nx_connect_lds_youth.nx source

1// nx_connect_lds_youth.nx -- CONNECT / LDS-community vertical: YOUTH-SAFETY VISIBLE-CONTEXT WALL. 2// For LDS youth worldwide to meet, play games and hang out alongside adults and returned missionaries, 3// the platform must encode the Church's own youth-protection norm ("two-deep leadership", never one 4// adult alone with a youth) as a HARD information-flow invariant -- not a policy page, a wall. 5// 6// THE INVARIANT (composes the age-band spine of nx_connect_idage, no self-declared age): 7// * peer<->peer (adult<->adult OR minor<->minor) channels: allowed. 8// * a linked GUARDIAN and their own youth: allowed (parents are never blocked). 9// * a non-guardian ADULT <-> a MINOR: allowed ONLY in a VISIBLE GROUP with two-deep adult presence 10// (>=2 adults). A private 1:1 DM, or a group with a single adult, is DENIED BY CONSTRUCTION. 11// This is strictly safer than Meetup/Tandem/Match/Facebook, which all permit adult->minor private DMs. 12// 13// Plus: NO ads are ever shown to minors (COPPA + child dignity; the vertical is free either way). 14// 15// 8 checks incl. over-block guards (youth peers + adults are NOT harmed) and a NEG-CONTROL proving the 16// incumbent any->any default leaks adult->minor 1:1. 100% sovereign. license_tier: ORIGINAL expect_exit: 0 17// 2026-07-23 LIBRARY SPLIT: the wall moved to nx_connect_youth_lib.nx so THIS gate and the LIVE app 18// (nx_connect_serve, whose /events RSVP admission now calls it directly) bind ONE implementation instead 19// of the app re-stating the rule inline. This file is now purely the VERIFIER; its emitted output is 20// byte-identical to the pre-split version, which proves the extraction changed no behavior. 21import "nx_syscalls.nx" 22import "nx_connect_youth_lib.nx" 23 24func sw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 25func sn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 } 26 27func tcheck(pass: i64, label: *u8, fails: *i64) -> i64 { 28 sw(" " as *u8); sw(label); sw(": " as *u8) 29 if pass==1 { sw("PASS\n" as *u8) } else { sw("FAIL\n" as *u8); fails[0]=fails[0]+1 } 30 return 0 31} 32 33func main() -> i64 { 34 let fails: *i64 = sys_mmap(16) as *i64 35 fails[0]=0 36 37 // scenarios (deterministic): a returned missionary (adult) wanting to catch up with a youth convert, 38 // youth wanting to hang out/play games, parents, and adult peers. 39 let adult_dm_youth: i64 = yw_may_channel(YW_BAND_ADULT, YW_BAND_MINOR, 0, YW_CTX_DM, 0) // core wall 40 let adult_grp2_youth: i64 = yw_may_channel(YW_BAND_ADULT, YW_BAND_MINOR, 0, YW_CTX_GROUP, 2) // two-deep visible 41 let adult_grp1_youth: i64 = yw_may_channel(YW_BAND_ADULT, YW_BAND_MINOR, 0, YW_CTX_GROUP, 1) // one-adult group 42 let guardian_youth: i64 = yw_may_channel(YW_BAND_ADULT, YW_BAND_MINOR, 1, YW_CTX_DM, 0) // parent + own youth 43 let youth_youth: i64 = yw_may_channel(YW_BAND_MINOR, YW_BAND_MINOR, 0, YW_CTX_DM, 0) // peers (game/hangout) 44 let adult_adult: i64 = yw_may_channel(YW_BAND_ADULT, YW_BAND_ADULT, 0, YW_CTX_DM, 0) // adult peers 45 let inc_adult_youth: i64 = yw_may_incumbent(YW_BAND_ADULT, YW_BAND_MINOR, 0, YW_CTX_DM, 0) // incumbent default 46 47 sw("=== nx_connect_lds_youth -- youth-safety visible-context wall (two-deep by construction) ===\n" as *u8) 48 sw("channel allowed? 