nx_safety.nx
buildroot/runtime/nx_safety.nx
about
nx_safety.nx -- SafetyEnvelope as a native NishiLang construct.
Per cardinal feedback-safety-envelope-native-language-feature
(user 2026-05-16: "just make it metaprogramming or whatever and
part of what nishilang does natively"), the safety envelope is
a STRUCTURED DATA TYPE, not a comment-block convention. Every
substrate module declares:
import "nx_safety.nx"
const _SAFETY_ENVELOPE: SafetyEnvelope = SafetyEnvelope {
sil_target: SIL_2,
asil_target: ASIL_QM,
dal_target: DAL_B,
iec_62304_class: IEC_62304_NONE,
evidence_ids: [EVID_NO_FP, EVID_SEALED_ENUM] as *i64,
n_evidence_ids: 2,
hazard_ids: [HAZ_CACHE_TIMING_AES] as *i64,
n_hazard_ids: 1,
residual_risk: "S-box cache-timing per Bernstein 2005" as *u8,
residual_risk_len: 38,
verdict: NX_VERDICT_NOT_YET_EVALUATED,
}
The grader (nx_safety_critical_grade.nx) consumes the const
directly -- typed introspection, no comment scan. Future
compilers extend this via NishiLang's existing struct/const
machinery without parser changes.
Companion catalog: nishi-library/seeds/safety-critical-standards.toml
license_tier: ORIGINAL
genealogy_id: substrate-native synthesis of IEC 61508 / ISO 26262 /
DO-178C / IEC 62304 / NASA-STD-8719.13 / MIL-STD-882E
+ NASA JPL Power of 10
dependencies 1 imports · 3 importers
imports: nx_syscalls.nx
imported by: nx_aes.nxnx_chacha20.nxnx_safety_gate.nx
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| 144 | struct SafetyEnvelope |
consts
| 43 | const SIL_NONE: i64 = 0 |
| 44 | const SIL_1: i64 = 1 |
| 45 | const SIL_2: i64 = 2 |
| 46 | const SIL_3: i64 = 3 |
| 47 | const SIL_4: i64 = 4 |
| 51 | const ASIL_QM: i64 = 0 |
| 52 | const ASIL_A: i64 = 1 |
| 53 | const ASIL_B: i64 = 2 |
| 54 | const ASIL_C: i64 = 3 |
| 55 | const ASIL_D: i64 = 4 |
| 59 | const DAL_NONE: i64 = 0 |
| 60 | const DAL_E: i64 = 1 |
| 61 | const DAL_D: i64 = 2 |
| 62 | const DAL_C: i64 = 3 |
| 63 | const DAL_B: i64 = 4 |
| 64 | const DAL_A: i64 = 5 |
| 68 | const IEC_62304_NONE: i64 = 0 |
| 69 | const IEC_62304_A: i64 = 1 |
| 70 | const IEC_62304_B: i64 = 2 |
| 71 | const IEC_62304_C: i64 = 3 |
| 76 | const NX_VERDICT_NOT_YET_EVALUATED: i64 = 0 |
| 77 | const NX_VERDICT_PASS: i64 = 1 |
| 78 | const NX_VERDICT_FAIL: i64 = 2 |
| 79 | const NX_VERDICT_WIN_S_UNANIMOUS: i64 = 3 |
| 89 | const EVID_NO_FP: i64 = 1 // no floating-point arithmetic |
| 90 | const EVID_SEALED_ENUM_COMPLETE: i64 = 2 // all verdict paths sealed-enum |
| 91 | const EVID_BOUNDED_LOOPS: i64 = 3 // JPL Rule 2: every while bounded |
| 92 | const EVID_NO_RECURSION: i64 = 4 // JPL Rule 1 |
| 93 | const EVID_ASSERTION_DENSITY: i64 = 5 // JPL Rule 5: >=2/fn |
| 94 | const EVID_BIT_EQUAL_REPRODUCIBLE: i64 = 6 // deterministic across runs |
| 95 | const EVID_NO_TABLE_LOOKUP_ON_SECRET: i64 = 7 // constant-time crypto |
| 96 | const EVID_CONSTANT_TIME_BY_DESIGN: i64 = 8 // no secret-dep branches |
| 97 | const EVID_KAT_VERIFIED: i64 = 9 // known-answer-test pass |
| 98 | const EVID_LICENSE_TIER_ORIGINAL: i64 = 10 // original work |
| 99 | const EVID_LICENSE_TIER_INDEPENDENT_REDERIVE: i64 = 11 |
| 100 | const EVID_LICENSE_TIER_TIER_0_UNENCUMBERED: i64 = 12 |
| 101 | const EVID_FORMAL_PROOF_THEOREM: i64 = 13 // theorem with full proof |
| 102 | const EVID_FAULT_INJECTION_SURVIVED: i64 = 14 // chaos test pass |
| 103 | const EVID_ICL_AUDIT_PASSED: i64 = 15 // capability-claims audit |
| 104 | const EVID_KIND_ISOLATED: i64 = 16 // no sibling-kind imports |
| 105 | const EVID_BACKTRACKING_RESISTANCE: i64 = 17 // CSPRNG specific |
| 106 | const EVID_NONCE_UNIQUENESS_DOC: i64 = 18 // crypto caller-contract documented |
| 107 | const EVID_FIPS_TEST_VECTORS: i64 = 19 // NIST CAVS / FIPS validated |
| 108 | const EVID_RFC_TEST_VECTORS: i64 = 20 // RFC appendix vectors validated |
| 117 | const HAZ_CACHE_TIMING_AES_SBOX: i64 = 1 |
| 118 | const HAZ_NONCE_REUSE_DISCLOSURE: i64 = 2 |
| 119 | const HAZ_LENGTH_EXTENSION_HASH: i64 = 3 |
| 120 | const HAZ_PADDING_ORACLE: i64 = 4 |
| 121 | const HAZ_MAC_NONCONSTANT_TIME_COMPARE: i64 = 5 |
| 122 | const HAZ_NULL_DEREF_UNCHECKED: i64 = 6 |
| 123 | const HAZ_INTEGER_OVERFLOW_SILENT: i64 = 7 |
| 124 | const HAZ_INFINITE_LOOP_UNBOUNDED: i64 = 8 |
| 125 | const HAZ_STACK_OVERFLOW_RECURSION: i64 = 9 |
| 126 | const HAZ_USE_AFTER_FREE: i64 = 10 |
| 127 | const HAZ_DOUBLE_FREE: i64 = 11 |
| 128 | const HAZ_RACE_CONDITION_TOCTOU: i64 = 12 |
| 129 | const HAZ_INJECTION_VIA_UNESCAPED: i64 = 13 |
| 130 | const HAZ_XSS_HTML_ATTRIBUTE: i64 = 14 |
| 131 | const HAZ_CSRF_NO_TOKEN: i64 = 15 |
| 132 | const HAZ_DNS_CACHE_POISONING: i64 = 16 |
| 133 | const HAZ_DOWNGRADE_ATTACK: i64 = 17 |
| 134 | const HAZ_SUPPLY_CHAIN_HASH_COLLISION: i64 = 18 |
| 135 | const HAZ_AI_ALIGNMENT_MISUSE: i64 = 19 |
| 136 | const HAZ_SIDE_CHANNEL_FAULT_INJECTION: i64 = 20 |
functions
| 168 | func nx_safety_envelope_is_valid(e: *SafetyEnvelope) -> i64 |
| 190 | func main() -> i64 |