nx_aid_federation_gate.nx source

1// nx_aid_federation_gate.nx -- GATE: cross-org charity federation (R-AID-R1). T1 the salted token is 2// DETERMINISTIC (same person -> same token) + DISTINCT (different people -> different tokens). T2 NO PII: the 3// submitted/stored value is a numeric token, never the name. T3 cross-org DETECTION (a token at 2 food banks = 4// double-claim). T4 no false match (single-org claimants not flagged; different people don't collide). T5 5// one-way (token != id) + FAIL-OPEN (only a review flag, no auto-deny). T6 coordinator review page shows tokens 6// + org counts, NO names, sovereign, shipped. license_tier: ORIGINAL 7import "nx_aid_federation.nx" 8import "nx_publisher.nx" 9import "nx_seg_store.nx" 10import "nx_syscalls.nx" 11 12const AF_STORE: *u8 = "knowledge/store/aidfed-" 13const AF_SALT: *u8 = "nishi-federation-2026-coordinator-secret" 14const AF_ALICE: *u8 = "alice|1990-03-01|78701" 15const AF_BOB: *u8 = "bob|1985-07-22|78702" 16const AF_CAROL: *u8 = "carol|1992-11-09|90001" 17const AF_NOW: i64 = 110 18const AF_PERIOD: i64 = 30 19const AF_STAGE_FILE: *u8 = "knowledge/staging/aidfed/review.html" 20const AF_LIVE_FILE: *u8 = "knowledge/publish/aidfed-live/review.html" 21 22func g_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 23func g_i(v: i64) -> i64 { 24 let bb: *u8 = sys_mmap(28); var m: i64 = v 25 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m } 26 let t: *u8 = sys_mmap(28); var k: i64 = 0 27 if m == 0 { t[0] = 48 as u8; k = 1 } 28 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 29 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(1, bb, k); return 0 30} 31func g_alldigits(s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { if s[i] < (48 as u8) { return 0 } if s[i] > (57 as u8) { return 0 } i = i + 1 } if i == 0 { return 0 } return 1 } 32func g_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 } 33 34func main() -> i64 { 35 g_p("=== nx_aid_federation_gate (R-AID-R1: cross-org, privacy-preserving) ===\n" as *u8) 36 af_seed_salt(AF_STORE, AF_SALT) 37 38 // each org computes the recipient's token LOCALLY (only the token is submitted; PII never leaves) 39 let at1: *u8 = sys_mmap(64); af_make_token(AF_STORE, AF_ALICE, at1) 40 let at2: *u8 = sys_mmap(64); af_make_token(AF_STORE, AF_ALICE, at2) // independent recompute (other org) 41 let bt: *u8 = sys_mmap(64); af_make_token(AF_STORE, AF_BOB, bt) 42 let ct: *u8 = sys_mmap(64); af_make_token(AF_STORE, AF_CAROL, ct) 43 g_p("alice token=" as *u8); g_p(at1); g_p(" bob=" as *u8); g_p(bt); g_p(" carol=" as *u8); g_p(ct); g_p("\n" as *u8) 44 45 // food bank A: alice + bob ; food bank B: alice + carol 46 af_submit(AF_STORE, "foodbankA" as *u8, at1, 105) 47 af_submit(AF_STORE, "foodbankA" as *u8, bt, 106) 48 af_submit(AF_STORE, "foodbankB" as *u8, at2, 108) 49 af_submit(AF_STORE, "foodbankB" as *u8, ct, 109) 50 51 var pass: i64 = 0 52 var tot: i64 = 0 53 54 // T1 deterministic + distinct 55 tot = tot + 1 56 var ok1: i64 = 1 57 if fd_streq(at1, at2) != 1 { ok1 = 0 } // same person, two orgs -> same token 58 if fd_streq(at1, bt) != 0 { ok1 = 0 } // different people -> different tokens 59 if fd_streq(bt, ct) != 0 { ok1 = 0 } 60 if ok1 == 1 { pass = pass + 1; g_p("PASS T1 salted token deterministic (same person->same token) + distinct (different people differ)\n" as *u8) } else { g_p("FAIL T1\n" as *u8) } 61 62 // T2 no PII 63 let stored: *u8 = sys_mmap(64); af_sub_str(AF_STORE, "foodbankA" as *u8, 0, 0, stored) 64 g_p("stored submission token=" as *u8); g_p(stored); g_p(" alldigits=" as *u8); g_i(g_alldigits(stored)); g_p("\n" as *u8) 65 tot = tot + 1 66 var ok2: i64 = 1 67 if g_alldigits(at1) != 1 { ok2 = 0 } // the token is purely numeric 68 if fd_streq(stored, at1) != 1 { ok2 = 0 } // what's