code wiki / _hdl_build / nx_host_attest_test.nx
`nx_host_attest_test.nx` source

1// nx_host_attest_test.nx -- HOSTATTESTGATE: proves sovereign behavior-attestation. An honest host whose
2// observed probe responses MATCH the spec fingerprint (with >=2 diverse paths agreeing) upgrades
3// NAME-TRUSTED -> BEHAVIOR-ATTESTED. A swapped/poisoned host (one probe response wrong) is REFUSED and stays
4// NAME-TRUSTED (the L2-silicon / L4-OS swap defense, executable). Single-source (paths<2) = auto-distrust.
5// GREEN iff golden attests, swap is caught, single-source is refused. exit 0 on 6/6.
6import "nx_host_attest.nx"
7import "nx_syscalls.nx"
8
9func ag_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
10func ag_num(v: i64) -> i64 { let b: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {b[i]=t[k-1-i]; i=i+1}; sys_write(1,b,k); return 0 }
11
12func main() -> i64 {
13    ag_puts("=== SOVEREIGN HOST BEHAVIOR-ATTESTATION (prove behavior vs spec, refuse a swap) ===\n" as *u8)
14    let n: i64 = 4
15    let exp: *i64 = sys_mmap(32) as *i64
16    let obs: *i64 = sys_mmap(32) as *i64
17    let bad: *i64 = sys_mmap(32) as *i64
18    exp[0]=11; exp[1]=22; exp[2]=33; exp[3]=44      // spec-expected behavioral fingerprint (DATA)
19    obs[0]=11; obs[1]=22; obs[2]=33; obs[3]=44      // honest host: behavior == spec
20    bad[0]=11; bad[1]=22; bad[2]=99; bad[3]=44      // swapped/poisoned host: probe 3 response wrong
21
22    let m_good: i64 = ha_match(obs, exp, n)
23    let m_bad:  i64 = ha_match(bad, exp, n)
24    let att_good:   i64 = ha_attest(m_good, 2)      // match + 2 diverse paths -> attested
25    let att_swap:   i64 = ha_attest(m_bad, 2)       // mismatch -> REFUSED (liar-kill)
26    let att_single: i64 = ha_attest(m_good, 1)      // single-source -> auto-distrust
27
28    ag_puts(" honest host: match=" as *u8); ag_num(m_good); ag_puts(" attested=" as *u8); ag_num(att_good); ag_puts(" posture=" as *u8); ag_num(ha_posture(att_good)); ag_puts(" (2=BEHAVIOR-ATTESTED)\n" as *u8)
29    ag_puts(" swapped host: match=" as *u8); ag_num(m_bad); ag_puts(" attested=" as *u8); ag_num(att_swap); ag_puts(" posture=" as *u8); ag_num(ha_posture(att_swap)); ag_puts(" (1=NAME-TRUSTED, REFUSED)\n" as *u8)
30    ag_puts(" single-source: attested=" as *u8); ag_num(att_single); ag_puts(" (0=auto-distrust, principle #3)\n" as *u8)
31
32    let r: *i64 = sys_mmap(8*8) as *i64
33    r[0] = 0; if att_good == 1 { r[0] = 1 }                                  // golden attests
34    r[1] = 0; if att_swap == 0 { r[1] = 1 }                                  // swap caught -> REFUSED
35    r[2] = 0; if att_single == 0 { r[2] = 1 }                                // single-source auto-distrust
36    r[3] = 0; if ha_posture(att_good) == TP_BEHAVIOR_ATTESTED { r[3] = 1 }   // upgrade only on real attest
37    r[4] = 0; if ha_posture(att_swap) == TP_NAME_TRUSTED { r[4] = 1 }        // swap never upgrades
38    r[5] = 0; if m_good == 1 { if m_bad == 0 { r[5] = 1 } }                  // fingerprint compare is real
39
40    var pass: i64 = 0; var i: i64 = 0
41    while i < 6 { pass = pass + r[i]; i = i + 1 }
42    ag_puts("----\n passed " as *u8); ag_num(pass); ag_puts("/6\n" as *u8)
43    if pass == 6 {
44        ag_puts("HOSTATTESTGATE probes=4 golden_attested=1 swap_refused=1 single_source_distrust=1 upgrade=NAME-TRUSTED->BEHAVIOR-ATTESTED exceed[trust-by-behavior-not-name + swap/poison refusal; live-credential probe wiring is the OUTWARD-FACING follow-on (operator go)] verdict=GREEN\n" as *u8)
45        sys_exit(0); return 0
46    }
47    ag_puts("HOSTATTESTGATE verdict=RED\n" as *u8); sys_exit(1); return 1
48}
nx_host_attest_test.nx source

`nx_host_attest_test.nx` source
