nx_evoracle_gate.nx source

1// nx_evoracle_gate.nx -- teeth for THE INDEPENDENCE LAW (nx_evoracle.nx). 2// 3// Written to clause 4 of the evidence law: EVERY clause has a NEGATIVE CONTROL that makes it fire. A gate 4// that only ever asserts the happy path has not been shown to measure anything -- and this lane has already 5// paid for that lesson twice (a filter that excluded its own target class reported nothing-to-test, which 6// reads identically to nothing-to-find). 7// 8// T3 IS THE GATE THAT MATTERS. It is the single move by which this classifier could be gamed: name-drop 9// RFC 7748 in a comment while computing your own expected values, and collect a THIRD-party label for 10// first-party work. T3 replays exactly that forgery and requires FIRST. If T3 ever passes by returning 11// THIRD, the classifier has become the thing it audits. 12// T1 and T2 are drawn from REAL corpus headers, not invented fixtures: T1 is the header of 13// nx_x25519_kat_gate.nx (RFC 7748 + OpenSSL cross-check) and T2 is the header of nx_lex_kat.nx (all 256 14// bytes vs inlined ground truth). A classifier proven only on fixtures its author designed is a fixture 15// test; these two are the measured population it must separate. 16// license_tier: ORIGINAL expect_exit: 0 17import "nx_syscalls.nx" 18import "nx_evoracle.nx" 19 20func gw(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 21 22func gn(v: i64) -> i64 { 23 var m: i64 = v 24 if m < 0 { gw("-" as *u8); m = 0 - m } 25 let t: *u8 = sys_mmap(24) 26 var k: i64 = 0 27 if m == 0 { t[0] = 48 as u8; k = 1 } 28 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 29 let b: *u8 = sys_mmap(24) 30 var j: i64 = 0 31 while j < k { b[j] = t[k - 1 - j]; j = j + 1 } 32 sys_write(1, b, k) 33 return 0 34} 35 36func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 37 38func chk(c: *i64, name: *u8, got: i64, want: i64) -> i64 { 39 if got == want { 40 c[0] = c[0] + 1 41 gw(" PASS " as *u8); gw(name); gw("\n" as *u8) 42 return 1 43 } 44 c[1] = c[1] + 1 45 gw(" FAIL " as *u8); gw(name); gw(" got=" as *u8); gn(got); gw(" want=" as *u8); gn(want); gw("\n" as *u8) 46 return 0 47} 48 49func main() -> i64 { 50 let c: *i64 = sys_mmap(64) as *i64 51 c[0] = 0 52 c[1] = 0 53 gw("nx_evoracle_gate -- THE INDEPENDENCE LAW (party-ness of evidence)\n" as *u8) 54 55 let t1: *u8 = "RIGOROUS standing KAT for X25519 (RFC 7748). T1 RFC 7748 5.2 test-1, T10 OpenSSL-verified\x00" as *u8 56 let t2: *u8 = "EXHAUSTIVE KAT for nx_lex. All 256 bytes vs inlined ground truth. func gt_ws(c: i64)\x00" as *u8 57 let t3: *u8 = "KAT per RFC 7748 section 5.2 -- expected values from func gt_expected below\x00" as *u8 58 let t4: *u8 = "differential parity: every output compared against the OpenSSL reference implementation\x00" as *u8 59 let t5: *u8 = "checks that the encoder round-trips and the counters increment as designed\x00" as *u8 60 let t6: *u8 = "\x00" as *u8 61 62 gw(" -- classifier on REAL corpus headers --\n" as *u8) 63 chk(c, "T1 x25519 header (RFC 7748 cited) -> THIRD" as *u8, evo_classify(t1, slen(t1)), EVO_P_THIRD) 64 chk(c, "T2 NEG lex header (inlined truth) -> FIRST" as *u8, evo_classify(t2, slen(t2)), EVO_P_FIRST) 65 chk(c, "T3 NEG *THE FORGERY* RFC + own answers -> FIRST" as *u8, evo_classify(t3, slen(t3)), EVO_P_FIRST) 66 chk(c, "T4 refimpl differential (OpenSSL) -> THIRD" as *u8, evo_classify(t4, slen(t4)), EVO_P_THIRD) 67 chk(c, "T5 no authority named -> UNRESOLVED" as *u8, evo_classify(t5, slen(t5)), EVO_P_UNRESOLVED) 68 chk(c, "T6 NEG empty buffer -> UNRESOLVED" as *u8, evo_classify(t6, 0), EVO_P_UNRESOLVED) 69 70 gw(" -- the diagnostic must NAME the defect, not just deny --\n" as *u8) 71 chk(c, "T7 self-oracle reason = SELF_ORACLE" as *u8, evo_refuse_reason(t2, slen(t2)), EVO_R_SELF_ORACLE) 72 