code wiki / _hdl_build / nx_api_harden_gate.nx

nx_api_harden_gate.nx

buildroot/runtime/_hdl_build/nx_api_harden_gate.nx

3953 B66 linesdepth 3pulls 3 transitivereach 0 importersview sourcekind gate/prooftopic api

docs dependencies structs consts functions

about

nx_api_harden_gate.nx -- GATE: the remaining S-class remote-access gaps (sovereign WAF + tamper-evident audit + mTLS). T1 WAF -- normal request allowed; over-rate / oversized / bad-pattern all blocked. T2 AUDIT -- a 4-entry hash-chained log verifies intact; tampering ONE past entry breaks the final hash (detected). T3 mTLS -- a CA-signed client cert is accepted; an unsigned/forged cert is rejected. T4 NEVER-BRICK- deterministic. GREEN iff all. Sovereign nx_cc->nxasm. With nx_relay these close the remote-access census GAPs -> full S-class. expect_exit: 0 license_tier: ORIGINAL

dependencies 2 imports · 0 importers

imports: nx_api_harden.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

none

functions

10	func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 2: wn main calls 1: sys_write
11	func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as u8);m=0-m} let t:u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } called by 1: main calls 3: w sys_mmap sys_write
13	func main() -> i64 calls 9: w waf_allow wn sys_mmap audit_final audit_verify+3