nx_recycler_assess.nx source

1// nx_recycler_assess.nx -- Analyzes external bug reports to identify applicable security issues and generates hardening gates for Nishi systems. 2import "nx_gate_gn.nx" 3// nx_recycler_assess.nx -- the NISHI RECYCLER brain: "logically look at OTHER systems' published bugs and find the 4// ones that apply to US, then eat their garbage to harden ourselves" (the inverse of the builder; the Amazon-Basics 5// move -- mine third-party complaints, address the stated issue, ship better). For each REAL published bug (fetched 6// to knowledge/fetched/recyc_*.raw by nx_recycler_fetch, so it EXISTS SEPARATE -- rule 4), it maps the bug CLASS to a 7// grounded Nishi architectural FACT and emits a VERDICT + a RECYCLE-ACTION (a named gate). Verdicts: NEEDS-GATE (we 8// have the surface -> add a hardening gate), IMMUNE-BY-DESIGN (a sovereign invariant rules it out -> add a regression 9// gate proving the immunity so we never regress IN), NOT-APPLICABLE (no Nishi surface). The intelligence is the 10// cross-link: external famous bugs map onto OUR OWN documented issues -- Spectre(side-channel)->SEC-CT-001/002 11// timing leaks; integer-overflow->LM-005. Self-gating: proves each intake artifact EXISTS (grounding), the verdict 12// counts, the cross-links, and a neg-control. license_tier: ORIGINAL 13import "nx_syscalls.nx" 14 15func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 16func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 17func has_sub(hay: *u8, needle: *u8) -> i64 { 18 let hl: i64=slen(hay); let nl: i64=slen(needle); if nl==0 { return 1 } 19 var i: i64=0 20 while i+nl<=hl { var k: i64=0; var m: i64=1; while k<nl { if hay[i+k]!=needle[k]{m=0;k=nl} else {k=k+1} } if m==1 { return 1 } i=i+1 } 21 return 0 22} 23func have_file(path: *u8) -> i64 { let fd: i64=sys_openat_rd(path); if fd<0 { return 0 } sys_close(fd); return 1 } 24func streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8){ if a[i]!=b[i]{return 0} i=i+1 } if b[i]!=(0 as u8){return 0} return 1 } 25 26func main() -> i64 { 27 gp("=== nx_recycler_assess: consume other systems' published bugs -> Nishi hardening (Amazon-Basics inverse-builder) ===\n" as *u8) 28 29 // parallel record arrays (grounded: each `file` is a REAL fetched artifact from nx_recycler_fetch) 30 let ids: *i64 = sys_mmap(8*16) as *i64 31 let klass: *i64 = sys_mmap(8*16) as *i64 32 let verd: *i64 = sys_mmap(8*16) as *i64 33 let basis: *i64 = sys_mmap(8*16) as *i64 34 let act: *i64 = sys_mmap(8*16) as *i64 35 let file: *i64 = sys_mmap(8*16) as *i64 36 37 ids[0]="heartbleed" as *u8 as i64; klass[0]="buffer-over-read (CVE-2014-0160)" as *u8 as i64; verd[0]="NEEDS-GATE" as *u8 as i64 38 basis[0]="we ship a SOVEREIGN TLS-1.3 record parser (nx_tls13) -> the bounds-check surface EXISTS" as *u8 as i64 39 act[0]="GATE: a record/length field must be clamped to the bytes actually received (reject the over-read)" as *u8 as i64 40 file[0]="knowledge/fetched/recyc_heartbleed.raw" as *u8 as i64 41 42 ids[1]="bufferoverread" as *u8 as i64; klass[1]="buffer over-read (class)" as *u8 as i64; verd[1]="NEEDS-GATE" as *u8 as i64 43 basis[1]="every sovereign parser (TLS/HTTP/X509/JSON) reads length-prefixed fields from untrusted input" as *u8 as i64 44 act[1]="GATE: length fields clamped to remaining input across the parser family" as *u8 as i64 45 file[1]="knowledge/fetched/recyc_bufferoverread.raw" as *u8 as i64 46 47 ids[2]="shellshock" as *u8 as i64; klass[2]="env-var code injection (CVE-2014-6271)" as *u8 as i64; verd[2]="IMMUNE-BY-DESIGN" as *u8 as i64 48 basis[2]="NO shell in the hot path; organs exec via sys_execve with an explicit argv, never a shell-interpolated env string" as *u8 as i64 49 act[2]="GATE: prove no organ execs an env-derived command string (regression-lock the immunity)" as *u8 as i64 50 file[2]="knowledge/fetched/recyc_shellshock.raw" as *u8 as i64 51 52 ids[3]="log4shell" as *u8 as i64; klass[3]="untrusted lookup/deserialize -> RCE (CVE-2021-44228)" as *u8 as i64; verd[3]="IMMUNE-BY-DESIGN" as *u8 as i64 53 basis[3]="NO eval, NO reflective string->code lookup, NO untrusted deserialization; logging is literal sys_write, not ${}-interpolation" as *u8 as i64 54 act[3]="GATE: prove logging/templating never interprets untrusted ${}/lookup syntax" as *u8 as i64 55 file[3]="knowledge/fetched/recyc_log4shell.raw" as *u8 as i64 56 57 ids[4]="leftpad" as *u8 as i64; klass[4]="supply-chain dependency removal" as *u8 as