1=yes 0=no\n" as *u8) 49 sw(" adult <-> youth PRIVATE 1:1 DM = " as *u8); sn(adult_dm_youth); sw(" (DENIED)\n" as *u8) 50 sw(" adult <-> youth visible group, 2 adults = " as *u8); sn(adult_grp2_youth); sw(" (allowed: two-deep)\n" as *u8) 51 sw(" adult <-> youth group, only 1 adult = " as *u8); sn(adult_grp1_youth); sw(" (DENIED: not two-deep)\n" as *u8) 52 sw(" guardian <-> own youth 1:1 = " as *u8); sn(guardian_youth); sw(" (allowed)\n" as *u8) 53 sw(" youth <-> youth 1:1 (games/hangout) = " as *u8); sn(youth_youth); sw(" (allowed)\n" as *u8) 54 sw(" adult <-> adult 1:1 = " as *u8); sn(adult_adult); sw(" (allowed)\n" as *u8) 55 sw(" ads to minor = " as *u8); sn(yw_ad_allowed(YW_BAND_MINOR)); sw(" ads to adult = " as *u8); sn(yw_ad_allowed(YW_BAND_ADULT)); sw("\n" as *u8) 56 sw("-- gate checks --\n" as *u8) 57 58 // T1: the core wall -- a non-guardian adult cannot privately DM a youth 59 var t1: i64=0; if adult_dm_youth==0 { t1=1 } 60 tcheck(t1, "T1 CORE WALL adult<->youth private 1:1 DM DENIED" as *u8, fails) 61 62 // T2: two-deep visible group is the permitted path for adult<->youth contact 63 var t2: i64=0; if adult_grp2_youth==1 { t2=1 } 64 tcheck(t2, "T2 two-deep visible group allowed (returned missionary can catch up, in the open)" as *u8, fails) 65 66 // T3: a single-adult group is still blocked (two-deep is required, not just 'a group') 67 var t3: i64=0; if adult_grp1_youth==0 { t3=1 } 68 tcheck(t3, "T3 single-adult group still DENIED (two-deep required)" as *u8, fails) 69 70 // T4: guardians are never blocked from their own youth 71 var t4: i64=0; if guardian_youth==1 { t4=1 } 72 tcheck(t4, "T4 guardian<->own youth allowed (parents not over-blocked)" as *u8, fails) 73 74 // T5: youth peers can talk/play freely (the whole point: youth worldwide meeting each other) 75 var t5: i64=0; if youth_youth==1 { t5=1 } 76 tcheck(t5, "T5 youth<->youth allowed (peers meet, play games, hang out)" as *u8, fails) 77 78 // T6: adults are unaffected among themselves 79 var t6: i64=0; if adult_adult==1 { t6=1 } 80 tcheck(t6, "T6 adult<->adult unaffected (no over-block)" as *u8, fails) 81 82 // T7: no ads to minors; adults may see brought-to-you-by ads 83 var t7: i64=0; if yw_ad_allowed(YW_BAND_MINOR)==0 { if yw_ad_allowed(YW_BAND_ADULT)==1 { t7=1 } } 84 tcheck(t7, "T7 no ads shown to minors (COPPA + dignity); free either way" as *u8, fails) 85 86 // T8: NEG-CONTROL -- the incumbent any->any default allows exactly the 1:1 our wall denies 87 var t8: i64=0; if inc_adult_youth==1 { if adult_dm_youth==0 { t8=1 } } 88 tcheck(t8, "T8 NEG-CONTROL incumbent any->any leaks adult->youth 1:1; our wall is load-bearing" as *u8, fails) 89 90 sw(" fails=" as *u8); sn(fails[0]); sw("\n" as *u8) 91 if fails[0]==0 { sw("VERDICT: GREEN (two-deep visible-context wall holds; peers/parents free; no ads to minors; incumbent leak proven)\n" as *u8); sys_exit(0) } 92 sw("VERDICT: RED\n" as *u8) 93 sys_exit(1) 94 return 1 95}