_64"),
    _arch("aarch64", ["aarch64", "arm64"], "aarch64-linux-musl", "numos-floor-aarch64"),
    _arch("riscv64", ["riscv64"], "riscv64-linux-musl", "numos-floor-riscv64"),
    _arch("arm", ["arm", "armv7l", "armv6l", "armhf"], "arm-linux-musleabihf", "numos-floor-armv7l"),
    _arch("powerpc64le", ["ppc64le", "powerpc64le"], "powerpc64le-linux-musl", "numos-floor-ppc64le"),
    _arch("s390x", ["s390x"], "s390x-linux-musl", "numos-floor-s390x"),
    _arch("mips64el", ["mips64el"], "mips64el-linux-musl", "numos-floor-mips64el"),
    _arch("x86", ["x86", "i686", "i386"], "x86-linux-musl", "numos-floor-x86"),
    # loongarch64 Zig target availability is confirmed at build time, not
    # asserted here.
    #
    # HONESTY NOTE. Floor providers with a published multi-call binary are
    # declared in numos.distro.FLOOR_PROVIDERS (x86_64 and i686 today). Other
    # arches resolve in the arch table but need an operator-supplied floor
    # binary until a provider URL+sha256 is pinned in the graph.
    _arch("loongarch64", ["loongarch64"], None, "numos-floor-loongarch64"),
]


def _unit(name, exec_, kind="oneshot", restart="never", requires=None, after=None):
    return {"name": name, "kind": kind, "restart": restart,
            "backoff_ms": 0 if restart == "never" else 100,
            "backoff_max_ms": 0 if restart == "never" else 8000,
            "arch_mask": [], "health_probe": None,
            "requires": requires or [], "after": after or [], "exec": exec_}


INFRA_UNITS = [
    _unit("mount-proc", "mount -t proc proc /proc"),
    _unit("mount-sys", "mount -t sysfs sys /sys"),
    _unit("mount-dev", "mount -t devtmpfs dev /dev"),
    _unit("net-up", "ip link set eth0 up", restart="on-failure",
          requires=["mount-sys"]),
    _unit("clock-sync", "ntpd -n -q", restart="on-failure", after=["net-up"]),
    _unit("identity", "numctl identity-init", requires=["mount-proc"]),
    _unit("join", "numctl join", kind="longrun", restart="always",
          requires=["identity"], after=["net-up", "clock-sync"]),
]

BOOT_PHASES = [
    {"ordinal": 10, "name": "mount", "on_failure": "halt",
     "required_units": ["mount-proc", "mount-sys", "mount-dev"]},
    {"ordinal": 20, "name": "net", "on_failure": "degrade",
     "required_units": ["net-up"]},
    {"ordinal": 30, "name": "clock", "on_failure": "continue",
     "required_units": ["clock-sync"]},
    {"ordinal": 40, "name": "identity", "on_failure": "halt",
     "required_units": ["identity"]},
    {"ordinal": 50, "name": "join", "on_failure": "degrade",
     "required_units": ["join"]},
]


# Health predicates. Until this existed, X records rendered, parsed and
# round-tripped while numinit's health machinery -- numos_health_tick,
# numos_health_fire, threshold counting, local_action dispatch -- ran against
# an always-empty set. The runtime was complete and tested; nothing fed it.
#
# This is the falsifiability pivot. The `join` unit is the one longrun unit in
# the seeded state, and nothing outside the machine observes whether it is
# alive. With no predicate, a node whose join unit died on boot and a node
# whose join unit is healthy produce byte-identical output. The probe below
# makes those two worlds distinguishable from inside the machine, which is the
# most that can honestly be claimed while Capability advertisement is
# unimplemented.
#
# degrade-node rather than restart-unit: the node marks itself degraded so a
# coordinator would stop scheduling onto it. That is the honest local action
# for a liveness failure whose cause this floor cannot diagnose.
HEALTH_PREDICATES = [
    {
        "name": "join-alive",
        "interval_s": 10,
        "threshold": 3,
        "local_action": "degrade-node",
        "on_fire": None,
        "probe": "kill -0 $(cat ${NUMOS_RUNDIR:-/run/numos}/units/join.pid 2>/dev/null) 2>/dev/null",
    },
]