code wiki / _hdl_build / nx_infra_control.nx
`nx_infra_control.nx` source

1// nx_infra_control.nx -- sovereign INFRA-HOST control posture model (operator: "sovereign control of
2// NAS / router / west-server"). Operationalizes the Trusting-Trust defense at the infra layer: a host is
3// NOT trusted by NAME ("I am the NAS") but by BEHAVIOR matching spec, and a claim of sovereign control is
4// REFUSED unless the control path is actually sovereign (not vendor DSM / router firmware / 3rd-party
5// OpenSSH). Pure logic; the census is DATA (knowledge/registry/infra_hosts.tsv); the gate proves it with a
6// liar-kill (a false-sovereign claim is caught). NO fabricated exceed -- vendor-dependence today is the
7// honest BEHIND. license_tier: ORIGINAL  Composes the trust-by-behavior law + the sovereign nx_ssh_client.
8import "nx_syscalls.nx"
9
10// trust posture -- WHY we trust the host
11const TP_NAME_TRUSTED:      i64 = 1   // trusted because it claims an identity (the Thompson danger)
12const TP_BEHAVIOR_ATTESTED: i64 = 2   // trusted only by proving behavior matches spec
13
14// control path -- WHO actually drives the host
15const CP_VENDOR:    i64 = 0   // DSM / router web UI / vendor firmware -- NOT operator-fixable
16const CP_OPENSSH:   i64 = 1   // 3rd-party OpenSSH transport -- better, still not operator-owned
17const CP_SOVEREIGN: i64 = 2   // nx_ssh_client / sovereign organ -- operator-owned bits-up
18
19// sovereign control level -- HOW MUCH of the host we drive bits-up
20const SC_NONE:    i64 = 0
21const SC_PARTIAL: i64 = 1     // sovereign organ can reach/recon; vendor still owns config/firmware
22const SC_FULL:    i64 = 2     // driven end-to-end by sovereign organs, no vendor trust-root
23
24// is the control path operator-owned (bits-up)?
25func ic_is_sovereign(cp: i64) -> i64 { if cp == CP_SOVEREIGN { return 1 } return 0 }
26
27// THE LIAR-KILL: a host that CLAIMS full sovereign control but is driven by a non-sovereign path is a
28// false-sovereign claim -- exactly the "trust by name" lie the defense forbids. Returns 1 if it lies.
29func ic_false_sovereign(sc: i64, cp: i64) -> i64 { if sc == SC_FULL { if cp != CP_SOVEREIGN { return 1 } } return 0 }
30
31// a sovereignty GAP = a host still trusted by name (honest BEHIND, the work to close -- not a violation).
32func ic_gap(tp: i64) -> i64 { if tp == TP_NAME_TRUSTED { return 1 } return 0 }
33
34// per-host posture is CLEAN iff it makes no false-sovereign claim (gaps are allowed-but-counted).
35func ic_posture_clean(sc: i64, cp: i64) -> i64 { if ic_false_sovereign(sc, cp) == 1 { return 0 } return 1 }
36
37// sovereign-control coverage in permil (hosts on a sovereign control path / total). honest, no fabrication.
38func ic_coverage_permil(sovereign_hosts: i64, total: i64) -> i64 { if total == 0 { return 0 } return (sovereign_hosts * 1000) / total }
nx_infra_control.nx source

`nx_infra_control.nx` source
