nx_pamp_meta.nx source

1// nx_pamp_meta.nx -- FALSE-pattern detection (deepest layer). 2// 3// Per [[feedback-unified-immune-architecture-three-tier]] item 2.3: 4// "DEEPEST LAYER recognizing FALSE patterns themselves; deception 5// requires maintenance + maintenance leaves traces; statistical- 6// ensemble across byte+structural+behavioral+temporal+side-channel; 7// disguise can hide in one channel not all." 8// 9// nx_pamp catches KNOWN attack patterns (NOP sled, homoglyph, etc). 10// nx_pamp_meta catches DECEPTION ITSELF -- the subtle inconsistencies 11// that arise when something is pretending to be what it's not. A 12// sophisticated mimic can fool one channel (byte pattern); few can 13// fool ALL channels (byte + timing + structure + entropy + relational). 14// 15// THE STRATEGIC INSIGHT (per user 2026-05-19 mimicry directive, 16// applied INVERSELY here): if WE can fool vendor scanners through 17// mimicry, then ANY adversary trying to fool US faces the same 18// problem -- their disguise has to be consistent across multiple 19// orthogonal channels, and maintenance of multi-channel consistency 20// is exponentially harder than single-channel. 21// 22// V1 channels measured: 23// 1. BYTE_DISTRIBUTION -- chi-squared deviation from expected 24// distribution for declared content type 25// 2. STRUCTURAL_SHAPE -- field count + nesting depth + size ratios 26// 3. TIMING_VARIANCE -- inter-arrival timing of bytes in stream 27// (real systems have hardware-jitter 28// signature; emulated ones don't) 29// 4. ENTROPY_PROFILE -- entropy at start vs middle vs end 30// (legitimate content has a profile; 31// packed/encrypted has different profile) 32// 33// Cross-channel consistency check: each channel returns a per-channel 34// "looks legit" Q10 confidence; the META verdict is HIGH-DECEPTION 35// when channels DISAGREE strongly (one says legit, another says fake) 36// even if each individual channel passes its own threshold. 37// 38// Composes: 39// nx_pamp -- shipped V1; meta layer LAYERS ATOP pamp 40// (pamp is single-channel; meta is multi-channel) 41// nx_crispr -- meta-detected deceptions still go into crispr 42// so adaptive memory accumulates them 43// nx_xenocell -- meta-flagged events are signed observations 44// with FALSE_PATTERN_DECEPTION enrichment 45// nx_restriction -- IO gate can refuse on meta verdict even when 46// single-channel pamp passes 47// 48// V1 ships: 49// - struct NxChannelReading bundling per-channel Q10 confidences 50// - cross-channel consistency check (variance across channels) 51// - meta verdict (HIGH_DECEPTION / SUSPICIOUS / CONSISTENT / UNKNOWN) 52// 53// Gap list (V1 honest perf verdict): 54// - 4 channels (V2 adds side-channel power-rail/EM/cache-timing) 55// - channels supplied by caller (V2 internalizes via probes) 56// - threshold tuning is illustrative; real corpus needed to calibrate 57// - no behavioral-pattern channel (requires temporal observation 58// window; queued) 59// - false-positive rate vs false-negative rate not measured 60// 61// genealogy_id: cardinal_2026-05-19_unified_immune_architecture_deepest + 62// statistical_ensemble + biology_PAMP_recognition_evolved 63// lineage_id: substrate_pamp_meta_v1 64// 65// nx_safety_envelope: 66// intended_use: "Cross-channel deception detection; meta- 67// layer over nx_pamp single-channel scanners" 68// sil_target: SIL2 69// evidence: [variance_across_channels_signal, 70// no_silent_pass_on_inconsistency] 71// verdict: NOT_YET_EVALUATED 72 73import "nx_syscalls.nx" 74import "nx_tier.nx" 75import "nx_pamp.nx" 76 77// ===== Sealed enum: NxChannel ===================================== 78 79const NX_PCM_BYTE_DISTRIBUTION: nx_int = 0 80const NX_PCM_STRUCTURAL_SHAPE: nx_int = 1 81const NX_PCM_TIMING_VARIANCE: nx_int = 2 82const NX_PCM_ENTROPY_PROFILE: nx_int = 3 83const NX_PCM_N_CHANNELS: nx_int = 4 84 85// ===== Sealed enum: NxPampMetaVerdict ============================= 86 87const NX_PCM_CONSISTENT: nx_int = 0 // all channels agree 88const NX_PCM_SUSPICIOUS: nx_int = 1 // mild disagreement 89const NX_PCM_HIGH_DECEPTION: nx_int = 2 // strong disagreement 90const NX_PCM_UNKNOWN: nx_int = 3 // insufficient data 91const NX_PCM_N_VERDICTS: nx_int = 4 92 93// ===== Struct: NxChannelReading =================================== 94// 95// Per-channel Q10 confidence values supplied by caller. 0 = "this 96// channel says definitely fake"; 1024 = "this channel says definitely 97// legit." A consistent legitimate sample has all four near 1024; a 98// consistent attack has all four near 0; a SOPHISTICATED MIMIC has 99// some near 1024 and others near 0 -- that's the deception signal. 100 101struct NxChannelReading { 102 byte_dist_q10: nx_int, 103 structural_q10: nx_int, 104 timing_q10: nx_int, 105 entropy_q10: nx_int, 106 n_channels_valid: nx_int, // how many of the 4 were measurable 107} 108 109// ===== Thresholds ================================================= 110// 111// Per Cardinal 11 (data-driven thresholds) these belong in config 112// long-term. V1 ships static values that real-corpus tuning will 113// adjust later. 