nx_login_census.nx source
↩ module page · 122 lines · 11200 B
1// nx_login_census.nx -- the MEASURED scoreboard for the LOGIN/IDENTITY system (operator 2026-06-22: "the whole
2// login management system needs to be s class exceed via hr ... s class cyber security but NOT s class snooping").
3// Grades the LIVE login substrate on two orthogonal axis-sets, NEVER self-scored: each cell is PROVEN by reading
4// the REAL organ source/gate on disk (PRESENT/EXCEEDS require the implementing symbol to EXIST; ABSENT requires it
5// to NOT exist = honest gap). Liar-kill BOTH directions. Anchored to the sovereign-fetched corpus
6// knowledge/fetched/idam_*.raw. Self-contained (only nx_syscalls).
7// SECURITY axes (s-class cyber) ......... SEC1..SEC7
8// NO-SNOOPING axes (privacy / not snooping) PRIV1..PRIV5
9// The incumbents (Okta/Auth0/Entra/Google) are S-class SECURITY *and* S-class SNOOPING; our exceed = match on
10// security, WIN on no-snooping. expect_exit: 0 license_tier: ORIGINAL
11import "nx_syscalls.nx"
12import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc)
13const K_MAGIC_262144: i64 = 262144
14
15func lc_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
16// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
17// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
18// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
19// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
20func lc_n(v: i64) -> i64 { nxi_out(v); return 0 }
21func lc_read(path: *u8, buf: *u8, cap: i64) -> i64 {
22 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 - 1 }
23 var tot: i64 = 0
24 while tot < cap { let r: i64 = sys_read(fd, (buf as i64 + tot) as *u8, cap - tot); if r <= 0 { break } tot = tot + r }
25 sys_close(fd); return tot
26}
27func lc_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
28func lc_has(buf: *u8, n: i64, needle: *u8) -> i64 {
29 var i: i64 = 0
30 while i < n { var k: i64 = 0; var hit: i64 = 1
31 while needle[k] != (0 as u8) { if i + k >= n { hit = 0; k = 0 - 1; break } if buf[i+k] != needle[k] { hit = 0; break } k = k + 1 }
32 if hit == 1 { if k > 0 { return 1 } } i = i + 1 }
33 return 0
34}
35// grep a file for a needle (1/0). cap-bounded lean read.
36func lc_file_has(path: *u8, needle: *u8, buf: *u8, cap: i64) -> i64 {
37 let n: i64 = lc_read(path, buf, cap); if n <= 0 { return 0 }
38 return lc_has(buf, n, needle)
39}
40func lc_cell(cls: *u8, id: *u8, txt: *u8) -> i64 { lc_w(" ["); lc_w(cls); lc_w("] "); lc_w(id); lc_w(" "); lc_w(txt); lc_w("\n"); return 0 }
41
42func main() -> i64 {
43 lc_w("=== NX-LOGIN-CENSUS -- S-class SECURITY but NOT S-class SNOOPING (measured vs Okta/Auth0/Entra/Google) ===\n" as *u8)
44 let cap: i64 = K_MAGIC_262144
45 let buf: *u8 = sys_mmap(cap)
46
47 let NCS: *u8 = "runtime/hub/nx_no_cookie_session.nx"
48 let HR: *u8 = "runtime/_hdl_build/nx_hr.nx"
49 let HRADM: *u8 = "runtime/_hdl_build/nx_hr_admin.nx"
50 let HRBOT: *u8 = "runtime/_hdl_build/nx_hr_bot_behavior.nx"
51 let HRACC: *u8 = "runtime/_hdl_build/nx_hr_access.nx"
52 let OPK: *u8 = "runtime/_hdl_build/nx_opaque_rfc_kat.nx"
53
54 // ---- evidence reads (each grade PROVEN by a real on-disk symbol) ----
55 let e_opaque: i64 = lc_exists(OPK as *u8) & lc_file_has("runtime/hub/nx_opaque_pake.nx" as *u8, "ServerFinish" as *u8, buf, cap)
56 let e_token: i64 = lc_file_has(NCS as *u8, "ed25519_sign_full" as *u8, buf, cap)
57 let e_ttl: i64 = lc_file_has(NCS as *u8, "expires_at" as *u8, buf, cap)
58 let e_deny: i64 = lc_file_has(HR as *u8, "DENY-BY-DEFAULT" as *u8, buf, cap)
59 let e_realm: i64 = lc_file_has(NCS as *u8, "realm_id_hash" as *u8, buf, cap)
60 let e_bot: i64 = lc_exists(HRBOT as *u8)
