code wiki / _hdl_build / nx_account_admin_exceed_gate.nx
nx_account_admin_exceed_gate.nx source
↩ module page · 148 lines · 12063 B
1// nx_account_admin_exceed_gate.nx -- the MEASURED S-CLASS EXCEED referee for the HR-driven account-administration
2// capability (nx_hr_admin + nx_hr_entitle + nx_lan_signup). It scores our capability against a FAITHFUL naive
3// baseline -- not a strawman: each baseline is literally what the system did/does without this work --
4// * naive entitlements = he_include with super=0 (the EXACT pre-superuser olgd_emit_access logic);
5// * naive signup = a global "registration_open" flag (return 1 when open -- the old single-flag world);
6// * naive roster = a mutable list where suspend DELETES the row (only the current row survives -> history=1);
7// * naive realms = one shared user list (a handle known anywhere is "known" everywhere).
8// Every number below is COMPUTED by the organ from real operations (never self-asserted). A LIAR-KILL negative
9// control proves the classifier only says EXCEEDS on a real measured gap: an axis where naive == ours MUST score
10// PARITY, not EXCEEDS. GREEN iff all 4 real axes EXCEEDS and the neg-control is PARITY.
11// HONEST SCOPE (printed): the exceed is on SAFETY / SOVEREIGNTY / BY-CONSTRUCTION correctness vs a flat-file+flag
12// baseline -- NOT a feature-parity claim against a mature IAM (Okta/Workday); those features are ABSENT and declared.
13import "nx_hr_entitle.nx" // he_count_access / he_include
14import "nx_g_puts_lib.nx"
15import "nx_hr_admin.nx" // hra_invite / hra_is_invited / hra_suspend
16import "nx_lan_signup.nx" // ls_signup_allowed
17import "nx_hr.nx" // hr_read / hr_line_end / hr_field_end (for the NAIVE entitlements-TSV baseline only)
18import "nx_hr_sov.nx" // CUTOVER: hrs_set_role (seg_store)
19import "nx_seg_store.nx" // ss_scan_all (history version count)
20import "nx_syscalls.nx"
21
22func g_mkpfx(base: *u8, ms: i64, out: *u8) -> i64 { var o: i64=0; while base[o]!=(0 as u8){out[o]=base[o];o=o+1} let t: *u8=sys_mmap(28); var m: i64=ms; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var z: i64=k-1; while z>=0{out[o]=t[z];o=o+1;z=z-1} out[o]=0 as u8; return o }
23func ex_histcount(prefix: *u8, cred: *u8) -> i64 { let kinds: *i64=sys_mmap(256*8) as *i64; let ptrs: *i64=sys_mmap(256*8) as *i64; let lens: *i64=sys_mmap(256*8) as *i64; let srcs: *i64=sys_mmap(256*8) as *i64; return ss_scan_all(prefix, cred, kinds, ptrs, lens, srcs) }
24
25func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
26func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
27func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 }
28func gtrunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd>=0 { sys_close(fd) } return 0 }
29func g_writefile(path: *u8, s: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 1 } var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd, s, n); sys_close(fd); return 0 }
30func g_append(path: *u8, s: *u8) -> i64 { let fd: i64 = sys_openat_append(path, 0x1a4); if fd<0 { return 1 } var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd, s, n); sys_close(fd); return 0 }
31func g_ip4(out: *u8, a: i64, b: i64, c: i64, d: i64) -> i64 { out[0]=a as u8; out[1]=b as u8; out[2]=c as u8; out[3]=d as u8; return 0 }
32func g_count_lines(path: *u8) -> i64 { let buf: *u8=sys_mmap(65536); let n: i64=hr_read(path, buf, 65536); var c: i64=0; var i: i64=0; while i<n { if buf[i]==(10 as u8) { c=c+1 } i=i+1 } return c }
33func g_file_has(path: *u8, needle: *u8, nl: i64) -> i64 { let buf: *u8=sys_mmap(65536); let n: i64=hr_read(path, buf, 65536); if nl==0 {return 1} var i: i64=0; while i+nl<=n { var j: i64=0; var ok: i64=1; while j<nl { if buf[i+j]!=needle[j]{ok=0;j=nl} else {j=j+1} } if ok==1 {return 1} i=i+1 } return 0 }
34
35// the FAITHFUL naive entitlement count = the SAME seg_store entitlements, iterated WITHOUT the superadmin rule
36// (super bit forced to 0): he_count_super(0, handle, hn, ent). That isolates the EXACT variable under test (the
37// superuser-by-construction bit), so "ours vs naive" is a clean A/B on one store -- no separate TSV baseline needed.
38// the naive global-open registration flag: when "open", anyone (any IP, any handle) registers.
39func naive_signup_open() -> i64 { return 1 }
40
41// verdict classifier: 2=EXCEEDS, 1=PARITY, 0=BEHIND. higher_better=1 -> bigger metric wins.
