DECnet Phase IV lane: live NSP link + NCP config + CTERM $SET HOST + first real-VAX adjacency

CMakeLists.txt

@@ -1080,7 +1080,15 @@ if(BUILD_TOOLS)
         vms_sysgen           # SYSGEN.EXE
         vms_cnxtrace         # CNXTRACE.EXE
         PARTS                # PARTS.EXE
+        ncp_exe              # NCP.EXE
     )
+    # NCP.EXE (rd vms-1e9): the DECnet Phase IV Network Control Program
+    # (SET/DEFINE/SHOW/CLEAR NODE, SET/SHOW EXECUTOR). Portable C (stdio + the
+    # node database) with no arch-specific code, so it ships on BOTH arches --
+    # the configuration surface a DECnet manager uses to build the node database.
+    # (The DECNETD.EXE network daemon is deliberately NOT in this aggregate yet:
+    # its AF_PACKET/PTY path needs the netbsd-vax userspace port + a booted proof
+    # before it ships -- tracked under vms-30e, not an allowlist gap.)
 
     # CNXTRACE.EXE is in the aggregate on PURPOSE, on both arches (E69). It
     # reads the connection manager's join transition ring out of the executive

distro/Dockerfile.bootable

@@ -48,7 +48,7 @@
 # link-native-cmake-x86_64 job uses; OVMX_LINK_NATIVE auto-detects ON only
 # when `$CC -dumpmachine` reports an aarch64/x86_64 *-musl triple, which
 # Ubuntu's musl-gcc wrapper does not.
 FROM --platform=linux/amd64 alpine:3.20 AS link-native
 
 RUN apk add --no-cache cmake gcc g++ musl-dev binutils make linux-headers
 
@@ -622,6 +622,15 @@
     # stages build-static/bin/LIBRARIAN.EXE, so the path + presence are proven.
     cp build-static/bin/LIBRARIAN.EXE  /system-stage/vms/SYS0/SYSCOMMON/SYSEXE/ 2>/dev/null ; \
     cp build-static/bin/OVMXDUMP       /system-stage/vms/SYS0/SYSCOMMON/SYSEXE/ 2>/dev/null ; \
+    # DECnet Phase IV: ship the NCP configuration utility on the running system
+    # so an admin can build the node database (DEFINE NODE) + set the executor.
+    # NCP.EXE is portable C and ships on BOTH arches (see the ovmx-images vax
+    # aggregate). The DECNETD.EXE network daemon is NOT staged yet: its AF_PACKET
+    # datalink + PTY login path need the netbsd-vax userspace port + a booted
+    # proof before it ships (rd vms-30e); staging it x86-only would be an unbuilt
+    # parity gap, which the #589 allowlist forbids. Plain `cp ... SYSEXE/` form so
+    # the image-parity scanner sees it.
+    cp build-static/bin/NCP.EXE        /system-stage/vms/SYS0/SYSCOMMON/SYSEXE/ 2>/dev/null ; \
     # TCC.EXE (compiler) + LINK.EXE (linker) -- the self-host toolchain on the
     # shipped disk (vms-992e). LINK.EXE comes from build-static (BUILD_TOOLS
     # vmslink target); TCC.EXE from the mk_tcc_static.sh step above. LIBRARIAN.EXE
@@ -1019,8 +1028,8 @@
 # (no --build-arg) stages nothing and boots with auth_group=0, byte-identical
 # to today. Only a caller who explicitly names a real cluster's group (e.g.
 # the lab VAX cluster's group 257) gets a CLUSTER_AUTHORIZE.DAT written.
 ARG CLUSTER_AUTH_GROUP=0
 ARG CLUSTER_AUTH_PASSWORD=""
 
 RUN mkdir -p /initramfs-slim/dev /initramfs-slim/proc /initramfs-slim/sys \
              /initramfs-slim/tmp /initramfs-slim/var /initramfs-slim/mnt \
@@ -1232,7 +1241,7 @@
 # boot.sh mounts a host directory at /data so the container owns the disk
 # file and can write freely (avoids rootless Docker permission issues).
 # When run standalone (no /data mount), falls back to /tmp/sysdisk.img.
 CMD ARCH=$(uname -m) && \
     if [ "$ARCH" = "aarch64" ] || [ "$ARCH" = "arm64" ]; then \
         QEMU=qemu-system-aarch64; \
         MACHINE="-machine virt -cpu cortex-a57"; \

