nx_intent.nx source

1// nx_intent.nx -- per-function intent declaration (Captain Moroni Phase M1). 2// 3// Per [[feedback-captain-moroni-doctrine]] Phase M1: "nx_intent<I> 4// sealed type with values Defensive | Diagnostic | Educational | 5// Creative. EVERY function declares intent; substrate refuses 6// unintented operations." 7// 8// THE STRUCTURAL REFUSAL FOUNDATION. Substrate-level enforcement (not 9// policy-level) of the Captain Moroni doctrine. A function declared 10// with intent=Defensive cannot be invoked to compose an offensive 11// operation; intent=Educational cannot exfiltrate; intent=Creative 12// cannot command physical actuators. 13// 14// Distinct from nx_intent_survival.nx (image-render-verification 15// primitive); the suffixed name there avoids any collision with this 16// foundational primitive. 17// 18// Composes: 19// nx_cell -- every cell declares its meta-intent 20// nx_brane -- capability checks compose with intent checks 21// nx_drone_doctrine -- intent must be Defensive for drone code 22// nx_battery_safety -- intent restricts BMS commands 23// nx_pollinate -- federation refuses non-Defensive payloads 24// 25// V1 ships: 26// - 4 sealed values per cardinal 27// - intent-pair compatibility table (caller's declared intent must 28// be CONSISTENT with callee's declared intent) 29// - structural-refusal predicate for offensive-pattern operations 30 31import "nx_syscalls.nx" 32import "nx_tier.nx" 33 34// ===== Sealed enum: NxIntent ====================================== 35 36const NX_INTENT_DEFENSIVE: nx_int = 0 37const NX_INTENT_DIAGNOSTIC: nx_int = 1 38const NX_INTENT_EDUCATIONAL: nx_int = 2 39const NX_INTENT_CREATIVE: nx_int = 3 40const NX_INTENT_N_KINDS: nx_int = 4 41 42// ===== Sealed enum: NxIntentVerdict =============================== 43 44const NX_IN_OK: nx_int = 0 45const NX_IN_ERR_BAD_INTENT: nx_int = 1 46const NX_IN_REFUSED_INCONSISTENT: nx_int = 2 // caller / callee intents disagree 47const NX_IN_REFUSED_OFFENSIVE: nx_int = 3 // structural-refusal fire 48const NX_IN_REFUSED_UNDECLARED: nx_int = 4 // missing intent at boundary 49 50// ===== Validators ================================================ 51 52func nx_intent_is_valid(i: nx_int) -> nx_int { 53 if i < 0 { return 0 } 54 if i >= NX_INTENT_N_KINDS { return 0 } 55 return 1 56} 57 58// ===== nx_intent_compatible ======================================= 59// 60// Two intents are COMPATIBLE if a caller of `caller_intent` may 61// invoke a callee declared with `callee_intent`. Rules: 62// Defensive -> Defensive: OK 63// Defensive -> Diagnostic: OK (defense uses diagnostic) 64// Defensive -> any: OK (defense is the broadest authority) 65// Diagnostic -> Diagnostic: OK 66// Diagnostic -> Educational: OK 67// Diagnostic -> Creative: REFUSED (diagnostic can't compose into creative) 68// Diagnostic -> Defensive: OK 69// Educational -> Educational: OK 70// Educational -> anything else: REFUSED (edu is read-only) 71// Creative -> Creative: OK 72// Creative -> Educational: OK 73// Creative -> Defensive: REFUSED (creative can't drive defense) 74// Creative -> Diagnostic: OK (creative may diagnose its own state) 75 76func nx_intent_compatible(caller: nx_int, callee: nx_int) -> nx_int { 77 if nx_intent_is_valid(caller) == 0 { return 0 } 78 if nx_intent_is_valid(callee) == 0 { return 0 } 79 if caller == NX_INTENT_DEFENSIVE { return 1 } // defense is broadest 80 if caller == NX_INTENT_DIAGNOSTIC { 81 if callee == NX_INTENT_CREATIVE { return 0 } 82 return 1 83 } 84 if caller == NX_INTENT_EDUCATIONAL { 85 if callee == NX_INTENT_EDUCATIONAL { return 1 } 86 return 0 87 } 88 if caller == NX_INTENT_CREATIVE { 89 if callee == NX_INTENT_DEFENSIVE { return 0 } 90 return 1 91 } 92 return 0 93} 94 95// ===== nx_intent_check_invocation ================================= 96// 97// Boundary check: about to invoke callee under caller's intent. 