code wiki / _hdl_build / nx_hr_graph_access.nx
nx_hr_graph_access.nx
buildroot/runtime/_hdl_build/nx_hr_graph_access.nx
about
nx_hr_graph_access.nx -- NISHI HR's new capability (operator 2026-07-16): "HR gains the capability to use
the FROM-GOD family graph (source of truth) to ASSIGN + COORDINATE access privileges, in partnership with
the PM who guides priorities." HR is the accountable role for manage_users/access; this makes the ecosystem
GRAPH the root of trust for who-can-access-what, instead of a hand-maintained ACL that drifts.
★THE NOVEL SOVEREIGN INVARIANT (security-by-construction): PROVENANCE OUTRANKS AUTHORITY. A capability that
is NOT from-god-rooted (an orphan / island in the family tree -- no traced lineage to the root) is
UNGRANTABLE -- even the HR operator (level-3 god within the realm) CANNOT grant access to it. Rationale:
granting access to something with no provenance is unsafe by construction (you cannot vouch for what you
cannot trace to god). Root it first (nx_genesis_trace / from-god rooting), THEN access can be assigned.
This is strictly stronger than Zanzibar/ReBAC alone (which would let an admin grant anything): here the
GRAPH gates the admin. Composes -- does NOT rebuild -- nx_rebac (the tuple engine) for the actual grant.
PM PARTNERSHIP: every assignment carries a priority (from nishi_project / the PM board); the verdict passes
it through so the PM's ranking orders which grants land first -- HR executes, PM prioritizes.
This organ ships the PURE, adversarially-GATED verdict (the invariant, un-gameable) + a real from-god
rooted-set check (reads the graph's rooted projection). The live grant-emit = compose hga_verdict ->
rb_store_tuple (nx_rebac) -- the named next wiring; the DECISION is proven here.
nx_hr_graph_access gate -- adversarial self-test (default; expect_exit 0)
nx_hr_graph_access check <object> <hr_level> <rooted-set-file> -- live verdict for a real object
license_tier: ORIGINAL module: nishi-core.hr.graph_access
dependencies 2 imports · 0 importers
imports: nx_syscalls.nxnx_itoa_lib.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 25 | const HGA_MAGIC_1048576: i64 = 1048576 |
| 26 | const HGA_MAGIC_1048575: i64 = 1048575 |
| 29 | const HGA_GRANT: i64 = 1 // rooted + authorized -> emit the rebac grant (additive tuple) |
| 30 | const HGA_DENY_AUTHZ: i64 = 2 // rooted, but subject lacks HR authority -> deny-by-default |
| 31 | const HGA_REFUSE_UNROOTED: i64 = 3 // object not from-god-rooted -> UNGRANTABLE by construction (the invariant) |
| 32 | const HGA_OPERATOR_LEVEL: i64 = 3 // HR level that is site-operator/god-in-realm (mirrors nx_rebac RB_OPERATOR) |
functions
| 34 | func hga_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 39 | func hga_pn(v: i64) -> i64 { nxi_out(v); return 0 } |
| 40 | func hga_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 } called by 1: main |
| 41 | func hga_atoi(s: *u8) -> i64 { var v: i64 = 0; var i: i64 = 0; var go: i64 = 1; while go == 1 { let c: i64 = s[i] as i64; if c < 48 { go = 0 } else { if c > 57 { go = 0 } else { v = v * 10 + (c - 48); i = i + 1 } } } return v } called by 1: main |
| 42 | func hga_vname(v: i64) -> *u8 called by 1: main |
| 52 | func hga_verdict(rooted: i64, hr_level: i64) -> i64 |
| 61 | func hga_is_rooted(object: *u8, path: *u8) -> i64 |
| 92 | func hga_gate() -> i64 |
| 109 | func main(argc: i64, argv: *i64) -> i64 |