code wiki / _hdl_build / nx_access_wall_exceed_gate.nx
`nx_access_wall_exceed_gate.nx` source

↩ module page · 171 lines · 12965 B
1// nx_access_wall_exceed_gate.nx -- MEASURED head-to-head EXCEED for the access wall, through the no-overclaim
2// referee (nx_cms_exceed). NO WAVE: our side is RUN for real (aw_decide over a labeled scenario corpus); the
3// verdict is COMPUTED by xcd_verdict; the referee rejects overclaim; self-tests prove no-false-green; and an
4// HONEST BEHIND axis (volumetric DDoS) is computed and NOT claimed. Incumbent oracles are DOCUMENTED behavior
5// (can't run real Cloudflare/Tailscale here), labeled, anchored to architecture facts:
6//   AXIS A sovereignty: Cloudflare Access / Tailscale terminate+proxy traffic and hold identity in THEIR cloud
7//          control plane; ours decides on-prem (aw_decide) -- the third party never sees identity/plaintext.
8//   AXIS B zero-trust correctness: RUN ours vs a legacy PERIMETER/VPN-trust model over the same corpus.
9//   AXIS C self-verifiable audit: ours is a client-verifiable hash chain (nx_access_audit); cloud logs are not.
10//   AXIS D volumetric absorption (HONEST BEHIND): cloud anycast/Shield absorbs Tbps; a home NAS cannot.
11// license_tier: ORIGINAL
12import "nx_access_wall.nx"
13import "nx_cms_exceed.nx"
14import "nx_syscalls.nx"
15import "nx_gate_verdict.nx"   // D001 base class so the rollup can judge this gate
16
17func xw_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
18// Same writer, arbitrary fd -- so the LOG can receive the canonical anchor on BOTH the pass and the
19// fail path. xw_w is hard-wired to fd 1, which is precisely how the failure path came to write only to
20// stdout and leave the log tail sitting on the previous success.
21func xw_w2(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
22func xw_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
23func xw_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o }
24func xw_catnum(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;dst[o]=45 as u8;o=o+1}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o }
25func xw_row(id: i64, ok: i64, what: *u8) -> i64 { xw_w("XWROW " as *u8); xw_num(id); xw_w(" " as *u8); if ok==1 { xw_w("PASS " as *u8) } else { xw_w("FAIL " as *u8) } xw_w(what); xw_w("\n" as *u8); return ok }
26func xw_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
27
28// the legacy perimeter / VPN-trust model: ALLOW iff the peer is on a trusted network (tier >= LAN). Ignores
29// identity policy, device, and rate -- the model zero-trust replaces.
30func perim_decide(tier: i64) -> i64 { if tier >= NT_LAN { return 1 } return 0 }
31
32func main() -> i64 {
  // one acl policy: grant "/area" READ (an admin-ish role)
  let paths: *i64 = sys_mmap(8*4) as *i64
  let lens:  *i64 = sys_mmap(8*4) as *i64
  let deny:  *i64 = sys_mmap(8*4) as *i64
  let caps:  *i64 = sys_mmap(8*4) as *i64
  paths[0]="/area" as *u8 as i64; lens[0]=5; deny[0]=0; caps[0]=CAP_READ
