nx_doc_seal_gate.nx source

1// nx_doc_seal_gate.nx -- GATE for LEGAL D5 (nx_doc_seal). 2// 3// Drives the REAL seal over the RFC 8032 Ed25519 test-vector keypair 4// (deterministic) and asserts: 5// 6// SEAL+VERIFY : a VALID contract (UETA elements) seals (SEAL_OK), and the 7// produced Ed25519 signature VERIFIES over the canonical 8// record. 9// TAMPER : flipping one byte of the canonical record -> verify 10// TAMPERED; flipping it back -> VERIFIED again (the signature 11// commits to the exact document+signer+legal-context). 12// *** NEVER SEAL A VOID INSTRUMENT (the D5 safety crux) *** 13// a WILL with ALL general UETA elements but no witnesses, in 14// an e-wills jurisdiction -> REFUSED (NEEDS_MORE), NO signature; 15// a WILL in a NO-e-wills jurisdiction -> REFUSED_VOID, NO 16// signature. A generic e-sign clone would sign either; this 17// layer physically cannot. 18// E-WILL OK : a properly-executed e-will (testator + 2 witnesses + notary) 19// seals (SEAL_OK / ELECTRONIC_WILLS) and verifies. 20// 21// Evidence -> knowledge/status/doc_seal.log 22// license_tier: ORIGINAL 23import "nx_doc_seal.nx" 24import "nx_legal_compliance.nx" 25import "nx_syscalls.nx" 26 27const DS_LOG: *u8 = "knowledge/status/doc_seal.log" 28 29func ew(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 30func ewn(fd: i64, v: i64) -> i64 { 31 let bb: *u8 = sys_mmap(28); var m: i64 = v 32 if m < 0 { m = 0 - m; sys_write(fd, "-" as *u8, 1) } 33 let t: *u8 = sys_mmap(28); var k: i64 = 0 34 if m == 0 { t[0] = 48; k = 1 } 35 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 36 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } 37 sys_write(fd, bb, k); return 0 38} 39func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 40 41func main() -> i64 { 42 var ok: i64 = 1 43 44 // ---- RFC 8032 test-1 keypair (deterministic) ---- 45 let priv: *u8 = sys_mmap(64) 46 priv[0]=0x9d; priv[1]=0x61; priv[2]=0xb1; priv[3]=0x9d; priv[4]=0xef; priv[5]=0xfd; priv[6]=0x5a; priv[7]=0x60 47 priv[8]=0xba; priv[9]=0x84; priv[10]=0x4a; priv[11]=0xf4; priv[12]=0x92; priv[13]=0xec; priv[14]=0x2c; priv[15]=0xc4 48 priv[16]=0x44; priv[17]=0x49; priv[18]=0xc5; priv[19]=0x69; priv[20]=0x7b; priv[21]=0x32; priv[22]=0x69; priv[23]=0x19 49 priv[24]=0x70; priv[25]=0x3b; priv[26]=0xac; priv[27]=0x03; priv[28]=0x1c; priv[29]=0xae; priv[30]=0x7f; priv[31]=0x60 50 let pub: *u8 = sys_mmap(64) 51 pub[0]=0xd7; pub[1]=0x5a; pub[2]=0x98; pub[3]=0x01; pub[4]=0x82; pub[5]=0xb1; pub[6]=0x0a; pub[7]=0xb7 52 pub[8]=0xd5; pub[9]=0x4b; pub[10]=0xfe; pub[11]=0xd3; pub[12]=0xc9; pub[13]=0x64; pub[14]=0x07; pub[15]=0x3a 53 pub[16]=0x0e; pub[17]=0xe1; pub[18]=0x72; pub[19]=0xf3; pub[20]=0xda; pub[21]=0xa6; pub[22]=0x23; pub[23]=0x25 54 pub[24]=0xaf; pub[25]=0x02; pub[26]=0x1a; pub[27]=0x68; pub[28]=0xf7; pub[29]=0x07; pub[30]=0x51; pub[31]=0x1a 55 56 // ---- buffers + a synthetic 32-byte document hash ---- 57 let canon: *u8 = sys_mmap(512) 58 let sig: *u8 = sys_mmap(128) 59 let dh: *u8 = sys_mmap(64) 60 var di: i64 = 0 61 while di < 32 { dh[di] = ((di * 7 + 3) & 0xff) as u8; di = di + 1 } 62 let signer: *u8 = "attorney@andelinwest.com" as *u8 63 64 let s: *NxSeal = sys_mmap(256) as *NxSeal 65 s.doc_hash = dh; s.doc_hash_len = 32 66 s.signer_id = signer; s.signer_id_len = slen(signer) 67 s.ts = 1719300000 68 s.priv = priv 69 s.canon = canon 70 s.sig = sig 71 72 // ---- Test 1: VALID contract seals + verifies ---- 73 var t1: i64 = 1 74 s.doc_type = DT_CONTRACT; s.e_wills_allowed = 1 75 s.intent = 1; s.consent = 1; s.attribution = 1; s.retainable = 1; s.witnesses = 0; s.notarized = 0 76 let c1: i64 = nx_seal_create(s) 77 if c1 != SEAL_OK { t1 = 0 } 78 if s.status != SEAL_OK { t1 = 0 } 79 if s.verdict != LV_VALID { t1 = 0 } 80 let canon_len_1: i64 = s.canon_len 81 if nx_seal_verify(s, pub) != SEAL_VERIFIED { t1 = 0 } 82 if t1 != 1 { ok = 0 } 83 84 // ---- Test 2: tamper the canonical record -> TAMPERED, then restore ---- 85 var t2: i64 = 1 86 let cb: *u8 = s.canon 87 cb[12] = (cb[12] ^ 0x40) as u8 88 if nx_seal_verify(s, pub) != SEAL_TAMPERED { t2 = 0 } 89 cb[12] = (cb[12] ^ 0x40) as u8 90 if nx_seal_verify(s, pub) != SEAL_VERIFIED { t2 = 0 } 91 if t2 != 1 { ok = 0 } 92 93 // ---- Test 3: WILL, e-wills juris, NO witnesses -> REFUSED (never seal void) ---- 94 var t3: i64 = 1 95 s.doc_type = DT_WILL; s.e_wills_allowed = 1 96 s.intent = 1; s.consent = 1; s.attribution = 1; s.retainable = 1; s.witnesses = 0; s.notarized = 0 97 let c3: i64 = nx_seal_create(s) 98 if c3 == SEAL_OK { t3 = 0 } 99 if s.status == SEAL_OK { t3 = 0 } 100 if c3 != SEAL_REFUSED_NEEDS_MORE { t3 = 0 } 101 if t3 != 1 { ok = 0 } 102 103 // ---- Test 4: WILL, NO e-wills juris -> REFUSED_VOID (e-sign cannot execute) ---- 104 var t4: i64 = 1 105 s.doc_type = DT_WILL; s.e_wills_allowed = 0 106 s.intent = 1; s.consent = 1; s.attribution = 1; s.retainable = 1; s.witnesses = 2; s.notarized = 1 107 let c4: i64 = nx_seal_create(s) 108 if c4 != SEAL_REFUSED_VOID { t4 = 0 } 109 if t4 != 1 { ok = 0 } 110 111 // ---- Test 5: properly-executed e-will -> OK + verifies ---- 112 var t5: i64 = 1 113 s.doc_type = DT_WILL; s.e_wills_allowed = 1 114 s.intent = 1; s.consent = 0; s.attribution = 1; s.retainable = 1; s.witnesses = 2; s.notarized = 1 115 let c5: i64 = nx_seal_create(s) 116 if c5 != SEAL_OK { t5 = 0 } 117 if s.regime != RG_ELECTRONIC_WILLS { t5 = 0 } 118 if nx_seal_verify(s, pub) != SEAL_VERIFIED { t5 = 0 } 119 if t5 != 1 { ok = 0 } 120 121 // ---- evidence ---- 122 var fd: i64 = 1 123 while fd >= 1 { 124 ew(fd, "DOCSEALGATE authored=organ crypto=ed25519_rfc8032 contract_seal_verify=" as *u8); ewn(fd, t1) 125 ew(fd, " canon_len=" as *u8); ewn(fd, canon_len_1) 126 ew(fd, " tamper_detected=" as *u8); ewn(fd, t2) 127 ew(fd, " will_nowitness_refused=" as *u8); ewn(fd, t3) 128 ew(fd, " will_nojurisdiction_void=" as *u8); ewn(fd, t4) 129 ew(fd, " ewill_proper_seal_verify=" as *u8); ewn(fd, t5) 130 if ok == 1 { ew(fd, " verdict=GREEN\n" as *u8) } else { ew(fd, " verdict=RED\n" as *u8) } 131 if fd == 1 { 132 let lf: i64 = sys_openat_append(DS_LOG, 420) 133 if lf >= 1 { fd = lf } else { fd = 0 } 134 } else { 135 sys_close(fd); fd = 0 136 } 137 } 138 139 if ok == 1 { return 0 } 140 return 1 141}