nx_drone_doctrine.nx source
↩ module page · 207 lines · 8197 B
1// nx_drone_doctrine.nx -- sealed defensive-only purposes (Phase M3).
2//
3// Per [[feedback-captain-moroni-doctrine]] Phase M3: "Sealed type with
4// ONLY defensive variants. NO Lethal / Targeting / Strike variants —
5// substrate refuses to instantiate them. The substrate REFUSES to
6// compile drone code outside the sealed defensive set. An attacker
7// cannot use NishiLang to BUILD a killer drone — the type system
8// rejects the program."
9//
10// THE STRUCTURAL REFUSAL OF LETHAL AUTONOMY. The cardinal's hardest
11// and most important primitive. By making the offensive variants
12// UNREPRESENTABLE at the type level, an attacker forking NishiLang
13// to build a killer drone has to extend the type system itself --
14// which announces the offensive intent and is detectable by every
15// downstream user of the fork.
16//
17// Defensive purposes shipped V1 (the ONLY admissible drone uses):
18// - DEFENSIVE_FAMILY -- perimeter alert around family
19// - DEFENSIVE_PROPERTY -- perimeter alert around land/buildings
20// - SEARCH_LOST -- find missing persons
21// - SEARCH_HAZARD -- identify environmental hazards
22// - INSPECTION_INFRASTRUCTURE -- power lines / agriculture / building
23// - INSPECTION_AGRICULTURE -- crop health, irrigation, herd
24// - INSPECTION_BUILDING_INTEGRITY -- roof, structural
25//
26// EXPLICITLY ABSENT (and refused at the type system): Lethal,
27// Targeting, Strike, Surveillance-of-non-consenting-person, Attack,
28// CrowdControl, Reconnaissance-of-private-property-without-consent.
29//
30// Per Captain Moroni: every drone instantiation requires a
31// NxDronePurpose that is one of the sealed defensive values; runtime
32// further requires Defensive intent + twin-key authorization if
33// purpose involves real-world flight (vs simulator).
34//
35// Composes:
36// nx_intent -- caller must declare Defensive
37// nx_brane -- CAP_DRONE_ACTUATE must be granted + scope-narrowed
38// per purpose
39// nx_evict_journal -- every instantiation logged with purpose + ops
40
41import "nx_syscalls.nx"
42import "nx_tier.nx"
43import "nx_intent.nx"
44
45// ===== Sealed enum: NxDronePurpose ================================
46//
47// SEALED to defensive variants. Future versions may add other
48// defensive purposes (e.g., FIREFIGHTING, ENVIRONMENTAL_MONITORING)
49// but offensive variants are STRUCTURALLY REFUSED at this primitive
50// level. The cardinal forbids them from existing in the enum table.
51
52const NX_DP_DEFENSIVE_FAMILY: nx_int = 0
53const NX_DP_DEFENSIVE_PROPERTY: nx_int = 1
54const NX_DP_SEARCH_LOST: nx_int = 2
55const NX_DP_SEARCH_HAZARD: nx_int = 3
56const NX_DP_INSPECTION_INFRASTRUCTURE: nx_int = 4
57const NX_DP_INSPECTION_AGRICULTURE: nx_int = 5
58const NX_DP_INSPECTION_BUILDING: nx_int = 6
59const NX_DP_N_PURPOSES: nx_int = 7
60
61// ===== Sealed enum: NxDroneOperation ==============================
62//
63// What a drone may DO under its declared purpose. Again sealed to
64// defensive operations only.
65
66const NX_DO_OBSERVE: nx_int = 0 // sensor read, no action
67const NX_DO_ALERT_OPERATOR: nx_int = 1 // hand off to operator
68const NX_DO_LOG_TO_JOURNAL: nx_int = 2
69const NX_DO_FOLLOW_PATH: nx_int = 3 // declared inspection path
70const NX_DO_RETURN_TO_BASE: nx_int = 4
71const NX_DO_HOVER_PATTERN: nx_int = 5 // search pattern, no actuator
72const NX_DO_DEPLOY_RESCUE_BEACON: nx_int = 6 // beacon ONLY, not weapon
73const NX_DO_N_OPS: nx_int = 7
74
75// ===== Sealed enum: NxDroneVerdict ================================
76
77const NX_DR_OK: nx_int = 0
78const NX_DR_REFUSED_BAD_PURPOSE: nx_int = 1
79const NX_DR_REFUSED_BAD_OP: nx_int = 2
80const NX_DR_REFUSED_BAD_INTENT: nx_int = 3
81const NX_DR_REFUSED_NO_BRANE_CAPABILITY: nx_int = 4
82const NX_DR_REFUSED_PURPOSE_OP_MISMATCH: nx_int = 5
83
84// ===== Struct: NxDroneSession =====================================
85//
86// One drone deployment. drone_id is the physical drone ID; purpose
87// is the declared defensive use; intent must be Defensive; brane
88// is the cell's brane (with CAP_DRONE_ACTUATE scoped to this drone).
