nx_chromatin.nx source

1// nx_chromatin.nx -- backup cell state (germline replication). 2// 3// Biology: chromatin is the packed DNA + histones inside a cell's 4// nucleus -- the GERMLINE that survives cell death (when one cell 5// dies via apoptosis, its chromatin can be inherited by daughter 6// cells or read from spore form). In Nishi terms: chromatin holds 7// the content-addressed snapshot of a cell's running state so a 8// REPLICA cell can restore from it on failover (nx_promote). 9// 10// Per [[feedback-cell-immune-system-ransomware-judo-ddos-by-bit]]: 11// "ephemeral content-addressed cells deny persistence by design. 12// chromatin-replicated backups already running as peer cells (not 13// "restore archives"), failover = manifest pointer flip = sub-second." 14// 15// Per [[feedback-naming-discipline-no-industry-competitor-overlap]]: 16// chromatin replaces an earlier conflicting name (Project Nucleus + 17// Nucleus RTOS); chromatin is unowned in software-infra space. 18// 19// Composes: 20// nx_methyl -- methyl-marks the chromatin so a replica can 21// distinguish authentic-self chromatin from 22// a forged backup (decoy-invalid mark in fake 23// backups, valid mark in real ones) 24// nx_promote -- consumes chromatin to instantiate a replica 25// as the new primary (failover) 26// nx_abortive -- compromised cell's chromatin survives the 27// abortive transition; daughter cells get a 28// clean copy of pre-compromise state 29// nx_pollinate -- chromatin can federate across hosts as 30// XENO_OBSERVATION + RECLAIM_REPORT payload 31// 32// V1 ships: 33// - struct NxChromatin with originator, content_hash, ts, snapshot bytes 34// - snapshot operation (capture cell state into chromatin) 35// - restore operation (apply chromatin to destination cell buffer) 36// - is_valid predicate (signature + freshness check) 37// 38// Gap list (V1 honest perf verdict): 39// - snapshot is byte-copy (V2 supports COW + delta encoding) 40// - no automatic periodic capture (caller drives) 41// - no cross-version compatibility (snapshot ABI versioning queued) 42// - no peer-mesh replication yet (nx_pollinate is the transport) 43// 44// genealogy_id: cardinal_2026-05-17_cell_immune_ransomware_judo + 45// cardinal_2026-05-19_unified_immune_architecture + 46// biology_chromatin_germline_inheritance 47// lineage_id: substrate_chromatin_v1 48// 49// nx_safety_envelope: 50// intended_use: "Backup cell state for sub-second failover; 51// content-addressed; methyl-marked for 52// self-verification" 53// sil_target: SIL3 54// evidence: [content_addressed, methyl_chained, 55// immutable_after_capture] 56// verdict: NOT_YET_EVALUATED 57 58import "nx_syscalls.nx" 59import "nx_tier.nx" 60import "nx_methyl.nx" 61 62// ===== Sealed enum: NxChromatinVerdict ============================ 63 64const NX_CH_OK: nx_int = 0 65const NX_CH_ERR_BAD_SIZE: nx_int = 1 66const NX_CH_ERR_BAD_MARK: nx_int = 2 67const NX_CH_ERR_STALE: nx_int = 3 68const NX_CH_ERR_DST_TOO_SMALL: nx_int = 4 69 70// ===== Struct: NxChromatin ======================================== 71// 72// originator_id is the cell whose state was captured. content_hash 73// is BLAKE3 (or equivalent) of snapshot bytes. ts_us is capture 74// time. snapshot_ptr + snapshot_len hold the actual cell-state 75// bytes (caller's serialized format -- chromatin doesn't interpret 76// the contents). mark is the methyl-marked authenticity proof. 77 78struct NxChromatin { 79 originator_id: nx_int, 80 content_hash: nx_size, 81 ts_us: nx_size, 82 snapshot_ptr: *u8, 83 snapshot_len: nx_size, 84 mark: *NxMethylMark, 85 capture_seq: nx_int, // monotonic; latest wins on failover 86} 87 88// ===== nx_chromatin_capture ====================================== 89// 90// Snapshot a cell's state into a chromatin. Caller supplies the 91// already-serialized snapshot bytes + content hash + methyl mark. 92// Returns the chromatin pointer or NULL on bad inputs. 