code wiki / _hdl_build / nx_auth_unification_census.nx
nx_auth_unification_census.nx source
↩ module page · 138 lines · 7458 B
1// nx_auth_unification_census.nx -- MEASURED unification scoreboard for auth ACROSS every Nishi surface
2// (operator 2026-07-05: "make sure we are using opaque or whatever is state of the art and that its the
3// unified approach across all our nishi systems use the nishi researcher and census"). nx_login_census
4// grades the login LIBRARY's quality; THIS grades COVERAGE: does every surface in
5// knowledge/security/auth_surfaces.conf route through the ONE OPAQUE credential, and which SESSION CARRIER
6// each uses. Every cell PROVEN by reading the REAL organ source on disk (Rule 4, no assumptions).
7// Research-grounded: requires knowledge/library/auth_rfc9807_opaque.txt (nx_auth_research primary corpus).
8// CRED -- surface MINTS (nx_modern_auth_login|olg_login) or VALIDATES (nx_sa_validate) the OPAQUE session.
9// CARRIER -- no-cookie header (nx_sa_validate/X-Nishi-Session) vs `ngs=` cookie -> the unification split.
10// FRONTIER -- passkeys/WebAuthn = the passwordless next rung (honest gap, not a regression).
11// Self-contained. expect_exit: 0 license_tier: ORIGINAL
12import "nx_syscalls.nx"
13const K_MAGIC_524288: i64 = 524288
14
15func au_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
16func au_n(v: i64) -> i64 { var m: i64=v; if m<0 { au_w("-" as *u8); m=0-m } let t: *u8=sys_mmap(24); var k: i64=0; if m==0 {t[0]=48 as u8;k=1} while m>0 {t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let o: *u8=sys_mmap(24); var i: i64=0; while i<k {o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 }
17func au_read(path: *u8, buf: *u8, cap: i64) -> i64 {
18 let fd: i64 = sys_openat_rd(path)
19 if fd < 0 { return 0 - 1 }
20 var tot: i64 = 0
21 while tot < cap { let dst: *u8 = (buf as i64 + tot) as *u8; let r: i64 = sys_read(fd, dst, cap - tot); if r <= 0 { break } tot = tot + r }
22 sys_close(fd)
23 return tot
24}
25func au_has(buf: *u8, n: i64, needle: *u8) -> i64 {
26 var i: i64 = 0
27 while i < n {
28 var k: i64 = 0
29 var hit: i64 = 1
30 while needle[k] != (0 as u8) {
31 if i + k >= n { hit = 0; break }
32 if buf[i+k] != needle[k] { hit = 0; break }
33 k = k + 1
34 }
35 if hit == 1 { if k > 0 { return 1 } }
36 i = i + 1
37 }
38 return 0
39}
40func au_ncopy(src: *u8, n: i64) -> *u8 {
41 let out: *u8 = sys_mmap(n + 4)
42 var i: i64 = 0
43 while i < n { out[i] = src[i]; i = i + 1 }
44 out[n] = 0 as u8
45 return out
46}
47
48func main() -> i64 {
49 au_w("=== NX-AUTH-UNIFICATION-CENSUS -- is OPAQUE the ONE auth across every Nishi surface? (measured) ===\n" as *u8)
50 let cap: i64 = K_MAGIC_524288
51 let buf: *u8 = sys_mmap(cap)
52
53 var ground: i64 = 0
54 let gfd: i64 = sys_openat_rd("knowledge/library/auth_rfc9807_opaque.txt\x00" as *u8)
55 if gfd >= 0 { ground = 1; sys_close(gfd) }
56 au_w(" research-grounded (RFC9807 OPAQUE corpus banked by nx_auth_research): "); au_n(ground); au_w("\n")
57
58 let conf_n: i64 = au_read("knowledge/security/auth_surfaces.conf\x00" as *u8, buf, cap)
59 if conf_n < 0 { au_w("VERDICT RED (auth_surfaces.conf missing)\n" as *u8); return 1 }
60 let cfg: *u8 = au_ncopy(buf, conf_n)
61
62 au_w(" --- per-surface (CRED must be OPAQUE mint|validate; CARRIER header[no-cookie] | cookie[ngs]) ---\n" as *u8)
63 var surfaces: i64 = 0
64 var cred_ok: i64 = 0
65 var cred_red: i64 = 0
66 var carrier_header: i64 = 0
67 var carrier_cookie: i64 = 0
68 var p: i64 = 0
69 while p < conf_n {