114 115const NX_PCM_VARIANCE_THRESHOLD_LOW: nx_int = 200 // < 200 = CONSISTENT 116const NX_PCM_VARIANCE_THRESHOLD_HIGH: nx_int = 500 // > 500 = HIGH_DECEPTION 117 118// ===== Validators ================================================ 119 120func nx_pcm_channel_is_valid(c: nx_int) -> nx_int { 121 if c < 0 { return 0 } 122 if c >= NX_PCM_N_CHANNELS { return 0 } 123 return 1 124} 125 126func nx_pcm_verdict_is_valid(v: nx_int) -> nx_int { 127 if v < 0 { return 0 } 128 if v >= NX_PCM_N_VERDICTS { return 0 } 129 return 1 130} 131 132// ===== nx_pcm_reading_new ======================================== 133// 134// Caller has measured each channel and passes the Q10 values. 135// n_channels_valid is auto-counted from non-negative entries (a 136// caller passes -1 in fields it could not measure). 137 138func nx_pcm_reading_new(byte_dist_q10: nx_int, 139 structural_q10: nx_int, 140 timing_q10: nx_int, 141 entropy_q10: nx_int) -> *NxChannelReading { 142 let r: *NxChannelReading = (sys_mmap(40)) as *NxChannelReading 143 r.byte_dist_q10 = byte_dist_q10 144 r.structural_q10 = structural_q10 145 r.timing_q10 = timing_q10 146 r.entropy_q10 = entropy_q10 147 var n: nx_int = 0 148 if byte_dist_q10 >= 0 { n = n + 1 } 149 if structural_q10 >= 0 { n = n + 1 } 150 if timing_q10 >= 0 { n = n + 1 } 151 if entropy_q10 >= 0 { n = n + 1 } 152 r.n_channels_valid = n 153 return r 154} 155 156// ===== _pcm_mean_q10 ============================================== 157// 158// Mean of valid (non-negative) channel readings. Used for the 159// variance calculation. Returns -1 if no valid channels (caller 160// gets UNKNOWN verdict). 161 162func _pcm_mean_q10(r: *NxChannelReading) -> nx_int { 163 if r.n_channels_valid <= 0 { return -1 } 164 var sum: nx_int = 0 165 if r.byte_dist_q10 >= 0 { sum = sum + r.byte_dist_q10 } 166 if r.structural_q10 >= 0 { sum = sum + r.structural_q10 } 167 if r.timing_q10 >= 0 { sum = sum + r.timing_q10 } 168 if r.entropy_q10 >= 0 { sum = sum + r.entropy_q10 } 169 return sum / r.n_channels_valid 170} 171 172// ===== _pcm_abs_diff ============================================= 173 174func _pcm_abs_diff(a: nx_int, b: nx_int) -> nx_int { 175 if a > b { return a - b } 176 return b - a 177} 178 179// ===== nx_pcm_max_disagreement_q10 ================================ 180// 181// Largest single-channel deviation from the mean -- this is the 182// "deception signal." A sophisticated mimic that fools 3 channels 183// but leaks in the 4th will show high disagreement here, even 184// though the mean might still look benign. 185 186func nx_pcm_max_disagreement_q10(r: *NxChannelReading) -> nx_int { 187 let mean: nx_int = _pcm_mean_q10(r) 188 if mean < 0 { return -1 } 189 var max_dev: nx_int = 0 190 if r.byte_dist_q10 >= 0 { 191 let d: nx_int = _pcm_abs_diff(r.byte_dist_q10, mean) 192 if d > max_dev { max_dev = d } 193 } 194 if r.structural_q10 >= 0 { 195 let d: nx_int = _pcm_abs_diff(r.structural_q10, mean) 196 if d > max_dev { max_dev = d } 197 } 198 if r.timing_q10 >= 0 { 199 let d: nx_int = _pcm_abs_diff(r.timing_q10, mean) 200 if d > max_dev { max_dev = d } 201 } 202 if r.entropy_q10 >= 0 { 203 let d: nx_int = _pcm_abs_diff(r.entropy_q10, mean) 204 if d > max_dev { max_dev = d } 205 } 206 return max_dev 207} 208 209// ===== nx_pcm_verdict ============================================= 210// 211// Compose channel readings into a meta verdict. UNKNOWN if too few 212// channels valid (less than 2 -- can't disagree with one channel). 213// CONSISTENT if max disagreement is small. SUSPICIOUS if moderate. 214// HIGH_DECEPTION if large disagreement (one channel says legit, 215// another says fake -- classic mimic signature). 216 217func nx_pcm_verdict(r: *NxChannelReading) -> nx_int { 218 if r.n_channels_valid < 2 { return NX_PCM_UNKNOWN } 219 let max_dev: nx_int = nx_pcm_max_disagreement_q10(r) 220 if max_dev < 0 { return NX_PCM_UNKNOWN } 221 if max_dev < NX_PCM_VARIANCE_THRESHOLD_LOW { return NX_PCM_CONSISTENT } 222 if max_dev > NX_PCM_VARIANCE_THRESHOLD_HIGH { return NX_PCM_HIGH_DECEPTION } 223 return NX_PCM_SUSPICIOUS 224} 225 226// ===== nx_pcm_deception_q10 ======================================= 227// 228// Continuous Q10 deception score. 0 = fully consistent (no deception); 229// 1024 = maximum disagreement. Useful for nx_antibody to compute 230// "affinity maturation" gradient -- higher disagreement = stronger 231// signal for new antibody class. 232 233func nx_pcm_deception_q10(r: *NxChannelReading) -> nx_int { 234 if r.n_channels_valid < 2 { return 0 } 235 let max_dev: nx_int = nx_pcm_max_disagreement_q10(r) 236 if max_dev < 0 { return 0 } 237 // max_dev is in same Q10 scale as channels (0..1024 effective) 238 if max_dev > 1024 { return 1024 } 239 return max_dev 240}