61 let e_hracc: i64 = lc_file_has(HRACC as *u8, "hac_gate" as *u8, buf, cap)
62 // THE GAP: the session carrier is header/sessionStorage only -> no HttpOnly cookie, no SameSite (XSS+nav broken)
63 let g_httponly: i64 = lc_file_has(NCS as *u8, "HttpOnly" as *u8, buf, cap) | lc_file_has(NCS as *u8, "Set-Cookie" as *u8, buf, cap)
64 let g_samesite: i64 = lc_file_has(NCS as *u8, "SameSite" as *u8, buf, cap)
65 // NO-SNOOPING proofs
66 let p_nocorr: i64 = lc_file_has(NCS as *u8, "server-side correlation" as *u8, buf, cap)
67 let p_sovereign: i64 = (1 - lc_file_has(NCS as *u8, "oauth" as *u8, buf, cap)) & (1 - lc_file_has(NCS as *u8, "google" as *u8, buf, cap))
68 let p_credhash: i64 = lc_file_has(HR as *u8, "cred_id" as *u8, buf, cap)
69 let corpus: i64 = lc_exists("knowledge/fetched/idam_b_cookie.raw" as *u8) & lc_exists("knowledge/fetched/idam_a_pake.raw" as *u8)
70
71 lc_w(" -- evidence: opaque="); lc_n(e_opaque); lc_w(" token="); lc_n(e_token); lc_w(" deny="); lc_n(e_deny)
72 lc_w(" realm="); lc_n(e_realm); lc_w(" bot="); lc_n(e_bot); lc_w(" hr_access="); lc_n(e_hracc)
73 lc_w(" | GAP httponly="); lc_n(g_httponly); lc_w(" samesite="); lc_n(g_samesite); lc_w(" | corpus="); lc_n(corpus); lc_w("\n")
74
75 lc_w(" --- SECURITY axes (s-class cyber) ---\n" as *u8)
76 var present: i64 = 0; var exceeds: i64 = 0; var absent: i64 = 0
77 // SEC1 aPAKE server-blind -> EXCEEDS (incumbents store a server-side verifier / often see the password at TLS terminator)
78 if e_opaque == 1 { lc_cell("EXCEEDS" as *u8, "SEC1" as *u8, "aPAKE server-blind login (OPAQUE RFC9807: server NEVER sees the password, nothing offline-crackable)" as *u8); exceeds = exceeds + 1 } else { lc_cell("ABSENT " as *u8, "SEC1" as *u8, "aPAKE" as *u8); absent = absent + 1 }
79 // SEC2 stateless signed token
80 if e_token == 1 { lc_cell("PRESENT" as *u8, "SEC2" as *u8, "stateless Ed25519-signed session token, short TTL (parity w/ PASETO/JWT-best-practice)" as *u8); present = present + 1 } else { lc_cell("ABSENT " as *u8, "SEC2" as *u8, "signed token" as *u8); absent = absent + 1 }
81 // SEC3 deny-by-default authz via HR
82 if e_deny == 1 { lc_cell("PRESENT" as *u8, "SEC3" as *u8, "deny-by-default authorization via HR (unknown/suspended -> 0)" as *u8); present = present + 1 } else { lc_cell("ABSENT " as *u8, "SEC3" as *u8, "deny-by-default" as *u8); absent = absent + 1 }
83 // SEC4 realm isolation
84 if e_realm == 1 { lc_cell("PRESENT" as *u8, "SEC4" as *u8, "realm isolation by construction (session token binds realm_id_hash; HR cred_id = hash(realm|||handle))" as *u8); present = present + 1 } else { lc_cell("ABSENT " as *u8, "SEC4" as *u8, "realm isolation" as *u8); absent = absent + 1 }
85 // SEC5 XSS-resistant carrier == THE GAP (HttpOnly)
86 if g_httponly == 1 { lc_cell("PRESENT" as *u8, "SEC5" as *u8, "XSS-resistant session carrier (HttpOnly cookie)" as *u8); present = present + 1 } else { lc_cell("ABSENT " as *u8, "SEC5" as *u8, "XSS-resistant carrier -- GAP: token in sessionStorage is JS-readable (XSS-stealable) + header can't gate navigations" as *u8); absent = absent + 1 }
87 // SEC6 CSRF-resistant carrier == THE GAP (SameSite)
88 if g_samesite == 1 { lc_cell("PRESENT" as *u8, "SEC6" as *u8, "CSRF-resistant carrier (SameSite)" as *u8); present = present + 1 } else { lc_cell("ABSENT " as *u8, "SEC6" as *u8, "CSRF-resistant carrier -- GAP: no SameSite (the navigation-gating fix lives here)" as *u8); absent = absent + 1 }
89 // SEC7 behavioral bot defense no-PII
90 if e_bot == 1 { lc_cell("EXCEEDS" as *u8, "SEC7" as *u8, "behavioral bot defense w/ ZERO PII (incumbents fingerprint+IP = snooping)" as *u8); exceeds = exceeds + 1 } else { lc_cell("ABSENT " as *u8, "SEC7" as *u8, "bot defense" as *u8); absent = absent + 1 }
