nx_nxe.nx source

1// nx_nxe.nx -- the SOVEREIGN NISHI EXECUTABLE FORMAT (NXE) demonstrator + conformance suite. Our OWN 2// file -- NOT an ELF knockoff. A UNIQUE exceed: it bakes in what ELF/Mach-O/PE LACK by default -- 3// (1) INTEGRITY by construction: a content hash of the code section in the header; the loader VERIFIES it and 4// REFUSES tampered binaries (ELF/Mach-O/PE have no built-in integrity -- they rely on external signing). 5// (2) CAPABILITY MANIFEST (capability-based security, ef_capsec.raw): the binary DECLARES its caps (file/net/exec/ 6// raw-hw); the loader enforces least-privilege -- an undeclared cap is denied. (ELF declares nothing.) 7// (3) NEVER-BRICK tag (cardinal 26 IN THE FORMAT): a binary flagged HW_WRITE is REFUSED unless it carries a 8// never-brick guarantee. The brand-critical law enforced at load, by construction. 9// 10// CONVERGED 2026-08-15 -- THIS FILE NO LONGER CARRIES ITS OWN COPY OF THE FORMAT. 11// It used to define its own nxe_write/nxe_magic_ok/nxe_integrity_ok/nxe_may/p64/r64 with `HOFF = 80` and 12// a DJB2 code hash, sitting beside nx_nxe_lib.nx -- whose own header promises it was extracted "(rule-15 13// DRY) so both compose ONE copy". The extraction never reached this file, so the estate shipped TWO 14// incompatible NXE1 layouts (code@80 djb2 here, code@96 SHA-256 there) and the on-disk artifacts proved 15// it: knowledge/nxe_hello.nxe was 98 bytes while knowledge/organ_fx.nxe was 107. 16// * A DRY EXTRACTION THAT LEAVES THE ORIGINAL IN TREE HAS NOT DEDUPLICATED THE RULER, IT HAS FORKED IT 17// -- AND A FORKED FORMAT OUTLIVES THE CODE, BECAUSE THE ARTIFACTS PERSIST. 18// Now it imports nx_nxe_lib and tests THE SHIPPING FORMAT: code@96, FIPS-180-4 SHA-256, one writer. 19// Measured by buildroot/runtime/nx_nxeconform_gate.nx, which retires the duplicate LAYOUT row. 20// 21// Layout (8-byte fields): [0]magic'NXE1' [8]version [16]arch [24]flags [32]caps [40]entry [48]code_off=96 22// [56]code_len [64..96]code_hash(32B SHA-256) ; code@96. 23// T1 write/validate roundtrip. T2 integrity (verify ok; tampered code -> rejected). T3 capability 24// (declared allowed, undeclared denied). T4 never-brick (HW_WRITE without a guarantee -> REFUSED). 25// expect_exit: 0 Sovereign: nx_nxe_lib (+nx_syscalls, nx_sha256) and the shared itoa emitter. 26import "nx_nxe_lib.nx" 27import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 28const K_MAGIC_4096: i64 = 4096 29 30func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 31// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 32// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 33// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 34// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 35func g_pn(v: i64) -> i64 { nxi_out(v); return 0 } 36func ck(name: *u8, c: i64) -> i64 { if c==1 { g_puts(" PASS " as *u8) } else { g_puts(" FAIL " as *u8) } g_puts(name); g_puts("\n" as *u8); return c } 37func have(path: *u8) -> i64 { let fd: i64=sys_openat_rd(path); if fd<0 { return 0 } sys_close(fd); return 1 } 38 39// NON-EXECUTING validator. Deliberately NOT nxe_load_exec: this suite validates a container without 40// mapping it RWX and calling it, and T1's payload declares no EXEC cap (which load_exec refuses, -4). 41// Every predicate is the LIB's -- magic, integrity and never-brick are composed, never re-implemented. 42// return: 0 ok, -1 bad magic, -2 integrity fail, -3 never-brick violation. 43func nxe_validate(m: *u8) -> i64 { 44 if nxe_magic_ok(m)==0 { return 0-1 } 45 if nxe_integrity_ok(m)==0 { return 0-2 } 46 if nxe_neverbrick_ok(m)==0 { return 0-3 } 47 return 0 48} 49 50func main() -> i64 { 51 g_puts("nx_nxe (SOVEREIGN Nishi Executable format: our own file, integrity+capability+never-brick baked in -- not ELF)\n" as *u8) 52 var pass: i64=0; var total: i64=0 53 let m: *u8 = sys_mmap(K_MAGIC_4096) 54 55 // T1: write (arch=1, flags=0, caps=FILE_READ|NET=5, entry 0) + validate roundtrip 56 nxe_write(m, 1, 0, 5, 0, "rv64-payload-bytes" as *u8, 18) 57 let ld: i64=nxe_validate(m) 58 var t1: i64=0; if nxe_magic_ok(m)==1 { if nxe_r64(m,8)==1 { if nxe_r64(m,16)==1 { if nxe_r64(m,32)==5 { if ld==0 { t1=1 } } } } } 59 g_puts(" T1 wrote NXE (magic NXE1, ver "); g_pn(nxe_r64(m,8)); g_puts(", arch "); g_pn(nxe_r64(m,16)); g_puts(", caps "); g_pn(nxe_r64(m,32)); g_puts(", code_off "); g_pn(nxe_r64(m,48)); g_puts("); validate="); g_pn(ld); g_puts("\n" as *u8) 60 pass=pass+ck("T1: write/validate roundtrip -- own magic 'NXE1', self-describing header, ONE writer (nx_nxe_lib)" as *u8, t1); total=total+1 61 // write to disk (a real .nxe file) -- the SIZE comes from the lib, never a local constant 62 let fd: i64=sys_openat_wr("knowledge/nxe_hello.nxe" as *u8, 0x1ed); if fd>=0 { sys_write(fd,m,nxe_size(m)); sys_close(fd) } 63 64 // T2 INTEGRITY: ok now; tamper a code byte -> integrity fails -> validate rejects 65 let ok_before: i64=nxe_integrity_ok(m) 66 m[NXE_HOFF+3] = (m[NXE_HOFF+3] ^ (0xFF as u8)) // tamper the code 67 let ok_after: i64=nxe_integrity_ok(m); let ld_t: i64=nxe_validate(m) 68 m[NXE_HOFF+3] = (m[NXE_HOFF+3] ^ (0xFF as u8)) // restore -- the restore is part of the experiment 69 var t2: i64=0; if ok_before==1 { if ok_after==0 { if ld_t==(0-2) { t2=1 } } } 70 g_puts(" T2 integrity: verify-before="); g_pn(ok_before); g_puts(" verify-after-tamper="); g_pn(ok_after); g_puts(" validate-tampered="); g_pn(ld_t); g_puts(" (-2=integrity reject)\n" as *u8) 71 pass=pass+ck("T2: INTEGRITY by construction -- SHA-256 code hash verified; a tampered binary is REJECTED (ELF cannot do this)" as *u8, t2); total=total+1 72 73 // T3 CAPABILITY: declared caps=FILE_READ|NET (bits 0,2). FILE_READ allowed, FILE_WRITE(bit1) denied. 74 var t3: i64=0; if nxe_may(m,0)==1 { if nxe_may(m,2)==1 { if nxe_may(m,1)==0 { if nxe_may(m,4)==0 { t3=1 } } } } 75 g_puts(" T3 capability manifest: FILE_READ="); g_pn(nxe_may(m,0)); g_puts(" NET="); g_pn(nxe_may(m,2)); g_puts(" FILE_WRITE(undeclared)="); g_pn(nxe_may(m,1)); g_puts(" RAW_HW(undeclared)="); g_pn(nxe_may(m,4)); g_puts("\n" as *u8) 76 pass=pass+ck("T3: CAPABILITY manifest -- declared caps allowed, undeclared DENIED (least-privilege by construction)" as *u8, t3); total=total+1 77 78 // T4 NEVER-BRICK: a HW_WRITE binary WITHOUT a never-brick guarantee is REFUSED; WITH it, validates. 79 let mb: *u8=sys_mmap(K_MAGIC_4096); nxe_write(mb, 1, 1, 16, 0, "hw-writer" as *u8, 9) // flags=HW_WRITE(1), caps=RAW_HW 80 let ld_hw: i64=nxe_validate(mb) 81 let mg: *u8=sys_mmap(K_MAGIC_4096); nxe_write(mg, 1, 3, 16, 0, "hw-writer" as *u8, 9) // flags=HW_WRITE|NEVER_BRICK_PROVEN(3) 82 let ld_hwok: i64=nxe_validate(mg) 83 var t4: i64=0; if ld_hw==(0-3) { if ld_hwok==0 { t4=1 } } 84 g_puts(" T4 never-brick: HW_WRITE w/o guarantee validate="); g_pn(ld_hw); g_puts(" (-3=refused); HW_WRITE+never-brick-proven validate="); g_pn(ld_hwok); g_puts("\n" as *u8) 85 pass=pass+ck("T4: NEVER-BRICK tag (cardinal 26 IN THE FORMAT) -- a hw-write binary lacking a never-brick guarantee is REFUSED (nxe_neverbrick_ok, ONE predicate)" as *u8, t4); total=total+1 86 87 g_puts(" -- NXE vs ELF/Mach-O/PE (grounded ef_*.raw) --\n" as *u8) 88 g_puts(" [EXCEED] INTEGRITY-by-construction (ELF/Mach-O/PE: none built-in) ; CAPABILITY-MANIFEST (capability-based security) ; NEVER-BRICK tag\n" as *u8) 89 g_puts(" [EXCEED] SOVEREIGN + minimal + deterministic 96-byte header (own magic, no legacy cruft)\n" as *u8) 90 g_puts(" [PARITY] a loadable executable container (header + code + entry)\n" as *u8) 91 g_puts(" [BEHIND] no dynamic linking / debug info / relocations / OS-loader support outside Nishi yet\n" as *u8) 92 g_puts(" [BEHIND] no typed published interface layer -- the WASM Component Model / WASI 0.3 bar (ratified 2026)\n" as *u8) 93 g_puts(" *** ASTERISK: ELF/Mach-O/PE are universal + tooled (decades); NXE wins on integrity/capability/never-brick/sovereignty -- the secure-sovereign niche, not ubiquity. ***\n" as *u8) 94 95 var okall: i64=0; if pass==total { okall=1 } 96 g_puts("---- nx_nxe: passed "); g_pn(pass); g_puts(" / "); g_pn(total); g_puts(" ----\n" as *u8) 97 if okall==1 { 98 let logf: i64=sys_openat_append("knowledge/status/nxe.log" as *u8, 420) 99 if logf>=0 { let z: i64=sys_write(logf,"NXE GREEN: sovereign Nishi executable format -- integrity-verified + capability-manifest + never-brick-tag (NOT an ELF clone)\n" as *u8,121); sys_close(logf) } 100 g_puts("verdict=GREEN (the sovereign Nishi Executable format: our OWN file with integrity+capability+never-brick baked in -- a UNIQUE exceed, not an ELF knockoff)\n" as *u8); sys_exit(0); return 0 101 } 102 g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 103}