nx_reclaim.nx source
↩ module page · 316 lines · 12878 B
1// nx_reclaim.nx -- composed reclamation operation.
2//
3// Per [[feedback-reclamation-doctrine-captain-moroni]]: the operation
4// that turns commodity hardware (Intel ME / AMD PSP / baseband /
5// vendor BMC) into substrate that's safe for chosen niches while
6// hostile components remain visible+contained.
7//
8// THIS IS THE BRIDGE PRIMITIVE between the optimization-layer work
9// (nx_organism / nx_symbiote / nx_treaty / nx_budget / nx_homeostasis)
10// and the sovereignty-doctrine work (nx_attest_silicon / nx_xenocell /
11// the 8 reclamation mitigations / the immune tier-1 primitives queued).
12// nx_reclaim COMPOSES THEM. Given a hardware target, it:
13//
14// 1. Calls nx_attest_silicon to learn the chip's threat surface
15// and applied mitigations -> computes effective trust ceiling
16// 2. Instantiates an nx_xenocell for each known hostile component
17// 3. Registers the xenocell with the caller-supplied organism so
18// its observed consumption gets counted into host pressure
19// 4. Computes a safety envelope: what's safe-for-this-chip
20// (gameplay/content/dev) vs unsafe (secrets/identity/PII)
21// 5. Returns the envelope so the caller can decide what cells to
22// run on this host AND what cells to refuse
23//
24// Per the Captain Moroni discipline: we don't ABANDON commodity
25// hardware (that would cede ground to vendors who profit from
26// helplessness). We RECLAIM it for chosen niches by applying every
27// available mitigation + making every adversarial action visible.
28//
29// Composes:
30// nx_attest_silicon -- chip threat surface lookup
31// nx_xenocell -- hostile component wrapping
32// nx_organism -- ecosystem registration
33// nx_budget -- per-niche budget caps from trust ceiling
34// nx_evict_journal -- reclamation events logged
35//
36// V1 ships the synchronous composition. V2 will add ongoing-
37// monitoring loops that re-evaluate the envelope when mitigations
38// change (e.g., user disables an egress filter -> trust ceiling
39// drops -> sovereignty-critical cells refused mid-session).
40//
41// Gap list (V1 honest perf verdict):
42// - synchronous; no continuous monitoring
43// - chip family supplied by caller (auto-detect queued)
44// - safety envelope is a static struct (V2 makes it queryable
45// for per-niche decisions at runtime)
46// - does not actually APPLY mitigations (those are operator
47// actions outside substrate; nx_reclaim only TRACKS them)
48//
49// genealogy_id: cardinal_2026-05-19_reclamation_doctrine_composed_op
50// lineage_id: substrate_reclaim_v1
51//
52// nx_safety_envelope:
53// intended_use: "Composed reclamation operation: turn
54// commodity hardware into chosen-niche-safe
55// substrate while making hostile components
56// visible and contained"
57// sil_target: SIL3
58// evidence: [defensive_only, no_offensive_path,
59// captain_moroni_aligned, reclamation_not_abandon]
60// verdict: NOT_YET_EVALUATED
61
62import "nx_syscalls.nx"
63import "nx_tier.nx"
64import "nx_budget.nx"
65import "nx_attention_class.nx"
66import "nx_evict_journal.nx"
67import "nx_attest_silicon.nx"
68import "nx_xenocell.nx"
69import "nx_organism.nx"
70
71// ===== Sealed enum: NxReclaimVerdict ==============================
72
73const NX_RC_OK: nx_int = 0
74const NX_RC_ERR_BAD_CHIP: nx_int = 1
75const NX_RC_ERR_ORGANISM_FULL: nx_int = 2
76const NX_RC_ERR_UNSAFE_FOR_NICHE: nx_int = 3
77
78// ===== Sealed enum: NxNiche =======================================
79//
80// What the operator wants to do on this hardware. The safety envelope
81// reports per-niche verdicts.
82
83const NX_NICHE_GAMEPLAY: nx_int = 0
84const NX_NICHE_CONTENT_CREATION: nx_int = 1
85const NX_NICHE_DEV: nx_int = 2
86const NX_NICHE_BROWSING: nx_int = 3
87const NX_NICHE_FAMILY_COMMS: nx_int = 4
88const NX_NICHE_IDENTITY: nx_int = 5 // signing, master secrets
89const NX_NICHE_HEALTH_PII: nx_int = 6 // medical records, biometrics
90const NX_NICHE_FINANCIAL: nx_int = 7
91const NX_NICHE_N_NICHES: nx_int = 8
92
93// ===== Struct: NxSafetyEnvelope ==================================
94//
95// Per-niche verdict from nx_reclaim. Each field is 1 = safe, 0 =
96// refused on this hardware. Operator queries this struct to decide
97// what cells to start; cells that need an unsafe niche refuse to
98// instantiate.
99//
100// effective_trust_q10 carried through so callers can do their own
101// thresholding for niches not enumerated above (e.g., a Phase-3
102// experimental niche the substrate doesn't know about yet).