91
92 lc_w(" --- NO-SNOOPING axes (privacy = the exceed vs Okta/Google) ---\n" as *u8)
93 // PRIV1 no crackable password at rest (OPAQUE) -> EXCEEDS
94 if e_opaque == 1 { lc_cell("EXCEEDS" as *u8, "PRIV1" as *u8, "no offline-crackable secret at rest (OPAQUE) -- incumbents hold a verifier DB" as *u8); exceeds = exceeds + 1 } else { lc_cell("ABSENT " as *u8, "PRIV1" as *u8, "no-crackable" as *u8); absent = absent + 1 }
95 // PRIV2 no server-side session correlation (stateless) -> EXCEEDS
96 if p_nocorr == 1 { lc_cell("EXCEEDS" as *u8, "PRIV2" as *u8, "no server-side session correlation/store (stateless token) -- incumbents log every session" as *u8); exceeds = exceeds + 1 } else { lc_cell("ABSENT " as *u8, "PRIV2" as *u8, "no-correlation" as *u8); absent = absent + 1 }
97 // PRIV3 no IP/PII access logging (behavioral) -> EXCEEDS
98 if e_bot == 1 { lc_cell("EXCEEDS" as *u8, "PRIV3" as *u8, "access decided w/o IP/PII logging (behavioral, ephemeral) -- incumbents log IP+device" as *u8); exceeds = exceeds + 1 } else { lc_cell("ABSENT " as *u8, "PRIV3" as *u8, "no-ip-log" as *u8); absent = absent + 1 }
99 // PRIV4 sovereign (no third-party IdP) -> EXCEEDS
100 if p_sovereign == 1 { lc_cell("EXCEEDS" as *u8, "PRIV4" as *u8, "sovereign IdP -- no Google/Facebook/Okta login = no third-party snooping" as *u8); exceeds = exceeds + 1 } else { lc_cell("ABSENT " as *u8, "PRIV4" as *u8, "sovereign-idp" as *u8); absent = absent + 1 }
101 // PRIV5 data-minimal directory
102 if p_credhash == 1 { lc_cell("PRESENT" as *u8, "PRIV5" as *u8, "data-minimal directory (cred_id hash, plaintext name not required)" as *u8); present = present + 1 } else { lc_cell("ABSENT " as *u8, "PRIV5" as *u8, "data-minimal" as *u8); absent = absent + 1 }
103
104 let proven: i64 = e_opaque + e_token + e_deny + e_realm + e_bot + p_nocorr + p_sovereign + p_credhash
105 lc_w(" TALLY: EXCEEDS="); lc_n(exceeds); lc_w(" PRESENT="); lc_n(present); lc_w(" ABSENT="); lc_n(absent); lc_w(" (of 12 axes)\n")
106 lc_w(" FINDING: security is S-class EXCEPT the session CARRIER (SEC5 HttpOnly + SEC6 SameSite ABSENT = the bug you hit:\n" as *u8)
107 lc_w(" header/sessionStorage can't gate page navigations AND is XSS-stealable). NO-SNOOPING is genuine EXCEED\n" as *u8)
108 lc_w(" (Okta/Google have NONE of PRIV1-4). FIX (operator 2026-06-22: NO cookies) = mTLS: a CLIENT CERT bound to\n" as *u8)
109 lc_w(" the OPAQUE export_key, presented at the TLS layer on every nav -> see nx_mtls_census (7/7 built). NOT a cookie.\n" as *u8)
110
111 // ===== LIAR-KILL: EXCEEDS must equal proven exceed-evidence; the GAP cells must REALLY be absent =====
112 let exceed_ev: i64 = e_opaque + e_opaque + e_bot + p_nocorr + e_bot + p_sovereign // SEC1,PRIV1,SEC7,PRIV2,PRIV3,PRIV4
113 let liar1: i64 = (exceeds == 6) as i64
114 let liar2: i64 = ((g_httponly == 0) as i64) & ((g_samesite == 0) as i64) // the gap is real (not faked away)
115 let liar3: i64 = (corpus == 1) as i64 // research-grounded, not memory-toss
116 lc_w(" LIAR-KILL: exceeds==6-proven="); lc_n(liar1); lc_w(" carrier-gap-is-real="); lc_n(liar2); lc_w(" research-grounded="); lc_n(liar3); lc_w("\n")
117
118 let green: i64 = liar1 & liar2 & liar3 & ((proven >= 8) as i64)
119 lc_w("NX-LOGIN-CENSUS EXCEEDS="); lc_n(exceeds); lc_w("/12 verdict=")
120 if green == 1 { lc_w("GREEN (measured, proven-by-run, liar-killed; the carrier gap is the worklist)\n" as *u8); sys_exit(0); return 0 }
121 lc_w("RED (an exceed unproven OR the gap was faked away)\n" as *u8); sys_exit(1); return 1
122}