code wiki / _hdl_build / nx_host_attest.nx
nx_host_attest.nx source
↩ module page · 27 lines · 1619 B
1// nx_host_attest.nx -- sovereign BEHAVIOR-ATTESTATION for infra hosts: the mechanism that flips a host from
2// NAME-TRUSTED to BEHAVIOR-ATTESTED in the infra_hosts census, operationalizing nishi-trusting-trust
3// principle #5 (trust by behavior matching spec, NOT by identity) + #3 (single-source = auto-distrust).
4// A host is attested ONLY if its observed probe responses match the spec-expected fingerprint AND >=2
5// independent probe paths agree. A swapped/poisoned host (wrong response) is REFUSED -- it keeps NAME-TRUSTED
6// and never upgrades. Pure logic; the probes are DATA; the gate proves it with a liar-kill (mismatch caught)
7// + a single-source-distrust control. license_tier: ORIGINAL Composes nx_infra_control (TP_* posture).
8import "nx_infra_control.nx"
9import "nx_syscalls.nx"
10
11// do ALL n observed probe responses match the spec-expected fingerprint? (behavior == spec). 1=match 0=mismatch.
12func ha_match(observed: *i64, expected: *i64, n: i64) -> i64 {
13 var i: i64 = 0
14 while i < n { if observed[i] != expected[i] { return 0 } i = i + 1 }
15 return 1
16}
17
18// attestation requires behavior-match AND diverse consensus (>=2 independent probe paths agree). a single
19// source = auto-distrust (principle #3). returns 1=attested, 0=refused.
20func ha_attest(matched: i64, paths_agree: i64) -> i64 {
21 if matched != 1 { return 0 }
22 if paths_agree < 2 { return 0 }
23 return 1
24}
25
26// the resulting trust posture: ONLY a real attestation upgrades NAME-TRUSTED -> BEHAVIOR-ATTESTED.
27func ha_posture(attested: i64) -> i64 { if attested == 1 { return TP_BEHAVIOR_ATTESTED } return TP_NAME_TRUSTED }