docs/compat/facilities/decnet.yaml

@@ -6,23 +6,31 @@ vms_ref: "DECnet for OpenVMS Networking Manual; DNA Phase IV Routing + NSP specs
 scope_1_0: in
 plan_ref: vms-30e
 summary: >
-  No longer greenfield: src/vmsdecnet now carries real, clean-room Phase IV
-  wire codecs and a routing adjacency engine, several oracle-verified
-  byte-identical against captures committed in docs/decnet-provenance-register.md
-  (lab specimens, rd vms-3be/PR #665). Present: the Ethernet Endnode Hello
-  codec (oracle-verified), the Router Hello codec (spec-derived), the routing
-  adjacency state machine + hello/listen timers, and the NSP transport codec
-  (Connect Initiate oracle-verified; other PDUs self-round-trip). NOT yet
-  wired: a live engine/socket — nothing drives a real logical link, so
-  task-to-task and a working SET HOST do not exist. SET HOST still honestly
-  reports unavailability; NODE"acc"::file filespec syntax parses but nothing
-  downstream acts on it. 1.0 blocker (vms-30e).
-last_reviewed: 2026-08-31
+  No longer greenfield, and no longer codec-only: src/vmsdecnet now carries
+  real clean-room Phase IV codecs AND a live engine (DECNETD.EXE) that moves
+  frames over a real AF_PACKET datalink. Proven on real wires: the Ethernet
+  Endnode Hello codec (oracle-verified) drives adjacency against the REAL lab
+  VAX node 1.1 on the lab-2 br0 (OVMX emits faithful hellos and its engine
+  registers the VAX; tests/lab/tools/decnet_adjacency.sh, capture 2026-09-07),
+  and an NSP LOGICAL LINK completes end-to-end over a real datalink —
+  Connect Initiate/Confirm, a byte-identical data segment + ack, and a clean
+  Disconnect — between two engines (tests/integration/decnet_nsp_live_datalink.sh,
+  veth). Also present: the Router Hello codec (spec-derived) and the routing
+  adjacency state machine. STILL a codec-only / not-wired seam above the link:
+  a real VAX does not yet list OVMX as a reachable endnode (needs the node DB +
+  reachability wiring; parked on wedged lab consoles), task-to-task is only a
+  raw data segment (no $QIO/object DB/FAL), SET HOST is still an honest stub,
+  and NODE"acc"::file syntax parses but nothing downstream acts on it. 1.0
+  blocker (vms-30e).
+last_reviewed: 2026-09-07
 items:
   - {id: decnet$routing-hello, kind: protocol, status: verified, authenticity: real, vms: "Phase IV Ethernet Endnode Hello codec (encode/decode)", evidence: "src/vmsdecnet/routing/dnet_hello.c", verified_against: "docs/decnet-provenance-register.md sec 4.6 specimen #1 (lab capture, rd vms-3be/PR #665) round-tripped byte-identical by tests/vmsdecnet/test_dnet_hello.c", notes: "Pure byte-layout library, no socket/allocation; field-by-field mapped to the committed capture."}
   - {id: decnet$router-hello, kind: protocol, status: implemented, authenticity: real, vms: "Phase IV Ethernet Router Hello codec (encode/decode)", evidence: "src/vmsdecnet/routing/dnet_router_hello.c", notes: "SPEC-DERIVED — no committed router-hello wire specimen exists, so not oracle-anchored; self round-trips in tests/vmsdecnet/test_dnet_router_hello.c (rd vms-0aba)."}
   - {id: decnet$routing-adjacency, kind: feature, status: implemented, authenticity: real, vms: "Phase IV routing adjacency state machine (DOWN/INITIALIZING/UP) + hello cadence / listen timers", evidence: "src/vmsdecnet/routing/dnet_adjacency.c", notes: "Pure clock-injectable SM over the Hello codec; T3=15s oracle-captured (vms-3be), BCT3MULT spec-derived. Tested tests/vmsdecnet/test_dnet_adjacency.c (rd vms-b15)."}
-  - {id: decnet$nsp-transport, kind: protocol, status: partial, authenticity: real, vms: "NSP transport codec — Connect Initiate/Confirm, Data, Ack, teardown PDUs (logical links)", evidence: "src/vmsdecnet/nsp/dnet_nsp.c", notes: "Connect Initiate is oracle-verified byte-identical against docs/decnet-provenance-register.md sec 4.6 specimen #3 (the lab handshake never completed, so the other PDUs are self-round-trip only, no fabricated specimen bytes). Codec only — no live transport engine drives a logical link yet. Tested tests/vmsdecnet/test_dnet_nsp.c (rd vms-6986)."}
-  - {id: decnet$task-to-task, kind: feature, status: absent, authenticity: n/a, vms: "Task-to-task DECnet communication (logical-link $QIO / FAL)", evidence: "docs/design-decnet-ovmx.md", scope_1_0: in, notes: "The codecs exist but the engine boundary has not moved — no socket/AF_PACKET engine binds them into a live link."}
-  - {id: decnet$set-host, kind: command, status: stub, authenticity: real, vms: "SET HOST — DECnet remote-node connection", evidence: "src/vmsdcl/dcl_cmd_set.c", notes: "Honestly reports %SET-I-NOTAVAIL, DECnet is not available on this system — a stub, not a facade."}