i64; verd[4]="IMMUNE-BY-DESIGN" as *u8 as i64 58 basis[4]="SOVEREIGN: zero third-party runtime deps, no package manager -- own TLS, own nx_cc compiler, own nxasm" as *u8 as i64 59 act[4]="GATE: prove no organ pulls a third-party runtime dependency (the sovereignty invariant)" as *u8 as i64 60 file[4]="knowledge/fetched/recyc_leftpad.raw" as *u8 as i64 61 62 ids[5]="dirtycow" as *u8 as i64; klass[5]="kernel COW race -> privesc (CVE-2016-5195)" as *u8 as i64; verd[5]="NOT-APPLICABLE" as *u8 as i64 63 basis[5]="kernel-layer memory management is BELOW our surface; we issue syscalls, we do not implement COW/page tables" as *u8 as i64 64 act[5]="DOCUMENT the boundary; the never-brick doctrine governs any persistent-state write" as *u8 as i64 65 file[5]="knowledge/fetched/recyc_dirtycow.raw" as *u8 as i64 66 67 ids[6]="spectre" as *u8 as i64; klass[6]="speculative-execution side channel (CVE-2017-5753)" as *u8 as i64; verd[6]="NEEDS-GATE" as *u8 as i64 68 basis[6]="our CRYPTO has the SAME side-channel class -- SEC-CT-001/002 (ECDSA/Ed25519 timing leaks) are in OUR ki- catalogue" as *u8 as i64 69 act[6]="GATE: constant-time crypto (SEC-CT-002 already FIXED+gated _ed25519_ct_gate; SEC-CT-001 still OPEN -> close it)" as *u8 as i64 70 file[6]="knowledge/fetched/recyc_spectre.raw" as *u8 as i64 71 72 ids[7]="intoverflow" as *u8 as i64; klass[7]="integer overflow" as *u8 as i64; verd[7]="NEEDS-GATE" as *u8 as i64 73 basis[7]="Nishi is integer-only (i64, no-float) -> overflow IS our surface; LM-005 (mask after shift) is OUR documented landmine" as *u8 as i64 74 act[7]="GATE: overflow checks on load-bearing arithmetic (shifts/mults), keyed off LM-005" as *u8 as i64 75 file[7]="knowledge/fetched/recyc_intoverflow.raw" as *u8 as i64 76 let nrec: i64 = 8 77 78 // emit the recycle backlog + tally 79 var needs: i64=0; var immune: i64=0; var na: i64=0; var grounded: i64=0 80 var i: i64=0 81 while i < nrec { 82 let v: *u8 = verd[i] as *u8 83 gp(" [" as *u8); gp(ids[i] as *u8); gp("] " as *u8); gp(klass[i] as *u8); gp("\n verdict=" as *u8); gp(v) 84 gp(" basis: " as *u8); gp(basis[i] as *u8); gp("\n recycle-> " as *u8); gp(act[i] as *u8); gp("\n" as *u8) 85 if have_file(file[i] as *u8)==1 { grounded=grounded+1 } else { gp(" !! intake artifact MISSING (ungrounded)\n" as *u8) } 86 if streq(v, "NEEDS-GATE" as *u8)==1 { needs=needs+1 } 87 if streq(v, "IMMUNE-BY-DESIGN" as *u8)==1 { immune=immune+1 } 88 if streq(v, "NOT-APPLICABLE" as *u8)==1 { na=na+1 } 89 i=i+1 90 } 91 gp(" TALLY: needs-gate=" as *u8); gn(needs); gp(" immune-by-design=" as *u8); gn(immune); gp(" not-applicable=" as *u8); gn(na) 92 gp(" grounded-intake=" as *u8); gn(grounded); gp("/" as *u8); gn(nrec); gp(" (each NEEDS-GATE + each IMMUNE = a gate to build = the recycle yield)\n" as *u8) 93 94 // ---- self-gate ---- 95 var pass: i64=0; var fail: i64=0 96 if grounded==nrec { pass=pass+1 } else { fail=fail+1; gp(" FAIL not-all-grounded (a recycled bug lacks its fetched artifact)\n" as *u8) } 97 if needs==4 { pass=pass+1 } else { fail=fail+1; gp(" FAIL needs-gate-count\n" as *u8) } 98 if immune==3 { pass=pass+1 } else { fail=fail+1; gp(" FAIL immune-count\n" as *u8) } 99 if na==1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL na-count\n" as *u8) } 100 // the "applies to us" INTELLIGENCE: external bugs cross-linked to OUR OWN catalogue 101 if has_sub(basis[6] as *u8, "SEC-CT" as *u8)==1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL spectre-not-linked-to-SEC-CT\n" as *u8) } 102 if has_sub(basis[7] as *u8, "LM-005" as *u8)==1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL intoverflow-not-linked-to-LM-005\n" as *u8) } 103 // honesty: an IMMUNE verdict still yields a recycle-action (a regression gate), never "nothing to do" 104 if slen(act[2] as *u8) > 0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL immune-has-no-action\n" as *u8) } 105 // neg-control: a fabricated/foreign bug not in the intake is NOT graded (no invented verdict) 106 if have_file("knowledge/fetched/recyc_NOTAREALBUG.raw" as *u8)==0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL neg-control\n" as *u8) } 107 108 gp("RECYCLER-ASSESS pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 109 if fail==0 { gp(" verdict=GREEN (8 real published bugs consumed from fetched artifacts; 4 NEEDS-GATE + 3 IMMUNE + 1 N/A; external bugs cross-linked to our own SEC-CT/LM-005)\n" as *u8); sys_exit(0); return 0 } 110 gp(" verdict=RED\n" as *u8); sys_exit(1); return 1 111}