nx_canary_value.nx
buildroot/runtime/nx_canary_value.nx
about
nx_canary_value.nx -- known-value tokens detecting silent tampering.
module: nishi-core.security.canary_value
depends: nishi-core.io.syscalls, nishi-core.io.dir
disk_kb: 4
capability: CRYPTO
wired_status: FULLY_WIRED
(Honest: registry + verify-constant + verify-bytes + verify-file +
scan-files-array + scan-aggregate are all wired AND smoke-verified
via runtime/nx_canary_test.nx PASS on qemu-rv64. Self-consistent
hash test: read a real runtime/ file, compute FNV-1a via
nx_canary_hash_bytes, install canary with that hash, re-verify ->
INTACT. Mutation test: tweak expected hash, re-verify -> VIOLATED.
Aggregate over mixed canary array verdicts correctly.)
license_tier: PUBLIC_NISHI_SUBSTRATE
genealogy_id: nishi_racing_crew_team_honesty_threat_aware_cardinal +
canary_token_pattern_thinkst +
stack_canary_starguard_etoh_2003 +
nishi_no_false_ok_substrate_audit
Per cardinal [[feedback-racing-crew-team-honesty-threat-aware]]:
known-value tokens embedded in catalogs + critical substrate
constants. Any silent modification (by adversarial AI agent /
supply-chain attack / corrupted Wheeler-anchor / disk corruption)
trips the canary on next verification scan.
Two canary classes:
1. EMBEDDED in catalog files (a row with known content; if its
hash changes, something tampered)
2. CONSTANT in substrate primitives (specific magic numbers;
bit-flip detection)
dependencies 2 imports · 1 importers
imports: syscalls.nxnx_dir.nx
imported by: nx_canary_test.nx
structs
| 96 | struct CanaryRecord |
| 215 | struct CanaryScanReport |
consts
| 59 | const NX_MAGIC_1048576: i64 = 1048576 |
| 60 | const NX_MAGIC_65536: i64 = 65536 |
| 64 | const NX_CANARY_INTACT: i64 = 1 |
| 65 | const NX_CANARY_VIOLATED: i64 = 2 // value changed; tampering suspected |
| 66 | const NX_CANARY_MISSING: i64 = 3 // canary row deleted entirely |
| 67 | const NX_CANARY_NOT_VERIFIED: i64 = 4 // scan hasn't run yet |
| 79 | const NX_CANARY_CLASS_CATALOG_ROW: i64 = 1 |
| 80 | const NX_CANARY_CLASS_PRIMITIVE_CONSTANT: i64 = 2 |
| 81 | const NX_CANARY_CLASS_BUILD_ARTIFACT: i64 = 3 // hash of compiled output |
| 82 | const NX_CANARY_CLASS_DEPENDENCY_HASH: i64 = 4 // hash of Wheeler-anchor binary |
| 83 | const NX_CANARY_CLASS_DOCUMENT_HASH: i64 = 5 // hash of substrate roadmap docs |
| 111 | const NX_CANARY_RECORD_BYTES: i64 = 96 // 12 fields * 8 bytes |
| 115 | const NX_CANARY_FNV1A_OFFSET_BASIS: i64 = -3750763034362895579 |
| 116 | const NX_CANARY_FNV1A_PRIME: i64 = 1099511628211 |
| 204 | const NX_CANARY_FNV1A_OFFSET_BASIS_EXPECTED: i64 = -3750763034362895579 |
| 205 | const NX_CANARY_FNV1A_PRIME_EXPECTED: i64 = 1099511628211 |
| 227 | const NX_CANARY_SCAN_REPORT_BYTES: i64 = 72 // 9 fields * 8 bytes |
| 312 | const NX_CANARY_MAX_SCAN_FILES: i64 = 65536 |
functions
| 69 | func nx_canary_verdict_name(v: i64) -> *u8 |
| 85 | func nx_canary_class_name(c: i64) -> *u8 |
| 118 | func nx_canary_hash_bytes(bytes_ptr: *u8, bytes_len: i64) -> i64 |
| 138 | func nx_canary_install( called by 1: main |
| 167 | func nx_canary_verify_constant( called by 1: main |
| 182 | func nx_canary_verify_bytes( |
| 229 | func nx_canary_scan_aggregate( |
| 284 | func nx_canary_verify_file(canary: *CanaryRecord, now_unix: i64) -> i64 |
| 314 | func nx_canary_scan_files( |