nx_cms_roles_gate.nx source

1// nx_cms_roles_gate.nx -- CMS ROLES/CAPABILITIES gate (land a missing class HONESTLY). Runs the 2// TEAM-AUTHORED authz FSM c0_authz_step (shape 18, authored hands-off this session via auto_builder) 3// over a real role x route matrix and proves the security properties WordPress subscriber-roles get 4// wrong: tenant isolation (clientA cannot reach clientB scope) + privilege separation (no client 5// reaches an admin route) + admin reach. Writes CMSGATE roles-capabilities verdict=PASS to 6// knowledge/status/cms_gate.log ONLY if ALL assertions hold (no fake-green). license_tier: ORIGINAL 7// states: 0=anon 1=clientA 2=clientB 3=admin events: 0=public 1=clientA-scope 2=clientB-scope 3..5=admin-only 8// D001-MIGRATED 2026-08-01: this gate was GREEN and UNREADABLE at the same time -- it printed 9// "verdict=PASS" while nx_swcompare_evidence parses the nx_gate_verdict vocabulary, so cms scored 10// gates_green=0/2 with both gates passing. A correct proof nobody can parse contributes exactly as 11// much as no proof. Teeth and the durable cms_gate.log frame are UNCHANGED; only the verdict 12// emission moved onto the shared base class. 13import "c0_authz_step.nx" 14import "nx_syscalls.nx" 15import "nx_gate_verdict.nx" 16 17func rg_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 18func rg_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 19func rg_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 20 21func main() -> i64 { 22 let ctr: *i64 = gv_ctr() 23 gv_head("CMS-ROLES-GATE -- tenant isolation + privilege separation over the authz FSM" as *u8) 24 var t1: i64 = 0 25 if c0_authz_step_step(1, 2) == (0 - 1) { t1 = 1 } 26 gv_check("T1 tenant isolation: clientA CANNOT reach clientB scope" as *u8, t1, ctr) 27 var t2: i64 = 0 28 if c0_authz_step_step(2, 1) == (0 - 1) { t2 = 1 } 29 gv_check("T2 tenant isolation: clientB CANNOT reach clientA scope" as *u8, t2, ctr) 30 var t3: i64 = 0 31 if c0_authz_step_step(1, 3) == (0 - 1) { t3 = 1 } 32 gv_check("T3 privilege separation: a client CANNOT reach an admin route" as *u8, t3, ctr) 33 var t4: i64 = 0 34 if c0_authz_step_step(0, 1) == (0 - 1) { t4 = 1 } 35 gv_check("T4 anon CANNOT reach a client scope" as *u8, t4, ctr) 36 // POSITIVE controls: without these the four denials above are satisfied by a 37 // deny-everything FSM, which would be a vacuous pass. 38 var t5: i64 = 0 39 if c0_authz_step_step(1, 1) == 1 { t5 = 1 } 40 gv_check("T5 POS-CONTROL: clientA REACHES its own scope (denials are not blanket)" as *u8, t5, ctr) 41 var t6: i64 = 0 42 if c0_authz_step_step(3, 3) == 3 { t6 = 1 } 43 gv_check("T6 POS-CONTROL: admin REACHES an admin route" as *u8, t6, ctr) 44 let rc: i64 = gv_verdict("CMS-ROLES-GATE" as *u8, ctr, "tenant isolation + privilege separation, denials proven non-blanket" as *u8) 45 let pass: i64 = ctr[0] 46 let total: i64 = ctr[1] 47 48 if rc == 0 { 49 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4) 50 if gf >= 0 { 51 let line: *u8 = "CMSGATE row=nx_cms_roles role-capability cells=6 pass=6 verdict=PASS\n" as *u8 52 sys_write(gf, line, rg_len(line)); sys_close(gf) 53 } 54 rg_puts("CMS-ROLES-GATE role-capability recorded in cms_gate.log (pass="as *u8); rg_num(pass) 55 rg_puts("/"as *u8); rg_num(total); rg_puts(")\n"as *u8) 56 sys_exit(0); return 0 57 } 58 rg_puts("CMS-ROLES-GATE NOT recorded (no fake-green)\n"as *u8) 59 sys_exit(rc); return rc 60}