70 var e: i64 = p
71 while e < conf_n { if (cfg[e] as i64) == 10 { break } e = e + 1 }
72 var ln: i64 = e - p
73 if ln > 0 { if (cfg[p+ln-1] as i64) == 13 { ln = ln - 1 } }
74 var skip: i64 = 0
75 if ln <= 0 { skip = 1 }
76 if skip == 0 { if (cfg[p] as i64) == 35 { skip = 1 } }
77 if skip == 0 {
78 let line: *u8 = cfg + p
79 var b1: i64 = 0 - 1
80 var b2: i64 = 0 - 1
81 var q: i64 = 0
82 while q < ln { if (line[q] as i64) == 124 { if b1 < 0 { b1 = q } else { if b2 < 0 { b2 = q } } } q = q + 1 }
83 if b2 > 0 {
84 surfaces = surfaces + 1
85 let label: *u8 = au_ncopy(line, b1)
86 let srclen: i64 = b2 - b1 - 1
87 let srcoff: i64 = b1 + 1
88 let srcp: *u8 = line + srcoff
89 let src: *u8 = au_ncopy(srcp, srclen)
90 let sn: i64 = au_read(src, buf, cap)
91 var mint: i64 = 0
92 var val: i64 = 0
93 var ck: i64 = 0
94 if sn > 0 {
95 if au_has(buf, sn, "nx_modern_auth_login" as *u8) == 1 { mint = 1 }
96 if au_has(buf, sn, "olg_login" as *u8) == 1 { mint = 1 }
97 if au_has(buf, sn, "nx_sa_validate" as *u8) == 1 { val = 1 }
98 if au_has(buf, sn, "nx_modern_auth_validate_session" as *u8) == 1 { val = 1 }
99 if au_has(buf, sn, "Set-Cookie: ngs=" as *u8) == 1 { ck = 1 }
100 }
101 var opq: i64 = 0
102 if mint == 1 { opq = 1 }
103 if val == 1 { opq = 1 }
104 au_w(" [")
105 if opq == 1 { au_w("CRED:OPAQUE " as *u8) } else { au_w("CRED:*RED* " as *u8) }
106 if ck == 1 { au_w("CARRIER:cookie" as *u8) } else { if val == 1 { au_w("CARRIER:header" as *u8) } else { au_w("CARRIER:? " as *u8) } }
107 au_w("] ")
108 au_w(label)
109 if mint == 1 { au_w(" (login-provider)" as *u8) } else { if val == 1 { au_w(" (session-consumer)" as *u8) } }
110 if sn <= 0 { au_w(" (source unreadable)" as *u8) }
111 au_w("\n")
112 if opq == 1 { cred_ok = cred_ok + 1 } else { cred_red = cred_red + 1 }
113 if ck == 1 { carrier_cookie = carrier_cookie + 1 } else { if val == 1 { carrier_header = carrier_header + 1 } }
114 }
115 }
116 p = e + 1
117 }
118
119 au_w(" --- TALLY --- surfaces="); au_n(surfaces)
120 au_w(" CRED-opaque="); au_n(cred_ok); au_w("/"); au_n(surfaces)
121 au_w(" non-opaque="); au_n(cred_red); au_w("\n")
122 au_w(" CARRIER: no-cookie-header="); au_n(carrier_header); au_w(" cookie(ngs)="); au_n(carrier_cookie); au_w("\n")
123
124 au_w(" --- FINDINGS (grounded: nx_auth_research 13/13 primary RFCs) ---\n" as *u8)
125 au_w(" F1 CREDENTIAL = OPAQUE-3DH RFC9807 + Argon2id RFC9106 (SOTA aPAKE, server never sees the password)." as *u8)
126 if cred_red == 0 { au_w(" UNIFIED across ALL surfaces.\n" as *u8) } else { au_w(" *NOT unified* -- a surface rolls its own.\n" as *u8) }
127 au_w(" F2 CARRIER = bearer-over-OPAQUE everywhere, but SPLIT: no-cookie header vs ngs-cookie." as *u8)
128 if carrier_cookie > 0 { au_w(" Converge on mTLS bound to the OPAQUE export_key (no-cookie, gates navs, XSS-immune, nishi-first).\n" as *u8) } else { au_w(" Single carrier.\n" as *u8) }
129 au_w(" F3 FRONTIER = passwordless passkeys/WebAuthn (auth_webauthn_l3 banked) is the NEXT rung, not a regression.\n" as *u8)
130
131 var green: i64 = 0
132 if cred_red == 0 { if ground == 1 { if surfaces >= 8 { green = 1 } } }
133 au_w("NX-AUTH-UNIFICATION-CENSUS cred-opaque="); au_n(cred_ok); au_w("/"); au_n(surfaces); au_w(" verdict=")
134 if green == 1 { au_w("GREEN (OPAQUE is the ONE credential everywhere; carrier-unify to mTLS = the worklist)\n" as *u8); sys_exit(0); return 0 }
135 au_w("RED (a surface not on the unified OPAQUE credential, or research corpus missing)\n" as *u8)
136 sys_exit(1)
137 return 1
138}