code wiki / (root) / nx_property_test.nx

nx_property_test.nx

buildroot/runtime/nx_property_test.nx

5129 B93 linesdepth 8pulls 11 transitivereach 0 importersview sourcekind gate/proof
docsdependenciesstructsconstsfunctions

about

nx_property_test.nx -- PROPERTY-BASED + METAMORPHIC testing of the capability core (census gap). Instead of fixed cases, GENERATE random capabilities (reproducible LCG) and assert INVARIANTS hold over hundreds of them: P1 (property): verify(issue(allow,exp), tool) == OK <=> (tool in allow) AND (not expired) M1 (metamorphic): attenuate(all-cap, narrow) grants tool <=> tool in narrow (attenuation never widens) A single violation prints the (minimal-ish) counterexample and reds. This is what would have caught a subtler MAC/allow-logic bug that a hand-written fixed case might miss. license_tier: ORIGINAL

dependencies 2 imports · 0 importers

nx_cap_token.nx nx_gate.nx nx_property_test.nx

imports: nx_cap_token.nxnx_gate.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main gw sys_write capt_slen pt_rand pt_allow pt_tool capt_issue capt_payload capt_catb capt_catn signed_cookie_sign sc_sign_bytes sys_mmap hmac_sha256 sys_mmap ↻ sha256_digest sys_mmap ↻ sha256_init sha256_update sha256_final sha256_init ↻ sha256_update ↻ sha256_final ↻ b64_encode b64_enc_char capt_verify capt_mac_ok sc_sign_bytes ↻ capt_allows gn sys_write ↻ sys_mmap ↻ capt_attenuate capt_mac_ok ↻ capt_allows ↻ capt_issue ↻

structs

none

consts

none

functions

11func pt_rand(state: *i64) -> i64 { state[0] = state[0] * 1103515245 + 12345; return (state[0] >> 16) & 0x7fffffff }
called by 1: main
14func pt_tool(i: i64, buf: *u8) -> i64 { buf[0] = 116 as u8; buf[1] = (48 + i) as u8; return 2 }
called by 1: main
17func pt_allow(mask: i64, buf: *u8) -> i64
called by 1: main
30func main() -> i64