98// Returns NX_IN_OK on compatible, NX_IN_REFUSED_INCONSISTENT on 99// incompatible. 100 101func nx_intent_check_invocation(caller: nx_int, callee: nx_int) -> nx_int { 102 if nx_intent_is_valid(caller) == 0 { return NX_IN_ERR_BAD_INTENT } 103 if nx_intent_is_valid(callee) == 0 { return NX_IN_ERR_BAD_INTENT } 104 if nx_intent_compatible(caller, callee) == 1 { return NX_IN_OK } 105 return NX_IN_REFUSED_INCONSISTENT 106} 107 108// ===== Sealed enum: NxOperationKind =============================== 109// 110// Operations that compose with intent for offensive-pattern detection. 111// Some operations are flagged "offensive-pattern" -- the substrate 112// refuses them unless intent is Defensive. 113 114const NX_OPK_READ_OWN_STATE: nx_int = 0 115const NX_OPK_WRITE_OWN_STATE: nx_int = 1 116const NX_OPK_NETWORK_RECV: nx_int = 2 117const NX_OPK_NETWORK_SEND: nx_int = 3 118const NX_OPK_ACTUATE_DRONE: nx_int = 4 // offensive-pattern unless Defensive 119const NX_OPK_COMMAND_BATTERY: nx_int = 5 // offensive-pattern unless Defensive 120const NX_OPK_ACTIVATE_TRANSPONDER: nx_int = 6 // offensive-pattern unless Defensive 121const NX_OPK_KERNEL_PRIVILEGED: nx_int = 7 // offensive-pattern unless Defensive 122const NX_OPK_PEER_BROADCAST: nx_int = 8 123const NX_OPK_N_KINDS: nx_int = 9 124 125func nx_opk_is_valid(o: nx_int) -> nx_int { 126 if o < 0 { return 0 } 127 if o >= NX_OPK_N_KINDS { return 0 } 128 return 1 129} 130 131// ===== nx_opk_is_offensive_pattern ================================ 132// 133// Returns 1 if this operation kind is a structural offensive-pattern 134// (can be used in attack) -- caller intent MUST be Defensive to 135// invoke it. Per Captain Moroni: refusal is structural, not policy. 136 137func nx_opk_is_offensive_pattern(o: nx_int) -> nx_int { 138 if o == NX_OPK_ACTUATE_DRONE { return 1 } 139 if o == NX_OPK_COMMAND_BATTERY { return 1 } 140 if o == NX_OPK_ACTIVATE_TRANSPONDER { return 1 } 141 if o == NX_OPK_KERNEL_PRIVILEGED { return 1 } 142 return 0 143} 144 145// ===== nx_intent_check_operation ================================== 146// 147// Operation-level check: about to invoke an op of given kind under 148// declared intent. Offensive-pattern ops require Defensive intent; 149// substrate refuses otherwise. 150 151func nx_intent_check_operation(intent: nx_int, op: nx_int) -> nx_int { 152 if nx_intent_is_valid(intent) == 0 { return NX_IN_ERR_BAD_INTENT } 153 if nx_opk_is_valid(op) == 0 { return NX_IN_ERR_BAD_INTENT } 154 if nx_opk_is_offensive_pattern(op) == 0 { return NX_IN_OK } 155 // Offensive-pattern op: must be Defensive intent 156 if intent == NX_INTENT_DEFENSIVE { return NX_IN_OK } 157 return NX_IN_REFUSED_OFFENSIVE 158} 159 160// ===== nx_intent_string_short ==================================== 161// 162// Returns a one-byte representation for compact logging. 163// 'D' Defensive / 'd' Diagnostic / 'E' Educational / 'C' Creative. 164 165func nx_intent_string_short(i: nx_int) -> nx_int { 166 if i == NX_INTENT_DEFENSIVE { return 68 } // 'D' 167 if i == NX_INTENT_DIAGNOSTIC { return 100 } // 'd' 168 if i == NX_INTENT_EDUCATIONAL { return 69 } // 'E' 169 if i == NX_INTENT_CREATIVE { return 67 } // 'C' 170 return 63 // '?' 171}