nx_infra_control_test.nx source

1// nx_infra_control_test.nx -- INFRACTLGATE: proves the sovereign infra-host control posture model over the 2// honest current census (NAS / router / west-server) AND catches false-sovereign lies (liar-kill). 3// Honest current state: all three still NAME-TRUSTED + vendor/OpenSSH-driven => 3 gaps, 0 violations, 4// sovereign-coverage 0permil (no host on a bits-up control path yet). GREEN iff the census is CONSISTENT 5// (no false-sovereign claims), the tampers (claiming sovereign control over a vendor/OpenSSH path) are 6// CAUGHT, and the real sovereign end-state is NOT flagged. NO fabricated exceed. exit 0 on 7/7. 7import "nx_infra_control.nx" 8import "nx_syscalls.nx" 9 10func ig_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 11func ig_num(v: i64) -> i64 { let b: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {b[i]=t[k-1-i]; i=i+1}; sys_write(1,b,k); return 0 } 12 13func main() -> i64 { 14 ig_puts("=== SOVEREIGN INFRA-HOST CONTROL POSTURE (trust by behavior, not by name) ===\n" as *u8) 15 let N: i64 = 3 16 // honest current census: [0]=NAS(192.168.8.227) [1]=router(gateway) [2]=west-server 17 let sc: *i64 = sys_mmap(24) as *i64 18 let cp: *i64 = sys_mmap(24) as *i64 19 let tp: *i64 = sys_mmap(24) as *i64 20 sc[0]=SC_PARTIAL; cp[0]=CP_OPENSSH; tp[0]=TP_NAME_TRUSTED // NAS: sovereign recon PROVEN, DSM owns config 21 sc[1]=SC_NONE; cp[1]=CP_VENDOR; tp[1]=TP_NAME_TRUSTED // router: vendor firmware, no sovereign path 22 sc[2]=SC_PARTIAL; cp[2]=CP_OPENSSH; tp[2]=TP_NAME_TRUSTED // west-server: reachable, vendor OS 23 24 var viol: i64 = 0; var gaps: i64 = 0; var sov: i64 = 0; var i: i64 = 0 25 while i < N { 26 viol = viol + ic_false_sovereign(sc[i], cp[i]) 27 gaps = gaps + ic_gap(tp[i]) 28 sov = sov + ic_is_sovereign(cp[i]) 29 i = i + 1 30 } 31 let cov: i64 = ic_coverage_permil(sov, N) 32 ig_puts(" honest census: hosts=" as *u8); ig_num(N); ig_puts(" violations=" as *u8); ig_num(viol) 33 ig_puts(" gaps(name-trusted)=" as *u8); ig_num(gaps); ig_puts(" sovereign_coverage=" as *u8); ig_num(cov); ig_puts("permil\n" as *u8) 34 35 // tamper A (liar-kill): claim NAS is FULLY sovereign while still on OpenSSH -> must be caught 36 let tA: i64 = ic_false_sovereign(SC_FULL, CP_OPENSSH) 37 // tamper B (liar-kill): claim router FULLY sovereign while on vendor firmware -> must be caught 38 let tB: i64 = ic_false_sovereign(SC_FULL, CP_VENDOR) 39 // target end-state: NAS driven by a sovereign organ, FULL -> NOT a lie (the EXCEED target is consistent) 40 let tgt: i64 = ic_false_sovereign(SC_FULL, CP_SOVEREIGN) 41 ig_puts(" liar-kill: NAS-false-sovereign=" as *u8); ig_num(tA); ig_puts(" router-false-sovereign=" as *u8); ig_num(tB) 42 ig_puts(" target(sovereign+full)-legit=" as *u8); ig_num(1 - tgt); ig_puts("\n" as *u8) 43 44 let r: *i64 = sys_mmap(8*8) as *i64 45 r[0] = 0; if viol == 0 { r[0] = 1 } // honest census is consistent (no false claims) 46 r[1] = 0; if gaps == 3 { r[1] = 1 } // all three honestly BEHIND (name-trusted today) 47 r[2] = 0; if tA == 1 { r[2] = 1 } // false-sovereign NAS claim CAUGHT 48 r[3] = 0; if tB == 1 { r[3] = 1 } // false-sovereign router claim CAUGHT 49 r[4] = 0; if tgt == 0 { r[4] = 1 } // the real sovereign end-state is NOT flagged 50 r[5] = 0; if cov == 0 { r[5] = 1 } // honest coverage = 0permil (no bits-up path live yet) 51 r[6] = 0; if ic_posture_clean(SC_FULL, CP_VENDOR) == 0 { if ic_posture_clean(SC_PARTIAL, CP_OPENSSH) == 1 { r[6] = 1 } } 52 53 var pass: i64 = 0; i = 0 54 while i < 7 { pass = pass + r[i]; i = i + 1 } 55 ig_puts("----\n passed " as *u8); ig_num(pass); ig_puts("/7\n" as *u8) 56 if pass == 7 { 57 ig_puts("INFRACTLGATE hosts=3 violations=0 gaps=3 sovereign_coverage=0permil tamper_caught=2 exceed[posture-AHEAD(behavior-not-name trust model + false-sovereign liar-kill);breadth-BEHIND(NAS/router/west-server still vendor/OpenSSH-driven today -- NO-FABRICATED-WIN)] verdict=GREEN\n" as *u8) 58 sys_exit(0); return 0 59 } 60 ig_puts("INFRACTLGATE verdict=RED\n" as *u8); sys_exit(1); return 1 61}