chk(c, "T8 no-citation reason = NO_CITATION" as *u8, evo_refuse_reason(t5, slen(t5)), EVO_R_NO_CITATION) 73 chk(c, "T9 third-party reason = OK" as *u8, evo_refuse_reason(t1, slen(t1)), EVO_R_OK) 74 75 gw(" -- find(): index 0 is a HIT, not an absence --\n" as *u8) 76 let h: *u8 = "RFC 7748 at the very start\x00" as *u8 77 chk(c, "T10 needle at byte 0 is found" as *u8, evo_find(h, slen(h), "RFC" as *u8), 0) 78 chk(c, "T11 NEG absent needle returns -1" as *u8, evo_find(h, slen(h), "FIPS" as *u8), 0 - 1) 79 80 gw(" -- ORACLE ROW: derived, never declared --\n" as *u8) 81 let r1: *u8 = "class=oracle verdict=pass scope=x25519 ref=RFC7748-5.2 refdig=52f7dd94 gate=nx_x25519_kat_gate signer=nx\x00" as *u8 82 let r2: *u8 = "class=oracle verdict=pass scope=x25519 ref=RFC7748-5.2 gate=nx_x25519_kat_gate signer=nx\x00" as *u8 83 let r3: *u8 = "class=oracle verdict=pass scope=x25519 ref=RFC7748-5.2 refdig=52f7dd94 signer=nx\x00" as *u8 84 let r4: *u8 = "class=oracle verdict=pass scope=x25519 refdig=52f7dd94 gate=nx_x25519_kat_gate signer=nx\x00" as *u8 85 chk(c, "T12 complete row accepted" as *u8, evo_row_derived_ok(r1, slen(r1)), 1) 86 chk(c, "T13 NEG no refdig= REFUSED" as *u8, evo_row_derived_ok(r2, slen(r2)), 0) 87 chk(c, "T14 NEG no gate= REFUSED" as *u8, evo_row_derived_ok(r3, slen(r3)), 0) 88 chk(c, "T15 NEG no ref= REFUSED" as *u8, evo_row_derived_ok(r4, slen(r4)), 0) 89 chk(c, "T16 missing-refdig reason named" as *u8, evo_row_reason(r2, slen(r2)), EVO_R_NO_REFDIGEST) 90 chk(c, "T17 missing-gate reason named" as *u8, evo_row_reason(r3, slen(r3)), EVO_R_NOT_DERIVED) 91 92 gw(" -- the clause DEGRADES, it must never convict --\n" as *u8) 93 chk(c, "T18 THIRD meets a THIRD floor" as *u8, evo_independence_ok(EVO_P_THIRD, EVO_P_THIRD), 1) 94 chk(c, "T19 NEG FIRST fails a THIRD floor" as *u8, evo_independence_ok(EVO_P_FIRST, EVO_P_THIRD), 0) 95 chk(c, "T20 SECOND fails a THIRD floor" as *u8, evo_independence_ok(EVO_P_SECOND, EVO_P_THIRD), 0) 96 chk(c, "T21 floor 0 disables the clause" as *u8, evo_independence_ok(EVO_P_FIRST, 0), 1) 97 98 gw(" -- ANSWER PROVENANCE: an agent cannot supply external answers --\n" as *u8) 99 let a1: *u8 = "class=oracle ref=RFC8032 refdig=aa11 gate=g refsrc=https://rfc-editor.org/rfc/rfc8032.txt refsrcdig=bb22\x00" as *u8 100 let a2: *u8 = "class=oracle ref=RFC8032 refdig=aa11 gate=g refsrcdig=bb22\x00" as *u8 101 let a3: *u8 = "class=oracle ref=RFC8032 refdig=aa11 gate=g refsrc=https://rfc-editor.org/rfc/rfc8032.txt\x00" as *u8 102 let a4: *u8 = "class=oracle ref=RFC8032 refdig=aa11 gate=g\x00" as *u8 103 chk(c, "T23 row pinning refsrc+refsrcdig is answer-provenanced" as *u8, evo_answers_external(a1, slen(a1)), 1) 104 chk(c, "T24 NEG refsrcdig without refsrc REFUSED" as *u8, evo_answers_external(a2, slen(a2)), 0) 105 chk(c, "T25 NEG refsrc without refsrcdig REFUSED" as *u8, evo_answers_external(a3, slen(a3)), 0) 106 chk(c, "T26 NEG *THE RECALL FORGERY* neither field -> capped at SPECIFIED" as *u8, evo_row_tier(a4, slen(a4), EVO_V_VALIDATED), EVO_V_SPECIFIED) 107 chk(c, "T27 provenanced row keeps VALIDATED" as *u8, evo_row_tier(a1, slen(a1), EVO_V_VALIDATED), EVO_V_VALIDATED) 108 chk(c, "T28 a SPECIFIED subject is never upgraded by provenance" as *u8, evo_row_tier(a1, slen(a1), EVO_V_SPECIFIED), EVO_V_SPECIFIED) 109 110 gw(" -- tiers are ORDERED so a downgrade can never read as an upgrade --\n" as *u8) 111 var ord: i64 = 0 112 if EVO_P_THIRD > EVO_P_SECOND { if EVO_P_SECOND > EVO_P_FIRST { if EVO_P_FIRST > EVO_P_UNRESOLVED { ord = 1 } } } 113 chk(c, "T22 UNRESOLVED < FIRST < SECOND < THIRD" as *u8, ord, 1) 114 115 gw("\nnx_evoracle_gate: pass=" as *u8); gn(c[0]); gw(" fail=" as *u8); gn(c[1]) 116 if c[1] == 0 { gw(" verdict=GREEN\n" as *u8); return 0 } 117 gw(" verdict=RED\n" as *u8) 118 return 1 119}