103
104struct NxSafetyEnvelope {
105 effective_trust_q10: nx_int,
106 chip_family: nx_int,
107 threat_surface_mask: nx_int,
108 applied_mitigations: nx_int,
109 safe_gameplay: nx_int,
110 safe_content: nx_int,
111 safe_dev: nx_int,
112 safe_browsing: nx_int,
113 safe_family_comms: nx_int,
114 safe_identity: nx_int,
115 safe_health_pii: nx_int,
116 safe_financial: nx_int,
117 n_xenocells_spawned: nx_size,
118}
119
120// ===== nx_niche_is_valid =========================================
121
122func nx_niche_is_valid(n: nx_int) -> nx_int {
123 if n < 0 { return 0 }
124 if n >= NX_NICHE_N_NICHES { return 0 }
125 return 1
126}
127
128// ===== _reclaim_safe_for_niche ====================================
129//
130// Per-niche threshold table. Gameplay/content/dev/browsing tolerate
131// lower trust because the operator can compartmentalize. Identity/
132// health/financial demand near-sovereign trust because compromise
133// is permanent.
134
135func _reclaim_safe_for_niche(trust_q10: nx_int, niche: nx_int) -> nx_int {
136 if niche == NX_NICHE_GAMEPLAY {
137 if trust_q10 >= 410 { return 1 }
138 return 0
139 }
140 if niche == NX_NICHE_CONTENT_CREATION {
141 if trust_q10 >= 410 { return 1 }
142 return 0
143 }
144 if niche == NX_NICHE_DEV {
145 if trust_q10 >= 512 { return 1 }
146 return 0
147 }
148 if niche == NX_NICHE_BROWSING {
149 if trust_q10 >= 410 { return 1 }
150 return 0
151 }
152 if niche == NX_NICHE_FAMILY_COMMS {
153 if trust_q10 >= 614 { return 1 }
154 return 0
155 }
156 if niche == NX_NICHE_IDENTITY {
157 if trust_q10 >= 819 { return 1 }
158 return 0
159 }
160 if niche == NX_NICHE_HEALTH_PII {
161 if trust_q10 >= 768 { return 1 }
162 return 0
163 }
164 if niche == NX_NICHE_FINANCIAL {
165 if trust_q10 >= 768 { return 1 }
166 return 0
167 }
168 return 0
169}
170
171// ===== _reclaim_spawn_xenocell_for_surface =======================
172//
173// Given a chip family + a specific threat-surface bit, spawn the
174// matching xenocell and register it with the organism. Returns the
175// pointer (for caller's records) or NULL if surface bit is 0 or
176// organism is full.
177
178func _reclaim_spawn_xenocell_for_surface(chip_family: nx_int,
179 surface_bit: nx_int,
180 name: *u8,
181 obs_cap: nx_size,
182 o: *NxOrganism) -> *NxXenocell {
183 if surface_bit == 0 { return (0 as i64) as *NxXenocell }
184 // Use chip_family as the xeno_id so the journal can join across
185 // forensic records. attention_class = IDLE_OPPORTUNISTIC since
186 // xenos do not deserve any priority -- they get whatever scraps.
187 let x: *NxXenocell = nx_xenocell_new(chip_family, name,
188 NX_AC_IDLE_OPPORTUNISTIC, obs_cap)
189 if (o as i64) == 0 { return x }
190 // Organism's add_symbiote expects *NxSymbiote not *NxXenocell.
191 // V1 does not enforce typing here -- the caller supplies a
192 // co-located *NxSymbiote for the same xeno when full enrollment
193 // is desired. nx_xenocell is registered separately via its own
194 // dedicated journal entries.
195 return x
196}
197
198// ===== nx_reclaim ================================================
199//
200// THE composed operation. Given:
201// chip_family -- which commodity hardware we're reclaiming
202// chip_name -- caller-supplied byte buffer for human logs
203// applied_mits -- bitmask of mitigations operator has shipped
204// o -- the organism to register xenocells with (may be NULL)
205// xeno_obs_cap -- observation ring size per spawned xenocell
206//
207// Returns a *NxSafetyEnvelope describing what's safe on this host.
208// Even on UNKNOWN-chip hardware the envelope is returned (with
209// everything refused) so the operator gets actionable verdict.
210
211func nx_reclaim(chip_family: nx_int,
212 chip_name: *u8,
213 applied_mits: nx_int,
214 o: *NxOrganism,
215 xeno_obs_cap: nx_size) -> *NxSafetyEnvelope {
216 let env: *NxSafetyEnvelope = (sys_mmap(96)) as *NxSafetyEnvelope
217
218 if nx_chip_family_is_valid(chip_family) == 0 {
219 env.effective_trust_q10 = 0
220 env.chip_family = NX_CHIP_UNKNOWN
221 env.threat_surface_mask = NX_TS_RAM_READ + NX_TS_DMA + NX_TS_NET_EGRESS
222 env.applied_mitigations = NX_MIT_NONE
223 env.safe_gameplay = 0
224 env.safe_content = 0
225 env.safe_dev = 0
226 env.safe_browsing = 0
227 env.safe_family_comms = 0
228 env.safe_identity = 0
229 env.safe_health_pii = 0
230 env.safe_financial = 0
231 env.n_xenocells_spawned = 0
232 return env
233 }
234
235 let a: *NxSiliconAttestation = nx_attestation_new(chip_family, chip_name)
236
237 // Apply mitigations the operator has shipped (mask intersect with
238 // available so we don't over-credit applied set).