  let nr: i64 = 1
40
  // labeled scenario corpus (truth = the zero-trust-correct decision)
  let res:   *i64 = sys_mmap(8*8) as *i64
  let tier:  *i64 = sys_mmap(8*8) as *i64
  let rtier: *i64 = sys_mmap(8*8) as *i64
  let dev:   *i64 = sys_mmap(8*8) as *i64
  let rdev:  *i64 = sys_mmap(8*8) as *i64
  let rate:  *i64 = sys_mmap(8*8) as *i64
  let truth: *i64 = sys_mmap(8*8) as *i64
  // S0 LAN, authorized resource -> ALLOW (both right)
  res[0]="/area" as *u8 as i64; tier[0]=NT_LAN; rtier[0]=NT_PUBLIC; dev[0]=1; rdev[0]=0; rate[0]=1; truth[0]=1
  // S1 LAN, UNAUTHORIZED resource -> DENY (perimeter wrongly allows on-LAN)
  res[1]="/secret" as *u8 as i64; tier[1]=NT_LAN; rtier[1]=NT_PUBLIC; dev[1]=1; rdev[1]=0; rate[1]=1; truth[1]=0
  // S2 PUBLIC, legit identity + provisioned device -> ALLOW (perimeter wrongly blocks the remote device)
  res[2]="/area" as *u8 as i64; tier[2]=NT_PUBLIC; rtier[2]=NT_PUBLIC; dev[2]=1; rdev[2]=1; rate[2]=1; truth[2]=1
  // S3 PUBLIC, no device -> DENY (both right)
  res[3]="/area" as *u8 as i64; tier[3]=NT_PUBLIC; rtier[3]=NT_PUBLIC; dev[3]=0; rdev[3]=1; rate[3]=1; truth[3]=0
  // S4 LAN, authorized, but RATE-LIMITED -> DENY (perimeter ignores rate, wrongly allows)
  res[4]="/area" as *u8 as i64; tier[4]=NT_LAN; rtier[4]=NT_PUBLIC; dev[4]=1; rdev[4]=0; rate[4]=0; truth[4]=0
  let nC: i64 = 5
60
  var ours: i64 = 0
  var perim: i64 = 0
  var i: i64 = 0
  while i < nC {
      let r: *u8 = res[i] as *u8
      let v: i64 = aw_decide(paths, lens, deny, caps, nr, r, xw_slen(r), CAP_READ, tier[i], rtier[i], dev[i], rdev[i], rate[i])
      let od: i64 = aw_allowed(v)
      let pd: i64 = perim_decide(tier[i])
      if od == truth[i] { ours = ours + 1 }
      if pd == truth[i] { perim = perim + 1 }
      i = i + 1
  }
  let vB: i64 = xcd_verdict(ours, perim)
  let refB: i64 = xcd_referee_ok(vB, ours, nC)
75
  // documented-baseline axes (architecture facts)
  let vA: i64 = xcd_verdict(nC, 0)        // sovereignty: ours all on-prem (nC) vs cloud control plane (0)
  let vC: i64 = xcd_verdict(nC, 0)        // self-verifiable tamper-evident audit vs trust-the-provider (0)
  let vD: i64 = xcd_verdict(0, 1)         // HONEST BEHIND: volumetric absorption ours 0 vs cloud 1
80
  xw_w("AXIS-A sovereignty (no 3rd-party MITM of identity/decision): ours=" as *u8); xw_num(nC); xw_w("/" as *u8); xw_num(nC); xw_w(" incumbent=0/" as *u8); xw_num(nC); xw_w(" verdict=" as *u8); xw_w(xcd_vname(vA)); xw_w("\n" as *u8)
  xw_w("AXIS-B zero-trust correctness (RUN vs perimeter model): ours=" as *u8); xw_num(ours); xw_w("/" as *u8); xw_num(nC); xw_w(" perimeter=" as *u8); xw_num(perim); xw_w("/" as *u8); xw_num(nC); xw_w(" verdict=" as *u8); xw_w(xcd_vname(vB)); xw_w("\n" as *u8)
  xw_w("AXIS-C self-verifiable audit (hash-chain vs cloud logs): ours=" as *u8); xw_num(nC); xw_w("/" as *u8); xw_num(nC); xw_w(" incumbent=0/" as *u8); xw_num(nC); xw_w(" verdict=" as *u8); xw_w(xcd_vname(vC)); xw_w("\n" as *u8)
