nx_methyl.nx source

1// nx_methyl.nx -- cryptographic self-marking (Tier-1 immune). 2// 3// Biology: DNA methylation marks host DNA so restriction enzymes 4// know NOT to cut self. Foreign viral DNA arrives unmethylated; 5// restriction enzymes cleave it. Same principle, software substrate: 6// every Nishi-emitted artifact carries a methyl-mark (originator id 7// + chromatin hash + emission timestamp). Foreign bits lack the mark 8// or carry stale/invalid marks; nx_restriction (queued) refuses them 9// at the IO boundary. 10// 11// THIS IS ALSO THE FOUNDATION FOR MIMICRY DEFENSE. nx_decoy plants 12// fake artifacts that LOOK like Nishi cells but carry NO methyl mark 13// (or a deliberately-invalid one). A scraper reading them gets data 14// that pattern-matches "Nishi cell" but the auth chain doesn't 15// validate against any real chromatin -- so the scrape is detectable 16// AS forgery if it ever shows up downstream. 17// 18// Composes: 19// nx_chromatin -- the canonical originator-chain primitive 20// that methyl marks reference 21// nx_xenocell -- foreign artifacts found in the substrate 22// that lack valid methyl become evidence 23// nx_decoy -- decoy artifacts carry invalid methyl by 24// design so leaked decoys are detectable 25// nx_pamp + nx_crispr -- detection-and-memory primitives 26// nx_restriction (queued) -- IO-boundary check that consumes methyl 27// 28// V1 ships: 29// - struct NxMethylMark with originator/chromatin_hash/ts 30// - mark/verify functions 31// - is_self predicate (returns 1 if mark validates) 32// - "deliberate-invalid" variant for decoy use 33// 34// Gap list (V1 honest perf verdict): 35// - signature is externally supplied (V2 inlines nx_ml_dsa_65) 36// - no canonical bytes-to-mark function; caller supplies hash 37// - no propagation through nx_brane capability tokens (queued) 38// - no peer-mesh sharing of revoked originators (queued) 39// 40// genealogy_id: cardinal_2026-05-19_tier_1_innate_immune_microbial + 41// biology_DNA_methylation 42// lineage_id: substrate_methyl_v1 43// 44// nx_safety_envelope: 45// intended_use: "Cryptographic self-marking for substrate- 46// emitted artifacts; foreign artifacts lack 47// the mark and are refused by IO boundary" 48// sil_target: SIL2 49// evidence: [originator_chain_verified, no_silent_pass] 50// verdict: NOT_YET_EVALUATED 51 52import "nx_syscalls.nx" 53import "nx_tier.nx" 54 55// ===== Sealed enum: NxMethylVerdict =============================== 56 57const NX_METHYL_OK: nx_int = 0 58const NX_METHYL_ERR_NO_MARK: nx_int = 1 59const NX_METHYL_ERR_BAD_ORIG: nx_int = 2 60const NX_METHYL_ERR_BAD_CHAIN: nx_int = 3 61const NX_METHYL_ERR_STALE: nx_int = 4 62const NX_METHYL_ERR_DECOY: nx_int = 5 // deliberately-invalid 63 64// ===== Struct: NxMethylMark ====================================== 65// 66// originator_id is a stable identifier of the cell/peer that emitted 67// the artifact. chromatin_hash is BLAKE3 (or equivalent) of the 68// originator's chromatin manifest at emission time. ts_us is the 69// monotonic emission timestamp. sig_ptr + sig_len are an externally- 70// supplied ML-DSA-65 signature; V1 doesn't validate the signature 71// shape -- the IS_SELF predicate uses caller-supplied verification. 72// is_decoy_invalid is set to 1 by nx_decoy when planting fake marks. 