nx_access_wall_exceed_gate.nx source

1// nx_access_wall_exceed_gate.nx -- MEASURED head-to-head EXCEED for the access wall, through the no-overclaim 2// referee (nx_cms_exceed). NO WAVE: our side is RUN for real (aw_decide over a labeled scenario corpus); the 3// verdict is COMPUTED by xcd_verdict; the referee rejects overclaim; self-tests prove no-false-green; and an 4// HONEST BEHIND axis (volumetric DDoS) is computed and NOT claimed. Incumbent oracles are DOCUMENTED behavior 5// (can't run real Cloudflare/Tailscale here), labeled, anchored to architecture facts: 6// AXIS A sovereignty: Cloudflare Access / Tailscale terminate+proxy traffic and hold identity in THEIR cloud 7// control plane; ours decides on-prem (aw_decide) -- the third party never sees identity/plaintext. 8// AXIS B zero-trust correctness: RUN ours vs a legacy PERIMETER/VPN-trust model over the same corpus. 9// AXIS C self-verifiable audit: ours is a client-verifiable hash chain (nx_access_audit); cloud logs are not. 10// AXIS D volumetric absorption (HONEST BEHIND): cloud anycast/Shield absorbs Tbps; a home NAS cannot. 11// license_tier: ORIGINAL 12import "nx_access_wall.nx" 13import "nx_cms_exceed.nx" 14import "nx_syscalls.nx" 15 16func xw_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 17func xw_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 18func xw_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o } 19func xw_catnum(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o } 20func xw_row(id: i64, ok: i64, what: *u8) -> i64 { xw_w("XWROW " as *u8); xw_num(id); xw_w(" " as *u8); if ok==1 { xw_w("PASS " as *u8) } else { xw_w("FAIL " as *u8) } xw_w(what); xw_w("\n" as *u8); return ok } 21func xw_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 22 23// the legacy perimeter / VPN-trust model: ALLOW iff the peer is on a trusted network (tier >= LAN). Ignores 24// identity policy, device, and rate -- the model zero-trust replaces. 25func perim_decide(tier: i64) -> i64 { if tier >= NT_LAN { return 1 } return 0 } 26 27func main() -> i64 { 28 // one acl policy: grant "/area" READ (an admin-ish role) 29 let paths: *i64 = sys_mmap(8*4) as *i64 30 let lens: *i64 = sys_mmap(8*4) as *i64 31 let deny: *i64 = sys_mmap(8*4) as *i64 32 let caps: *i64 = sys_mmap(8*4) as *i64 33 paths[0]="/area" as *u8 as i64; lens[0]=5; deny[0]=0; caps[0]=CAP_READ 34 let nr: i64 = 1 35 36 // labeled scenario corpus (truth = the zero-trust-correct decision) 37 let res: *i64 = sys_mmap(8*8) as *i64 38 let tier: *i64 = sys_mmap(8*8) as *i64 39 let rtier: *i64 = sys_mmap(8*8) as *i64 40 let dev: *i64 = sys_mmap(8*8) as *i64 41 let rdev: *i64 = sys_mmap(8*8) as *i64 42 let rate: *i64 = sys_mmap(8*8) as *i64 43 let truth: *i64 = sys_mmap(8*8) as *i64 44 // S0 LAN, authorized resource -> ALLOW (both right) 45 res[0]="/area" as *u8 as i64; tier[0]=NT_LAN; rtier[0]=NT_PUBLIC; dev[0]=1; rdev[0]=0; rate[0]=1; truth[0]=1 46 // S1 LAN, UNAUTHORIZED resource -> DENY (perimeter wrongly allows on-LAN) 47 res[1]="/secret" as *u8 as i64; tier[1]=NT_LAN; rtier[1]=NT_PUBLIC; dev[1]=1; rdev[1]=0; rate[1]=1; truth[1]=0 48 // S2 PUBLIC, legit identity + provisioned device -> ALLOW (perimeter wrongly blocks the remote device) 49 res[2]="/area" as *u8 as i64; tier[2]=NT_PUBLIC; rtier[2]=NT_PUBLIC; dev[2]=1; rdev[2]=1; rate[2]=1; truth[2]=1 50 // S3 PUBLIC, no device -> DENY (both right) 51 res[3]="/area" as *u8 as i64; tier[3]=NT_PUBLIC; rtier[3]=NT_PUBLIC; dev[3]=0; rdev[3]=1; rate[3]=1; truth[3]=0 52 // S4 LAN, authorized, but RATE-LIMITED -> DENY (perimeter ignores rate, wrongly allows) 53 res[4]="/area" as *u8 as i64; tier[4]=NT_LAN; rtier[4]=NT_PUBLIC; dev[4]=1; rdev[4]=0; rate[4]=0; truth[4]=0 54 let nC: i64 = 5 55 56 var ours: i64 = 0 57 var perim: i64 = 0 58 var i: i64 = 0 59 while i < nC { 60 let r: *u8 = res[i] as *u8 61 let v: i64 = aw_decide(paths, lens, deny, caps, nr, r, xw_slen(r), CAP_READ, tier[i], rtier[i], dev[i], rdev[i], rate[i]) 62 let od: i64 = aw_allowed(v) 63 let pd: i64 = perim_decide(tier[i]) 64 if od == truth[i] { ours = ours + 1 } 65 if pd == truth[i] { perim = perim + 1 } 66 i = i + 1 67 } 68 let vB: i64 = xcd_verdict(ours, perim) 69 let refB: i64 = xcd_referee_ok(vB, ours, nC) 70 71 // documented-baseline axes (architecture facts) 72 let vA: i64 = xcd_verdict(nC, 0) // sovereignty: ours all on-prem (nC) vs cloud control plane (0) 73 let vC: i64 = xcd_verdict(nC, 0) // self-verifiable tamper-evident audit vs trust-the-provider (0) 74 let vD: i64 = xcd_verdict(0, 1) // HONEST BEHIND: volumetric absorption ours 0 vs cloud 1 75 76 xw_w("AXIS-A sovereignty (no 3rd-party MITM of identity/decision): ours=" as *u8); xw_num(nC); xw_w("/" as *u8); xw_num(nC); xw_w(" incumbent=0/" as *u8); xw_num(nC); xw_w(" verdict=" as *u8); xw_w(xcd_vname(vA)); xw_w("\n" as *u8) 77 xw_w("AXIS-B zero-trust correctness (RUN vs perimeter model): ours=" as *u8); xw_num(ours); xw_w("/" as *u8); xw_num(nC); xw_w(" perimeter=" as *u8); xw_num(perim); xw_w("/" as *u8); xw_num(nC); xw_w(" verdict=" as *u8); xw_w(xcd_vname(vB)); xw_w("\n" as *u8) 78 xw_w("AXIS-C self-verifiable audit (hash-chain vs cloud logs): ours=" as *u8); xw_num(nC); xw_w("/" as *u8); xw_num(nC); xw_w(" incumbent=0/" as *u8); xw_num(nC); xw_w(" verdict=" as *u8); xw_w(xcd_vname(vC)); xw_w("\n" as *u8) 79 xw_w("AXIS-D volumetric DDoS absorption (HONEST): ours=0 incumbent=1 verdict=" as *u8); xw_w(xcd_vname(vD)); xw_w(" -- NOT claimed (needs upstream/anycast; home NAS cannot)\n" as *u8) 80 81 var pass: i64 = 0 82 var rows: i64 = 0 83 var ok: i64 = 0 84 85 // R0: AXIS B measured AHEAD + referee-honest (ours all correct, perimeter wrong on 3) 86 ok = 