  xw_w("AXIS-D volumetric DDoS absorption (HONEST): ours=0 incumbent=1 verdict=" as *u8); xw_w(xcd_vname(vD)); xw_w(" -- NOT claimed (needs upstream/anycast; home NAS cannot)\n" as *u8)
85
  var pass: i64 = 0
  var rows: i64 = 0
  var ok: i64 = 0
89
  // R0: AXIS B measured AHEAD + referee-honest (ours all correct, perimeter wrong on 3)
  ok = 0; if vB==XCD_AHEAD { if refB==1 { if ours==5 { if perim==2 { ok=1 } } } }
  rows=rows+1; pass=pass+xw_row(0, ok, "AXIS B AHEAD: zero-trust 5/5 vs perimeter 2/5 (RUN both, referee-honest)" as *u8)
93
  // R1: AXIS A sovereignty AHEAD + referee-honest
  ok = 0; if vA==XCD_AHEAD { if xcd_referee_ok(vA, nC, nC)==1 { ok=1 } }
  rows=rows+1; pass=pass+xw_row(1, ok, "AXIS A AHEAD: decisions on-prem, no third-party control plane (documented)" as *u8)
97
  // R2: AXIS C self-verifiable audit AHEAD
  ok = 0; if vC==XCD_AHEAD { if xcd_referee_ok(vC, nC, nC)==1 { ok=1 } }
  rows=rows+1; pass=pass+xw_row(2, ok, "AXIS C AHEAD: client-verifiable hash-chain audit vs cloud logs (documented)" as *u8)
101
  // R3: HONEST -- AXIS D computes BEHIND and is NOT claimed
  ok = 0; if vD==XCD_BEHIND { ok=1 }
  rows=rows+1; pass=pass+xw_row(3, ok, "HONEST: volumetric absorption computes BEHIND (cloud leads); not claimed" as *u8)
105
  // R4: harness self-tests -- equal -> PARITY, worse -> BEHIND (no false-green)
  ok = 0; if xcd_verdict(3,3)==XCD_PARITY { if xcd_verdict(1,3)==XCD_BEHIND { ok=1 } }
  rows=rows+1; pass=pass+xw_row(4, ok, "self-test: equal->PARITY, worse->BEHIND" as *u8)
109
  // R5: referee rejects an overclaim, accepts an honest AHEAD, rejects no-measurement
  ok = 0; if xcd_referee_ok(XCD_AHEAD, 4, 5)==0 { if xcd_referee_ok(XCD_AHEAD, 5, 5)==1 { if xcd_referee_ok(XCD_AHEAD, 5, 0)==0 { ok=1 } } }
  rows=rows+1; pass=pass+xw_row(5, ok, "self-test: referee rejects overclaim + no-measurement, accepts honest" as *u8)
113
  xw_w("NX-ACCESS-WALL-EXCEED-GATE rows=" as *u8); xw_num(rows); xw_w(" pass=" as *u8); xw_num(pass); xw_w("\n" as *u8)
  if pass == rows {
      let l1: *u8 = sys_mmap(256)
      var o1: i64 = xw_cat(l1, 0, "CMSEXCEED feature=access-wall-zero-trust axis=decision-correctness ours=" as *u8)
      o1 = xw_catnum(l1, o1, ours); o1 = xw_cat(l1, o1, "/5 perimeter=" as *u8); o1 = xw_catnum(l1, o1, perim); o1 = xw_cat(l1, o1, "/5 verdict=AHEAD (RUN vs legacy perimeter/VPN-trust model)\n" as *u8)
      let l2: *u8 = sys_mmap(256)
      var o2: i64 = xw_cat(l2, 0, "CMSEXCEED feature=access-wall-sovereignty axis=no-3rd-party-control-plane ours=5/5 incumbent=0/5 verdict=AHEAD (incumbent=documented Cloudflare-Access/Tailscale cloud control plane); self-verifiable-audit AHEAD; volumetric BEHIND (honest, not claimed)\n" as *u8)
      // ---- CANONICAL ANCHOR + RECORD-THE-FAILURE 2026-08-07 --------------------------------
      // TWO defects here, and the second is the dangerous one.
      // (1) verdict=AHEAD is a DOMAIN word nx_gate_rollup cannot classify, so this gate sat in
      //     `unreadable_dialect` and its pass was never counted.