73 74struct NxMethylMark { 75 originator_id: nx_int, 76 chromatin_hash: nx_size, 77 ts_us: nx_size, 78 sig_ptr: *u8, 79 sig_len: nx_size, 80 is_decoy_invalid: nx_int, 81} 82 83// ===== nx_methyl_new ============================================= 84 85func nx_methyl_new(originator_id: nx_int, 86 chromatin_hash: nx_size, 87 ts_us: nx_size, 88 sig_ptr: *u8, 89 sig_len: nx_size) -> *NxMethylMark { 90 let m: *NxMethylMark = (sys_mmap(48)) as *NxMethylMark 91 m.originator_id = originator_id 92 m.chromatin_hash = chromatin_hash 93 m.ts_us = ts_us 94 m.sig_ptr = sig_ptr 95 m.sig_len = sig_len 96 m.is_decoy_invalid = 0 97 return m 98} 99 100// ===== nx_methyl_new_decoy ======================================= 101// 102// Plant a deliberately-invalid mark for nx_decoy use. The artifact 103// LOOKS like it has a methyl mark (pattern match against vendor 104// scanner heuristics) but fails verification by design. If a leaked 105// decoy ever shows up at a Nishi node downstream, this flag plus 106// signature-fails marks it as confirmed forgery. 107 108func nx_methyl_new_decoy(fake_originator_id: nx_int, 109 fake_chromatin_hash: nx_size, 110 ts_us: nx_size) -> *NxMethylMark { 111 let m: *NxMethylMark = (sys_mmap(48)) as *NxMethylMark 112 m.originator_id = fake_originator_id 113 m.chromatin_hash = fake_chromatin_hash 114 m.ts_us = ts_us 115 m.sig_ptr = (0 as i64) as *u8 116 m.sig_len = 0 117 m.is_decoy_invalid = 1 118 return m 119} 120 121// ===== nx_methyl_is_self ========================================= 122// 123// Returns 1 if the mark validates as substrate-self. V1 validation: 124// - is_decoy_invalid must be 0 125// - sig_ptr must be non-NULL 126// - sig_len must be > 0 127// - ts_us must be <= now_us (no future-dated marks) 128// - ts_us must be >= now_us - max_age_us (mark is fresh) 129// - originator_id must be in valid_originators bitmap (caller's 130// accepted-originator allowlist; V2 uses peer-mesh chromatin chain) 131// 132// The actual signature verification is caller-supplied (caller has 133// the verification key); V1 trusts non-null+non-zero as a sig 134// SHAPE check, not a crypto check. 135 136func nx_methyl_is_self(m: *NxMethylMark, 137 now_us: nx_size, 138 max_age_us: nx_size, 139 allowed_originator: nx_int) -> nx_int { 140 if (m as i64) == 0 { return 0 } 141 if m.is_decoy_invalid != 0 { return 0 } 142 if (m.sig_ptr as i64) == 0 { return 0 } 143 if m.sig_len <= 0 { return 0 } 144 if m.ts_us > now_us { return 0 } 145 if (now_us - m.ts_us) > max_age_us { return 0 } 146 if m.originator_id != allowed_originator { return 0 } 147 return 1 148} 149 150// ===== nx_methyl_verdict ========================================= 151// 152// Returns the verdict enum for diagnostic / forensic logging when 153// is_self returns 0. Useful for nx_restriction to report WHY a 154// foreign artifact was refused. 155 156func nx_methyl_verdict(m: *NxMethylMark, 157 now_us: nx_size, 158 max_age_us: nx_size, 159 allowed_originator: nx_int) -> nx_int { 160 if (m as i64) == 0 { return NX_METHYL_ERR_NO_MARK } 161 if m.is_decoy_invalid != 0 { return NX_METHYL_ERR_DECOY } 162 if (m.sig_ptr as i64) == 0 { return NX_METHYL_ERR_NO_MARK } 163 if m.sig_len <= 0 { return NX_METHYL_ERR_NO_MARK } 164 if m.ts_us > now_us { return NX_METHYL_ERR_STALE } 165 if (now_us - m.ts_us) > max_age_us { return NX_METHYL_ERR_STALE } 166 if m.originator_id != allowed_originator { return NX_METHYL_ERR_BAD_ORIG } 167 return NX_METHYL_OK 168} 169 170// ===== nx_methyl_is_decoy ======================================== 171 172func nx_methyl_is_decoy(m: *NxMethylMark) -> nx_int { 173 if (m as i64) == 0 { return 0 } 174 return m.is_decoy_invalid 175}