42func verdict(ours: i64, naive: i64, higher_better: i64) -> i64 {
43 if higher_better == 1 { if ours > naive { return 2 } if ours == naive { return 1 } return 0 }
44 if ours < naive { return 2 }
45 if ours == naive { return 1 }
46 return 0
47}
48func vname(v: i64) -> i64 { if v==2 { g_puts("EXCEEDS" as *u8) } else { if v==1 { g_puts("PARITY" as *u8) } else { g_puts("BEHIND" as *u8) } } return 0 }
49func axis(name: *u8, ours: i64, naive: i64, hb: i64) -> i64 {
50 let v: i64 = verdict(ours, naive, hb)
51 g_puts(" ["); vname(v); g_puts("] " as *u8); g_puts(name)
52 g_puts(" ours="); g_num(ours); g_puts(" naive="); g_num(naive); g_puts("\n" as *u8)
53 return v
54}
55
56func main() -> i64 {
57 g_puts("=== ACCOUNT-ADMIN S-CLASS EXCEED GATE (HR-driven; measured vs a faithful naive baseline) ===\n" as *u8)
58 let NR: *u8 = "nishi_site_admin" as *u8; let NRN: i64 = 16
59 let AR: *u8 = "andelinwest_admin" as *u8; let ARN: i64 = 17
60 let fam: *u8 = "andelin" as *u8
61 let ms: i64 = sys_now_ms()
62 let hr: *u8 = sys_mmap(96); g_mkpfx("/tmp/nx_ex_hr_" as *u8, ms, hr) // seg_store prefix (cutover)
63 let ent: *u8 = sys_mmap(96); g_mkpfx("/tmp/nx_ex_ent_" as *u8, ms, ent) // entitlement seg_store (cutover)
64 let cido: *u8 = sys_mmap(96); let cidb: *u8 = sys_mmap(96)
65 hra_enroll(hr, NR, NRN, "elderwesto" as *u8, 10, HRA_LVL_OWNER, fam, 1000, "system" as *u8, cido)
66 hra_enroll(hr, NR, NRN, "brad" as *u8, 4, HRA_LVL_MEMBER, fam, 1000, "elderwesto" as *u8, cidb)
67 // entitlements (seg_store): 1 public line; NONE keyed to elderwesto.
68 he_ent_put(ent, "*" as *u8, "Public Wiki" as *u8, "/wiki" as *u8)
69
70 var exceeds: i64 = 0
71
72 // --- AXIS 1: superuser-by-construction / no drift. Add 3 admin resources; owner must auto-see them. ---
73 he_ent_put(ent, "g1" as *u8, "Gallery Admin" as *u8, "/admin/g1" as *u8)
74 he_ent_put(ent, "g2" as *u8, "Billing" as *u8, "/admin/g2" as *u8)
75 he_ent_put(ent, "g3" as *u8, "System Status" as *u8, "/admin/g3" as *u8)
76 let ours_owner: i64 = he_count_access(hr, NR, NRN, "elderwesto" as *u8, 10, ent) // super -> 1 public + 3 admin = 4
77 let naive_owner: i64 = he_count_super(0, "elderwesto" as *u8, 10, ent) // SAME store, no super bit -> 1 public
78 let v1: i64 = axis("superuser auto-access (owner sees all resources)" as *u8, ours_owner, naive_owner, 1)
79 if v1==2 { exceeds=exceeds+1 }
80
81 // --- AXIS 2: invite-gated LAN-only signup vs global-open flag. 5 hostile (WAN + un-invited) attempts. ---
82 let wan: *u8 = sys_mmap(8); g_ip4(wan,203,0,113,5)
83 var blk_ours: i64=0; var blk_naive: i64=0; var t: i64=0
84 while t<5 {
85 if ls_signup_allowed(wan, hr, NR, NRN, "intruder" as *u8, 8)==0 { blk_ours=blk_ours+1 }
86 if naive_signup_open()==0 { blk_naive=blk_naive+1 }
87 t=t+1
88 }
89 let v2: i64 = axis("hostile signups blocked (of 5 WAN+uninvited)" as *u8, blk_ours, blk_naive, 1)
90 if v2==2 { exceeds=exceeds+1 }
91
92 // --- AXIS 3: append-only reversible roster vs mutable delete-on-suspend. enroll->suspend->reactivate. ---
93 let life: *u8 = sys_mmap(96); g_mkpfx("/tmp/nx_ex_life_" as *u8, ms, life) // seg_store prefix (cutover)
94 let cc: *u8 = sys_mmap(96)
95 hra_enroll(life, NR, NRN, "carol" as *u8, 5, HRA_LVL_MEMBER, fam, 1000, "elderwesto" as *u8, cc)
96 hra_suspend(life, NR, NRN, "carol" as *u8, 5, fam, 2000, "elderwesto" as *u8)
97 hrs_set_role(life, cc, "carol" as *u8, HRA_LVL_MEMBER, fam, 3000, "elderwesto" as *u8) // reactivate (rollback)
98 let ours_hist: i64 = ex_histcount(life, cc) // 3 lifecycle events preserved in the seg_store (computed)
99 // the naive baseline EXECUTED: a mutable file where suspend DELETES the row (truncate). Same 3 ops, for real.