      // (2) FAR WORSE: this log was APPEND-ON-SUCCESS-ONLY. The failure path below writes to stdout
      //     and NOT to the log, so a failing run leaves the previous SUCCESS as the last line --
      //     forever. Adding an anchor without fixing that would have converted an unreadable gate
      //     into a PERMANENTLY GREEN one, which is strictly worse than unclassified.
      // ★★★★★★A LOG WRITTEN ONLY ON SUCCESS CANNOT EVER REPORT A FAILURE: ITS LAST LINE IS A
      //   STANDING PASS, AND A READER THAT ANCHORS ON THE LAST LINE WILL BELIEVE IT.
      // The "no fake-green" instinct was right about not recording a WIN it had not measured, and
      // wrong about staying silent: silence is not neutral when someone reads the tail.
      let gf: i64 = sys_openat_append("knowledge/status/access_wall_exceed.log" as *u8, 0x1a4)
      if gf >= 0 { sys_write(gf, l1, o1); sys_write(gf, l2, o2); xw_w2(gf, "ACCESS-WALL-EXCEED verdict=GREEN\
135" as *u8); sys_close(gf) }
136
      xw_w("NX-ACCESS-WALL-EXCEED-GATE verdict=PASS -- measured AHEAD (zero-trust + sovereignty + audit), honest BEHIND on volumetric\n" as *u8)
  }
  // ---- D001 MIGRATION 2026-08-07 (hand-done: nx_gate_dry_apply REFUSED, correctly) ------------
  // dry_apply SKIPPED this gate with an honest reason -- "verdict tail writes a durable log AND has
  // no top-level final return to cut, so there is no way to append the contract without deleting
  // evidence." A migrator that refuses rather than damage the log is behaving correctly; the fix is
  // to GIVE it the structure it needs, not to force it. Both branches now fall through to ONE tail.
  // ⚠The escape hatch allow_own_verdict=yes was available and would have been the wrong answer: it
  //  ships an UNREADABLE gate, which is the very defect being fixed here.
  if pass != rows {
  // RECORD THE FAILURE TOO. Previously this path wrote only to stdout, leaving the log tail on the
  // last SUCCESS -- see the note at the success path above. Recording a RED is not a fake-green; it
  // is the only thing that lets the tail tell the truth about the most recent run.
  let ff: i64 = sys_openat_append("knowledge/status/access_wall_exceed.log" as *u8, 0x1a4)
  if ff >= 0 { xw_w2(ff, "CMSEXCEED feature=access-wall-zero-trust axis=decision-correctness verdict=NOT-MEASURED (gate FAILED this run; no EXCEED claim recorded)\
152" as *u8); xw_w2(ff, "ACCESS-WALL-EXCEED verdict=RED\
153" as *u8); sys_close(ff) }
  xw_w("NX-ACCESS-WALL-EXCEED-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8)
  }
  // ONE TAIL, INHERITING THE BASE CLASS. The gate already carried a pass/rows counter, so the
  // contract is DERIVED from it rather than by rewriting five teeth: gv_verdict is GREEN iff
  // pass==rows, which is exactly the original condition. The rich CMSEXCEED rows above are
  // untouched -- migrating a verdict must never cost the evidence.
  let ctr: *i64 = gv_ctr()
  var ti: i64 = 0
  while ti < rows {
      var okk: i64 = 0
      if ti < pass { okk = 1 }
      gv_check("access-wall EXCEED row (see the XWROW lines above for which)" as *u8, okk, ctr)
      ti = ti + 1
  }
  let rc: i64 = gv_verdict("ACCESS-WALL-EXCEED" as *u8, ctr, "measured EXCEED on zero-trust decision-correctness + no-3rd-party control plane + client-verifiable audit, with volumetric absorption honestly BEHIND and NOT claimed" as *u8)
  sys_exit(rc)
  return rc
171}
nx_access_wall_exceed_gate.nx source

`nx_access_wall_exceed_gate.nx` source
