nx_security_census_lib.nx
buildroot/runtime/nx_security_census_lib.nx
about
nx_security_census_lib.nx -- PURE core for the SECURITY maturity census. NO main (a lib), so the census
organ AND its gate import the SAME measured core and can never diverge -- the nx_ecomat_lib pattern.
It carries three things the rest of the census composes on:
1. sc_have(path) -- HAVE iff a real sovereign organ opens on disk (auditor discipline, no false-green;
existence != full correctness -> the per-organ gate is the ratchet). Same oracle
nx_adversarial_census uses.
2. sc_weight(crit) -- WEAKEST-LINK weighting: a critical control counts SC_CRIT_W(3)x, standard 1x, so a
missing CRITICAL control drags the grade hard. Encodes the "security = weakest link"
maturity principle mechanically (a research-grade primitive that is BUILT-BUT-UNWIRED
does not defend the live path, and must not read as coverage).
3. sc_permil(hw,tw)-- have_weight*1000/total_weight (0 if none). THE number the ecosystem-maturity rollup
live-derives the `security` domain grade from.
license_tier: ORIGINAL
dependencies 2 imports · 2 importers
imports: nx_syscalls.nxnx_artifact_root.nx
imported by: nx_security_census.nxnx_security_census_gate.nx
structs
| none |
consts
| 20 | const SC_PATH_CAP: i64 = 512 |
| 23 | const SC_SURF_WIRE: i64 = 0 // over the wire: transport, auth, crypto |
| 24 | const SC_SURF_NET: i64 = 1 // in the network: host, lateral movement, tenancy |
| 25 | const SC_SURF_DEV: i64 = 2 // on the device: firmware, boot, supply chain |
| 26 | const SC_SURF_AI: i64 = 3 // ai-operational: the agents |
| 29 | const SC_CRIT_W: i64 = 3 |
functions
| 31 | func sc_surf_name(s: i64) -> *u8 called by 1: sc_ax |
| 55 | func sc_have(path: *u8) -> i64 |
| 63 | func sc_weight(crit: i64) -> i64 |
| 69 | func sc_permil(have_w: i64, total_w: i64) -> i64 |