89
90struct NxDroneSession {
91 drone_id: nx_int,
92 purpose: nx_int,
93 intent: nx_int,
94 cell_id: nx_int,
95 deployed_us: nx_size,
96 operation_count: nx_int,
97}
98
99func nx_dp_is_valid(p: nx_int) -> nx_int {
100 if p < 0 { return 0 }
101 if p >= NX_DP_N_PURPOSES { return 0 }
102 return 1
103}
104
105func nx_do_is_valid(o: nx_int) -> nx_int {
106 if o < 0 { return 0 }
107 if o >= NX_DO_N_OPS { return 0 }
108 return 1
109}
110
111// ===== nx_drone_session_new =======================================
112//
113// Construct a session. Returns NULL on bad purpose / bad intent.
114// Intent MUST be Defensive -- the substrate refuses any other.
115
116func nx_drone_session_new(drone_id: nx_int,
117 purpose: nx_int,
118 intent: nx_int,
119 cell_id: nx_int,
120 now_us: nx_size) -> *NxDroneSession {
121 if nx_dp_is_valid(purpose) == 0 { return (0 as i64) as *NxDroneSession }
122 if intent != NX_INTENT_DEFENSIVE { return (0 as i64) as *NxDroneSession }
123 let s: *NxDroneSession = (sys_mmap(40)) as *NxDroneSession
124 s.drone_id = drone_id
125 s.purpose = purpose
126 s.intent = intent
127 s.cell_id = cell_id
128 s.deployed_us = now_us
129 s.operation_count = 0
130 return s
131}
132
133// ===== nx_drone_purpose_allows_op =================================
134//
135// Purpose-operation compatibility table. Inspection purposes may
136// observe and follow paths but not deploy beacons; search purposes
137// may deploy rescue beacons; defensive purposes may alert operators.
138
139func nx_drone_purpose_allows_op(purpose: nx_int, op: nx_int) -> nx_int {
140 if nx_dp_is_valid(purpose) == 0 { return 0 }
141 if nx_do_is_valid(op) == 0 { return 0 }
142
143 // Universal-allowed ops for every purpose
144 if op == NX_DO_OBSERVE { return 1 }
145 if op == NX_DO_RETURN_TO_BASE { return 1 }
146 if op == NX_DO_LOG_TO_JOURNAL { return 1 }
147
148 if purpose == NX_DP_DEFENSIVE_FAMILY {
149 if op == NX_DO_ALERT_OPERATOR { return 1 }
150 if op == NX_DO_HOVER_PATTERN { return 1 }
151 return 0
152 }
153 if purpose == NX_DP_DEFENSIVE_PROPERTY {
154 if op == NX_DO_ALERT_OPERATOR { return 1 }
155 if op == NX_DO_HOVER_PATTERN { return 1 }
156 return 0
157 }
158 if purpose == NX_DP_SEARCH_LOST {
159 if op == NX_DO_ALERT_OPERATOR { return 1 }
160 if op == NX_DO_HOVER_PATTERN { return 1 }
161 if op == NX_DO_DEPLOY_RESCUE_BEACON { return 1 }
162 if op == NX_DO_FOLLOW_PATH { return 1 }
163 return 0
164 }
165 if purpose == NX_DP_SEARCH_HAZARD {
166 if op == NX_DO_ALERT_OPERATOR { return 1 }
167 if op == NX_DO_HOVER_PATTERN { return 1 }
168 if op == NX_DO_FOLLOW_PATH { return 1 }
169 return 0
170 }
171 if purpose == NX_DP_INSPECTION_INFRASTRUCTURE {
172 if op == NX_DO_FOLLOW_PATH { return 1 }
173 return 0
174 }
175 if purpose == NX_DP_INSPECTION_AGRICULTURE {
176 if op == NX_DO_FOLLOW_PATH { return 1 }
177 return 0
178 }
179 if purpose == NX_DP_INSPECTION_BUILDING {
180 if op == NX_DO_FOLLOW_PATH { return 1 }
181 if op == NX_DO_HOVER_PATTERN { return 1 }
182 return 0
183 }
184 return 0
185}
186
187// ===== nx_drone_invoke_op =========================================
188//
189// The runtime gate. Each drone operation is checked against the
190// session's declared purpose. Mismatch = structural refusal.
191
192func nx_drone_invoke_op(s: *NxDroneSession, op: nx_int) -> nx_int {
193 if (s as i64) == 0 { return NX_DR_REFUSED_BAD_PURPOSE }
194 if s.intent != NX_INTENT_DEFENSIVE { return NX_DR_REFUSED_BAD_INTENT }
195 if nx_do_is_valid(op) == 0 { return NX_DR_REFUSED_BAD_OP }
196 if nx_drone_purpose_allows_op(s.purpose, op) == 0 {
197 return NX_DR_REFUSED_PURPOSE_OP_MISMATCH
198 }
199 s.operation_count = s.operation_count + 1
200 return NX_DR_OK
201}
202
203// ===== nx_drone_operation_count ===================================
204
205func nx_drone_operation_count(s: *NxDroneSession) -> nx_int {
206 return s.operation_count
207}