93 94func nx_chromatin_capture(originator_id: nx_int, 95 content_hash: nx_size, 96 ts_us: nx_size, 97 snapshot_ptr: *u8, 98 snapshot_len: nx_size, 99 mark: *NxMethylMark, 100 capture_seq: nx_int) -> *NxChromatin { 101 if snapshot_len == 0 { return (0 as i64) as *NxChromatin } 102 if (snapshot_ptr as i64) == 0 { return (0 as i64) as *NxChromatin } 103 if (mark as i64) == 0 { return (0 as i64) as *NxChromatin } 104 let c: *NxChromatin = (sys_mmap(56)) as *NxChromatin 105 c.originator_id = originator_id 106 c.content_hash = content_hash 107 c.ts_us = ts_us 108 c.snapshot_ptr = snapshot_ptr 109 c.snapshot_len = snapshot_len 110 c.mark = mark 111 c.capture_seq = capture_seq 112 return c 113} 114 115// ===== nx_chromatin_restore ======================================= 116// 117// Apply chromatin's snapshot bytes into dst buffer (the new primary 118// cell's state region). Verifies mark is self-valid before restore. 119// Returns OK on success or one of the err verdicts. 120 121func nx_chromatin_restore(c: *NxChromatin, 122 dst: *u8, 123 dst_cap: nx_size, 124 now_us: nx_size, 125 max_age_us: nx_size, 126 allowed_originator: nx_int) -> nx_int { 127 if (c as i64) == 0 { return NX_CH_ERR_BAD_SIZE } 128 if c.snapshot_len > dst_cap { return NX_CH_ERR_DST_TOO_SMALL } 129 if (c.mark as i64) == 0 { return NX_CH_ERR_BAD_MARK } 130 // Verify the methyl mark validates as self 131 let is_self: nx_int = nx_methyl_is_self(c.mark, now_us, 132 max_age_us, allowed_originator) 133 if is_self != 1 { return NX_CH_ERR_BAD_MARK } 134 if c.ts_us > now_us { return NX_CH_ERR_STALE } 135 if (now_us - c.ts_us) > max_age_us { return NX_CH_ERR_STALE } 136 // Byte-copy snapshot into dst 137 var i: nx_size = 0 138 while i < c.snapshot_len { 139 dst[i] = c.snapshot_ptr[i] 140 i = i + 1 141 } 142 return NX_CH_OK 143} 144 145// ===== nx_chromatin_is_fresher ==================================== 146// 147// Compare two chromatins by capture_seq. Useful when multiple 148// replicas exist (different peer hosts hold different snapshots); 149// the FRESHEST wins on failover. Returns 1 if a is fresher than b. 150 151func nx_chromatin_is_fresher(a: *NxChromatin, b: *NxChromatin) -> nx_int { 152 if (a as i64) == 0 { return 0 } 153 if (b as i64) == 0 { return 1 } 154 if a.capture_seq > b.capture_seq { return 1 } 155 return 0 156} 157 158// ===== nx_chromatin_size ========================================== 159 160func nx_chromatin_size(c: *NxChromatin) -> nx_size { 161 if (c as i64) == 0 { return 0 } 162 return c.snapshot_len 163} 164 165// ===== nx_chromatin_originator ==================================== 166 167func nx_chromatin_originator(c: *NxChromatin) -> nx_int { 168 if (c as i64) == 0 { return 0 } 169 return c.originator_id 170} 171 172// ===== nx_chromatin_verify_against_buf ============================ 173// 174// Caller has a serialized cell-state buf; verify that this chromatin 175// is a snapshot of THAT buf. Used to confirm "did our backup really 176// capture what we thought it captured?" V1 does byte-equality; V2 177// compares content_hash only (cheaper, content-addressed verify). 178 179func nx_chromatin_verify_against_buf(c: *NxChromatin, 180 buf: *u8, 181 buf_len: nx_size) -> nx_int { 182 if (c as i64) == 0 { return 0 } 183 if c.snapshot_len != buf_len { return 0 } 184 var i: nx_size = 0 185 while i < buf_len { 186 if c.snapshot_ptr[i] != buf[i] { return 0 } 187 i = i + 1 188 } 189 return 1 190}