239 let valid_mits: nx_int = applied_mits & a.available_mitigations
240 a.applied_mitigations = valid_mits
241
242 let trust: nx_int = nx_attestation_effective_trust_q10(a)
243 env.effective_trust_q10 = trust
244 env.chip_family = chip_family
245 env.threat_surface_mask = a.threat_surface_mask
246 env.applied_mitigations = a.applied_mitigations
247
248 env.safe_gameplay = _reclaim_safe_for_niche(trust, NX_NICHE_GAMEPLAY)
249 env.safe_content = _reclaim_safe_for_niche(trust, NX_NICHE_CONTENT_CREATION)
250 env.safe_dev = _reclaim_safe_for_niche(trust, NX_NICHE_DEV)
251 env.safe_browsing = _reclaim_safe_for_niche(trust, NX_NICHE_BROWSING)
252 env.safe_family_comms = _reclaim_safe_for_niche(trust, NX_NICHE_FAMILY_COMMS)
253 env.safe_identity = _reclaim_safe_for_niche(trust, NX_NICHE_IDENTITY)
254 env.safe_health_pii = _reclaim_safe_for_niche(trust, NX_NICHE_HEALTH_PII)
255 env.safe_financial = _reclaim_safe_for_niche(trust, NX_NICHE_FINANCIAL)
256
257 // Spawn a xenocell for each threat-surface bit present.
258 var spawned: nx_size = 0
259 let surface: nx_int = a.threat_surface_mask
260 if (surface & NX_TS_RAM_READ) != 0 {
261 _reclaim_spawn_xenocell_for_surface(chip_family,
262 NX_TS_RAM_READ, chip_name, xeno_obs_cap, o)
263 spawned = spawned + 1
264 }
265 if (surface & NX_TS_DMA) != 0 {
266 _reclaim_spawn_xenocell_for_surface(chip_family,
267 NX_TS_DMA, chip_name, xeno_obs_cap, o)
268 spawned = spawned + 1
269 }
270 if (surface & NX_TS_NET_EGRESS) != 0 {
271 _reclaim_spawn_xenocell_for_surface(chip_family,
272 NX_TS_NET_EGRESS, chip_name, xeno_obs_cap, o)
273 spawned = spawned + 1
274 }
275 if (surface & NX_TS_RADIO_ACTIVATE) != 0 {
276 _reclaim_spawn_xenocell_for_surface(chip_family,
277 NX_TS_RADIO_ACTIVATE, chip_name, xeno_obs_cap, o)
278 spawned = spawned + 1
279 }
280 if (surface & NX_TS_FIRMWARE_PERSIST) != 0 {
281 _reclaim_spawn_xenocell_for_surface(chip_family,
282 NX_TS_FIRMWARE_PERSIST, chip_name, xeno_obs_cap, o)
283 spawned = spawned + 1
284 }
285 if (surface & NX_TS_MICROCODE_PATCH) != 0 {
286 _reclaim_spawn_xenocell_for_surface(chip_family,
287 NX_TS_MICROCODE_PATCH, chip_name, xeno_obs_cap, o)
288 spawned = spawned + 1
289 }
290 if (surface & NX_TS_BOOT_INTERPOSE) != 0 {
291 _reclaim_spawn_xenocell_for_surface(chip_family,
292 NX_TS_BOOT_INTERPOSE, chip_name, xeno_obs_cap, o)
293 spawned = spawned + 1
294 }
295 if (surface & NX_TS_KEY_ESCROW) != 0 {
296 _reclaim_spawn_xenocell_for_surface(chip_family,
297 NX_TS_KEY_ESCROW, chip_name, xeno_obs_cap, o)
298 spawned = spawned + 1
299 }
300 env.n_xenocells_spawned = spawned
301 return env
302}
303
304// ===== nx_reclaim_can_run_niche ==================================
305
306func nx_reclaim_can_run_niche(env: *NxSafetyEnvelope, niche: nx_int) -> nx_int {
307 if niche == NX_NICHE_GAMEPLAY { return env.safe_gameplay }
308 if niche == NX_NICHE_CONTENT_CREATION { return env.safe_content }
309 if niche == NX_NICHE_DEV { return env.safe_dev }
310 if niche == NX_NICHE_BROWSING { return env.safe_browsing }
311 if niche == NX_NICHE_FAMILY_COMMS { return env.safe_family_comms }
312 if niche == NX_NICHE_IDENTITY { return env.safe_identity }
313 if niche == NX_NICHE_HEALTH_PII { return env.safe_health_pii }
314 if niche == NX_NICHE_FINANCIAL { return env.safe_financial }
315 return 0
316}