nx_cap_provision_gate.nx source

1// nx_cap_provision_gate.nx -- proves the FAIL-CLOSED cap-secret check. NEGATIVE CONTROLS are load- 2// bearing: an absent keyfile, a too-short keyfile, AND a keyfile that still contains the baked 3// placeholder must ALL read provisioned=NO (0) -- the three ways a server could silently fall back to 4// a forgeable secret. Only a present, long-enough, non-placeholder key reads YES (1). Fixtures written 5// to /tmp (survives WSL cold-boot; identical bytes each run = deterministic). verdict GREEN iff 5/5. 6// license_tier: ORIGINAL 7import "nx_cap_provision.nx" 8import "nx_seg_store.nx" // ss_writefile (truncating write) for /tmp fixtures 9 10func cpg_row(name: *u8, ok: i64) -> i64 { 11 cp_p("CPGATE row=" as *u8); cp_p(name) 12 if ok == 1 { cp_p(" verdict=PASS\n" as *u8) } else { cp_p(" verdict=FAIL\n" as *u8) } 13 if ok == 1 { return 1 } 14 return 0 15} 16 17func main(argc: i64, argv: *i64) -> i64 { 18 var pass: i64 = 0 19 20 // fixtures (ss_writefile truncates -> deterministic across re-runs) 21 let good: *u8 = "k7Q2rX9mN4pL8vT1wZ6bY3cD5fH0jA2s" // 32 bytes, non-placeholder 22 ss_writefile("/tmp/cp_good.key" as *u8, good, 32) 23 let short: *u8 = "tooshort" // 8 bytes < CAP_MINKEY(16) 24 ss_writefile("/tmp/cp_short.key" as *u8, short, 8) 25 let plc: *u8 = CAP_PLACEHOLDER 26 ss_writefile("/tmp/cp_placeholder.key" as *u8, plc, cp_slen(CAP_PLACEHOLDER)) 27 28 // T1 POS: a real, long-enough, non-placeholder key -> provisioned 29 var ok: i64 = 0 30 if cap_provisioned("/tmp/cp_good.key" as *u8, CAP_MINKEY) == 1 { ok = 1 } 31 pass = pass + cpg_row("T1-pos-real-key" as *u8, ok) 32 33 // T2 NEG (load-bearing): absent keyfile -> FAIL CLOSED (never verify vs a baked secret) 34 ok = 0 35 if cap_provisioned("/tmp/cp_does_not_exist.key" as *u8, CAP_MINKEY) == 0 { ok = 1 } 36 pass = pass + cpg_row("T2-neg-absent-failclosed" as *u8, ok) 37 38 // T3 NEG (load-bearing): too-short key -> FAIL CLOSED (a 1-byte keyfile must not provision) 39 ok = 0 40 if cap_provisioned("/tmp/cp_short.key" as *u8, CAP_MINKEY) == 0 { ok = 1 } 41 pass = pass + cpg_row("T3-neg-tooshort-failclosed" as *u8, ok) 42 43 // T4 NEG (THE risk-#1 proof): a keyfile that still holds the baked placeholder -> FAIL CLOSED 44 ok = 0 45 if cap_provisioned("/tmp/cp_placeholder.key" as *u8, CAP_MINKEY) == 0 { ok = 1 } 46 pass = pass + cpg_row("T4-neg-placeholder-failclosed" as *u8, ok) 47 48 // T5 determinism: same inputs, two calls, identical verdicts 49 ok = 0 50 let a: i64 = cap_provisioned("/tmp/cp_good.key" as *u8, CAP_MINKEY) 51 let b: i64 = cap_provisioned("/tmp/cp_good.key" as *u8, CAP_MINKEY) 52 let c: i64 = cap_provisioned("/tmp/cp_placeholder.key" as *u8, CAP_MINKEY) 53 let d: i64 = cap_provisioned("/tmp/cp_placeholder.key" as *u8, CAP_MINKEY) 54 if a == b { if c == d { if a == 1 { if c == 0 { ok = 1 } } } } 55 pass = pass + cpg_row("T5-deterministic" as *u8, ok) 56 57 cp_p("CPGATE pass=" as *u8) 58 let dig: *u8 = sys_mmap(8); dig[0] = (48 + pass) as u8; sys_write(1, dig, 1) 59 cp_p("/5 verdict=" as *u8) 60 var rc: i64 = 1 61 if pass == 5 { rc = 0 } 62 if rc == 0 { cp_p("GREEN\n" as *u8) } else { cp_p("RED\n" as *u8) } 63 sys_exit(rc) 64 return rc 65}