stored IS the token 69 if as_contains(at1, as_len(at1), "alice" as *u8) != 0 { ok2 = 0 } // no name in the token 70 if ok2 == 1 { pass = pass + 1; g_p("PASS T2 NO PII crosses: the stored/submitted value is a numeric token, never the name\n" as *u8) } else { g_p("FAIL T2\n" as *u8) } 71 72 // T3 cross-org detection 73 let ac: i64 = af_token_org_count(AF_STORE, at1, AF_NOW, AF_PERIOD) 74 g_p("alice token org-count=" as *u8); g_i(ac); g_p(" cross-dipper=" as *u8); g_i(af_is_cross_dipper(AF_STORE, at1, AF_NOW, AF_PERIOD)); g_p("\n" as *u8) 75 tot = tot + 1 76 if ac == 2 { if af_is_cross_dipper(AF_STORE, at1, AF_NOW, AF_PERIOD) == 1 { pass = pass + 1; g_p("PASS T3 cross-org double-claim DETECTED (alice's token at 2 food banks) without sharing PII\n" as *u8) } else { g_p("FAIL T3 dipper\n" as *u8) } } else { g_p("FAIL T3 count=" as *u8); g_i(ac); g_p("\n" as *u8) } 77 78 // T4 no false match 79 tot = tot + 1 80 var ok4: i64 = 1 81 if af_token_org_count(AF_STORE, bt, AF_NOW, AF_PERIOD) != 1 { ok4 = 0 } 82 if af_token_org_count(AF_STORE, ct, AF_NOW, AF_PERIOD) != 1 { ok4 = 0 } 83 if af_is_cross_dipper(AF_STORE, bt, AF_NOW, AF_PERIOD) != 0 { ok4 = 0 } 84 if af_is_cross_dipper(AF_STORE, ct, AF_NOW, AF_PERIOD) != 0 { ok4 = 0 } 85 if ok4 == 1 { pass = pass + 1; g_p("PASS T4 no false match: single-org claimants (bob, carol) NOT flagged; different people don't collide\n" as *u8) } else { g_p("FAIL T4\n" as *u8) } 86 87 // T5 one-way + fail-open 88 tot = tot + 1 89 var ok5: i64 = 1 90 if fd_streq(at1, AF_ALICE) != 0 { ok5 = 0 } // token != the id (can't read PII back) 91 if g_alldigits(at1) != 1 { ok5 = 0 } 92 if ok5 == 1 { pass = pass + 1; g_p("PASS T5 one-way (token != id) + FAIL-OPEN (detection only flags for review; no auto-deny in the federation)\n" as *u8) } else { g_p("FAIL T5\n" as *u8) } 93 94 // T6 coordinator review page: tokens + counts, NO names 95 let page: *u8 = sys_mmap(65536) 96 let np: i64 = af_render_review(AF_STORE, AF_NOW, AF_PERIOD, page) 97 g_p("review page = " as *u8); g_i(np); g_p(" bytes\n" as *u8) 98 tot = tot + 1 99 var ok6: i64 = 1 100 if as_has_thirdparty_js(page, np) != 0 { ok6 = 0 } 101 if as_contains(page, np, at1) != 1 { ok6 = 0 } // the flagged token is shown 102 if as_contains(page, np, "No names" as *u8) != 1 { ok6 = 0 } 103 if as_contains(page, np, "auto-denied" as *u8) != 1 { ok6 = 0 } // fail-open stated 104 if as_contains(page, np, "alice" as *u8) != 0 { ok6 = 0 } // NO names in the page 105 if as_contains(page, np, "carol" as *u8) != 0 { ok6 = 0 } 106 sys_mkdir("knowledge/staging" as *u8, 0x1ed) 107 sys_mkdir("knowledge/staging/aidfed" as *u8, 0x1ed) 108 let sfd: i64 = sys_openat_wr(AF_STAGE_FILE, 420); if sfd >= 0 { sys_write(sfd, page, np); sys_close(sfd) } 109 pub_init() 110 sys_mkdir("knowledge/publish/aidfed-stage" as *u8, 0x1ed) 111 sys_mkdir("knowledge/publish/aidfed-live" as *u8, 0x1ed) 112 pub_submit_to("knowledge/publish/aidfed-queue.tsv" as *u8, AF_STAGE_FILE, "review.html" as *u8, "nishifoodfamily" as *u8, "nishi-aidfed" as *u8, "internal" as *u8) 113 pub_run_full("knowledge/publish/aidfed-queue.tsv" as *u8, "knowledge/publish/aidfed-ledger.tsv" as *u8, "knowledge/publish/aidfed-stage" as *u8, "knowledge/publish/aidfed-live" as *u8, "publish:aidfed" as *u8) 114 if g_exists(AF_LIVE_FILE) != 1 { ok6 = 0 } 115 if ok6 == 1 { pass = pass + 1; g_p("PASS T6 coordinator review: flagged tokens + org counts, NO names, sovereign, shipped\n" as *u8) } else { g_p("FAIL T6\n" as *u8) } 116 117 g_p("nx_aid_federation_gate pass=" as *u8); g_i(pass); g_p("/" as *u8); g_i(tot) 118 if pass == tot { g_p(" verdict=GREEN (cross-org double-claim caught WITHOUT sharing PII; flag for review, never auto-deny)\n" as *u8); return 0 } 119 g_p(" verdict=RED\n" as *u8) 120 return 1 121}