0; if vB==XCD_AHEAD { if refB==1 { if ours==5 { if perim==2 { ok=1 } } } } 87 rows=rows+1; pass=pass+xw_row(0, ok, "AXIS B AHEAD: zero-trust 5/5 vs perimeter 2/5 (RUN both, referee-honest)" as *u8) 88 89 // R1: AXIS A sovereignty AHEAD + referee-honest 90 ok = 0; if vA==XCD_AHEAD { if xcd_referee_ok(vA, nC, nC)==1 { ok=1 } } 91 rows=rows+1; pass=pass+xw_row(1, ok, "AXIS A AHEAD: decisions on-prem, no third-party control plane (documented)" as *u8) 92 93 // R2: AXIS C self-verifiable audit AHEAD 94 ok = 0; if vC==XCD_AHEAD { if xcd_referee_ok(vC, nC, nC)==1 { ok=1 } } 95 rows=rows+1; pass=pass+xw_row(2, ok, "AXIS C AHEAD: client-verifiable hash-chain audit vs cloud logs (documented)" as *u8) 96 97 // R3: HONEST -- AXIS D computes BEHIND and is NOT claimed 98 ok = 0; if vD==XCD_BEHIND { ok=1 } 99 rows=rows+1; pass=pass+xw_row(3, ok, "HONEST: volumetric absorption computes BEHIND (cloud leads); not claimed" as *u8) 100 101 // R4: harness self-tests -- equal -> PARITY, worse -> BEHIND (no false-green) 102 ok = 0; if xcd_verdict(3,3)==XCD_PARITY { if xcd_verdict(1,3)==XCD_BEHIND { ok=1 } } 103 rows=rows+1; pass=pass+xw_row(4, ok, "self-test: equal->PARITY, worse->BEHIND" as *u8) 104 105 // R5: referee rejects an overclaim, accepts an honest AHEAD, rejects no-measurement 106 ok = 0; if xcd_referee_ok(XCD_AHEAD, 4, 5)==0 { if xcd_referee_ok(XCD_AHEAD, 5, 5)==1 { if xcd_referee_ok(XCD_AHEAD, 5, 0)==0 { ok=1 } } } 107 rows=rows+1; pass=pass+xw_row(5, ok, "self-test: referee rejects overclaim + no-measurement, accepts honest" as *u8) 108 109 xw_w("NX-ACCESS-WALL-EXCEED-GATE rows=" as *u8); xw_num(rows); xw_w(" pass=" as *u8); xw_num(pass); xw_w("\n" as *u8) 110 if pass == rows { 111 let l1: *u8 = sys_mmap(256) 112 var o1: i64 = xw_cat(l1, 0, "CMSEXCEED feature=access-wall-zero-trust axis=decision-correctness ours=" as *u8) 113 o1 = xw_catnum(l1, o1, ours); o1 = xw_cat(l1, o1, "/5 perimeter=" as *u8); o1 = xw_catnum(l1, o1, perim); o1 = xw_cat(l1, o1, "/5 verdict=AHEAD (RUN vs legacy perimeter/VPN-trust model)\n" as *u8) 114 let l2: *u8 = sys_mmap(256) 115 var o2: i64 = xw_cat(l2, 0, "CMSEXCEED feature=access-wall-sovereignty axis=no-3rd-party-control-plane ours=5/5 incumbent=0/5 verdict=AHEAD (incumbent=documented Cloudflare-Access/Tailscale cloud control plane); self-verifiable-audit AHEAD; volumetric BEHIND (honest, not claimed)\n" as *u8) 116 let gf: i64 = sys_openat_append("knowledge/status/cms_exceed.log" as *u8, 0x1a4) 117 if gf >= 0 { sys_write(gf, l1, o1); sys_write(gf, l2, o2); sys_close(gf) } 118 xw_w("NX-ACCESS-WALL-EXCEED-GATE verdict=PASS -- measured AHEAD (zero-trust + sovereignty + audit), honest BEHIND on volumetric\n" as *u8) 119 sys_exit(0); return 0 120 } 121 xw_w("NX-ACCESS-WALL-EXCEED-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8) 122 sys_exit(1); return 1 123}