code wiki / _hdl_build / nx_doc_authz_gate.nx
nx_doc_authz_gate.nx
buildroot/runtime/_hdl_build/nx_doc_authz_gate.nx
about
nx_doc_authz_gate.nx -- MEASURED hermetic gate for per-client EYES-ONLY authz + the private-doc read route
(nx_doc_authz). Fresh nonce domains per run. Proves the vault is no longer write-only and cannot be read by the
wrong client / the wrong firm:
T1 owner reads OWN confidential doc -> ALLOWED + plaintext round-trips (through decrypt).
T2 NON-owner (different subject) -> DENIED (<0), even though the doc exists (T1 read it).
T3 public doc -> readable by ANY subject (no regression on the public corpus).
T4 cross-domain (free-param hole) -> a domainA subject is DENIED a domainB doc.
T5 fail-closed -> a confidential doc with NO owner record is DENIED (never defaulted-open).
Print pass=5 + GREEN/RED, append knowledge/status/dp_authz_gate.log. STANDALONE -- no daemon, no deploy.
(nx_chacha20_poly1305_decrypt prints one 'A' to STDERR on first decrypt -- shipped-AEAD marker; harmless.)
license_tier: ORIGINAL
dependencies 3 imports · 0 importers
imports: nx_doc_authz.nxnx_doc_at_rest.nxnx_docportal_lib.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 16 | func g_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } called by 1: main |
| 17 | func g_num(v: i64) -> i64 called by 1: main |
| 23 | func g_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } called by 1: main |
| 24 | func g_wn(fd: i64, v: i64) -> i64 called by 1: main |
| 30 | func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 1: main |
| 31 | func g_cat(out: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { out[o] = s[i]; o = o + 1; i = i + 1 } return o } called by 1: main |
| 32 | func g_catnum(out: *u8, o: i64, v: i64) -> i64 called by 1: main |
| 38 | func g_eqbytes(a: *u8, b: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { if a[i] != b[i] { return 0 } i = i + 1 } return 1 } called by 1: main |
| 40 | func main() -> i64 |