+  - {id: decnet$nsp-transport, kind: protocol, status: implemented, authenticity: real, vms: "NSP transport codec + live logical-link connection service over the datalink", evidence: "src/vmsdecnet/engine/decnetd.c", notes: "The connection FSM (src/vmsdecnet/nsp/dnet_link.c: CI/CC/DATA/ACK/DI/DC + retransmit/give-up) is now DRIVEN OVER A REAL AF_PACKET DATALINK by DECNETD's live loop (--connect/--listen), not only a socketpair: an end-to-end link OPEN -> byte-identical data segment + ack -> clean DISCONNECT is proven over a veth wire in tests/integration/decnet_nsp_live_datalink.sh (rd vms-c23). Oracle scope unchanged: only the Connect Initiate bytes are oracle-verified (register sec 4.6 specimen #3); CC/DATA/ACK/DI/DC are spec-derived and proven by round-trip, no fabricated specimen bytes. Unit: tests/vmsdecnet/test_dnet_nsp.c + test_dnet_link.c (rd vms-6986/vms-c23)."}
+  - {id: decnet$task-to-task, kind: feature, status: partial, authenticity: real, vms: "Task-to-task DECnet communication (logical-link data; $QIO / FAL)", evidence: "src/vmsdecnet/engine/decnetd.c", scope_1_0: in, notes: "A raw application data segment now round-trips byte-identical over a LIVE NSP logical link between two engines on a real datalink (tests/integration/decnet_nsp_live_datalink.sh; the substrate exists). NOT yet built: the VMS $QIO task-to-task API, a named-object/listener database, and FAL file access — those are later rungs (vms-8c2/vms-230)."}
+  - {id: decnet$ncp, kind: command, status: partial, authenticity: real, vms: "NCP — Network Control Program (node/executor configuration)", evidence: "src/vmsdecnet/ncp/ncp.c", notes: "Real NCP.EXE driving a persisted database: SET/DEFINE NODE, CLEAR/PURGE NODE, SHOW KNOWN NODES, SHOW NODE, SET/SHOW EXECUTOR (ADDRESS/NAME/STATE), with VMS-faithful SHOW layout and honest errors. Grammar/layout from the public NCP manual (Rule 8). NOT yet: circuits, objects, lines, counters, LOOP, and the SET(volatile)/DEFINE(permanent) split — OVMX keeps one persisted DB today. Config-only; it does not itself start the network."}
+  - {id: decnet$node-database, kind: feature, status: implemented, authenticity: real, vms: "Persisted remote-node database + node NAME<->address resolution", evidence: "src/vmsdecnet/ncp/dnet_nodedb.c", notes: "The NCP node table: add/update/clear, case-insensitive unique node names, ascending-address SHOW ordering, and persistence (atomic save + tolerant load). Provides the name<->address resolution the SET HOST / NODE:: paths need. On-disk format is a documented OVMX plain-text layout (labelled — NOT VMS NETNODE_REMOTE.DAT binary). Unit: tests/vmsdecnet/test_dnet_nodedb.c (rd vms-1e9)."}
+  - {id: decnet$cterm-service, kind: feature, status: implemented, authenticity: real, vms: "CTERM terminal service — an interactive $ SET HOST session over a live NSP logical link", evidence: "src/vmsdecnet/engine/decnetd.c", notes: "DECNETD --set-host <a.n> (CTERM TERMINAL, real stdin/stdout) and --cterm-server (CTERM HOST that openpty+fork+execs a real login-command, default vmsdcl --login) carry a GENUINE interactive program's bidirectional I/O over the live datalink: link to CTERM object 42 -> Bind/Accept -> characteristics -> the spawned program's real output reaches the client AND the client's real keystrokes reach the program (proven both directions, incl. an independent side-channel, in tests/integration/decnet_set_host_live.sh over veth; capture docs/../decnet-set-host-live-20260908). NOT yet: the DCL `SET HOST` command wiring + name resolution (decnet$set-host), the real vmsdcl --login integration + proof (needs a booted OVMX env: SYSUAF/DCL/logicals), CTERM read-solicitation flow (byte-transparent pump today), and multi-link scope. CTERM wire bytes remain SPEC-DERIVED (no oracle specimen; register sec 4.7) -- unchanged by this work."}
+  - {id: decnet$set-host, kind: command, status: stub, authenticity: real, vms: "SET HOST — DECnet remote-node connection (DCL command)", evidence: "src/vmsdcl/dcl_cmd_set.c", notes: "The DCL `$ SET HOST` command still honestly reports %SET-I-NOTAVAIL — a stub, not a facade. The underlying capability now EXISTS (decnet$cterm-service: DECNETD --set-host carries a real CTERM session over the live link); wiring the DCL command to resolve the node name via the node database (decnet$node-database) and invoke it is the next rung (vms-230/vms-4d2), best completed + proven in a booted OVMX env."}
   - {id: decnet$node-filespec-syntax, kind: feature, status: partial, authenticity: real, vms: "NODE\"acc\"::dev:[dir]file filespec syntax", evidence: "src/vmsrms/rms_parse.c", notes: "Syntax only — sets NAM$M_NODE, parses/reconstructs the node prefix; nothing downstream (no live DECnet transport) acts on it."}