100 let nlife: *u8 = "/tmp/nx_ex_naive_life" as *u8
101 g_writefile(nlife, "carol\tactive\n" as *u8) // enroll
102 g_writefile(nlife, "" as *u8) // suspend = delete the row (truncate to empty)
103 g_writefile(nlife, "carol\tactive\n" as *u8) // reactivate
104 let naive_hist: i64 = g_count_lines(nlife) // = 1: the suspension left no trace (computed)
105 let ours_final: i64 = hra_resolve_level(life, cc, 64) // 1 -> reactivation restored the level
106 let v3: i64 = axis("lifecycle events preserved (audit + rollback)" as *u8, ours_hist, naive_hist, 1)
107 if v3==2 { exceeds=exceeds+1 }
108 g_puts(" (reversibility: ours resolves back to "); g_num(ours_final); g_puts(" after reactivate; naive file lost the suspension)\n" as *u8)
109
110 // --- AXIS 4: realm isolation by construction vs shared user list. brad known on nishi; query andelinwest. ---
111 let andl: *u8 = sys_mmap(96); g_mkpfx("/tmp/nx_ex_and_" as *u8, ms, andl) // seg_store prefix (cutover)
112 var ours_iso: i64 = 0
113 if hra_is_invited(andl, AR, ARN, "brad" as *u8, 4)==0 { ours_iso = 1 } // brad not provisioned in andelinwest
114 // the naive baseline EXECUTED: one shared list keyed by handle only -- provision brad once, query "other realm".
115 let nshared: *u8 = "/tmp/nx_ex_naive_shared" as *u8
116 g_writefile(nshared, "brad\n" as *u8) // brad provisioned once, shared
117 var naive_iso: i64 = 1
118 if g_file_has(nshared, "brad" as *u8, 4)==1 { naive_iso = 0 } // brad "known" everywhere -> NOT isolated
119 let v4: i64 = axis("cross-realm isolation (andelinwest sealed from nishifamily)" as *u8, ours_iso, naive_iso, 1)
120 if v4==2 { exceeds=exceeds+1 }
121
122 // --- LIAR-KILL negative control: a public ("*") resource is visible to a member under BOTH systems -> PARITY. ---
123 let ours_pub: i64 = he_count_access(hr, NR, NRN, "brad" as *u8, 4, ent) // brad: public only (no brad-keyed lines)
124 let naive_pub: i64 = he_count_super(0, "brad" as *u8, 4, ent) // SAME store, super=0 -> identical -> PARITY
125 let vneg: i64 = axis("[neg-control] public resource visible to member" as *u8, ours_pub, naive_pub, 1)
126
127 // --- verdict ---
128 g_puts("----\n" as *u8)
129 g_puts("EXCEEDS axes=" as *u8); g_num(exceeds); g_puts("/4 neg-control=" as *u8); vname(vneg)
130 var liar: i64 = 0
131 if vneg == 2 { liar = 1 } // the neg-control scored EXCEEDS despite ours==naive => the classifier is lying
132 g_puts(" liar_kill_fired=" as *u8); g_num(liar); g_puts("\n" as *u8)
133 g_puts("HONEST SCOPE: exceed = safety/sovereignty/by-construction vs a flat-file+flag baseline; NOT IAM feature-parity (Okta/Workday features ABSENT, declared).\n" as *u8)
134
135 var green: i64 = 0
136 if exceeds == 4 { if vneg == 1 { if liar == 0 { green = 1 } } }
137 if green==1 { g_puts("ACCOUNT-ADMIN-EXCEED verdict=GREEN (4/4 EXCEEDS, neg-control PARITY, no liar-kill)\n" as *u8) }
138 else { g_puts("ACCOUNT-ADMIN-EXCEED verdict=RED\n" as *u8) }
139
140 let lg: i64=sys_openat_append("knowledge/status/account_admin_exceed_gate.log" as *u8, 0x1a4)
141 if lg>=0 {
142 g_w(lg, "ACCOUNT-ADMIN-EXCEED exceeds=" as *u8); g_wn(lg, exceeds); g_w(lg, "/4 negctrl=" as *u8); g_wn(lg, vneg); g_w(lg, " liar=" as *u8); g_wn(lg, liar)
143 if green==1 { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) }
144 sys_close(lg)
145 }
146 if green==1 { sys_exit(0); return 0 }
147 sys_exit(1); return 1
148}