nx_remote_access_census_gate.nx source

1// nx_remote_access_census_gate.nx -- GATE: remote-access census (improved census engine) -- Nishi API gateway vs the 2// incumbents (Cloudflare Access/Tunnel, Tailscale, Kong, AWS API Gateway). our-grade = disk facts; competitor evidence 3// awaits a networked researcher fetch. Establishes where we EXCEED and the gaps to S-class. 4// HAVE (nx_api_gateway): zero-trust auth, default-deny allow-list, rate-limiting, SOVEREIGN self-hosted (the exceed axis). 5// GAP: NAT-traversal (reach behind CGNAT), DDoS/WAF, audit-log/observability, mTLS client certs. 6// T1 HAVE -- nx_api_gateway on disk -> the auth caps are PRESENT. 7// T2 LIAR -- a missing relay organ -> ABSENT (cannot fake). 8// T3 VERDICT-- reuse the engine. 9// Then prints the matrix. GREEN iff T1-T3. Sovereign nx_cc->nxasm. expect_exit: 0 license_tier: ORIGINAL 10import "nx_capability_census.nx" 11import "nx_syscalls.nx" 12 13func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 14func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 15 16func demo_row(label: *u8, term: *u8, organ: *u8, paths: *i64, npaths: i64, buf: *u8, cap: i64) -> i64 { 17 let none: *u8 = "runtime/nx_NONE_zz.nx" as *u8 18 let comp: i64 = cc_comp_attest(paths, npaths, term, buf, cap) 19 let our: i64 = cc_our_grade(organ, none) 20 let v: i64 = cc_verdict(comp, our) 21 w(" "); w(cc_verdict_str(v)); w(" us="); w(cc_grade_str(our)); w(" them(src="); wn(comp); w(") "); w(label); w("\n") 22 return 0 23} 24 25func main() -> i64 { 26 w("=== nx_remote_access_census_gate: Nishi API gateway vs Cloudflare/Tailscale/Kong/AWS (improved census) ===\n" as *u8) 27 var pass: i64 = 0; var total: i64 = 0 28 let cap: i64 = 2097152 29 let buf: *u8 = sys_mmap(cap) 30 let none: *u8 = "runtime/nx_NONE_zz.nx" as *u8 31 let gw: *u8 = "runtime/_hdl_build/nx_api_gateway.nx" as *u8 32 33 let g1: i64 = cc_our_grade(gw, none) 34 total=total+1; if g1==3 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 35 w("T1 HAVE: nx_api_gateway us=" as *u8); wn(g1); w(" (auth caps PRESENT)\n" as *u8) 36 37 let g2: i64 = cc_our_grade("runtime/nx_relay_NONE.nx" as *u8, none) 38 total=total+1; if g2==0 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 39 w("T2 LIAR: missing relay organ us=" as *u8); wn(g2); w(" (ABSENT)\n" as *u8) 40 41 var t3: i64 = 1 42 if cc_verdict(1,0)!=1 { t3=0 } 43 if cc_verdict(0,3)!=3 { t3=0 } 44 total=total+1; if t3==1 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 45 w("T3 VERDICT: engine reused\n" as *u8) 46 47 let subj: *i64=sys_mmap(8*4) as *i64 48 subj[0]="knowledge/fetched/ra_cloudflare.raw" as *u8 as i64 49 subj[1]="knowledge/fetched/ra_tailscale.raw" as *u8 as i64 50 subj[2]="knowledge/fetched/ra_apigw.raw" as *u8 as i64 51 let ns: i64 = 3 52 w("\n --- Cloudflare/Tailscale/Kong/AWS vs Nishi (them-src from fetched ra_*.raw; 0 = run researcher remotely) ---\n" as *u8) 53 demo_row("zero-trust auth (per-request, no network trust)" as *u8, "zero-trust" as *u8, gw, subj, ns, buf, cap) 54 demo_row("default-deny capability allow-list" as *u8, "allow-list" as *u8, gw, subj, ns, buf, cap) 55 demo_row("rate-limiting" as *u8, "rate-limit" as *u8, gw, subj, ns, buf, cap) 56 demo_row("SOVEREIGN self-hosted (no 3rd-party cloud in path)" as *u8,"sovereign" as *u8, gw, subj, ns, buf, cap) 57 demo_row("NAT-traversal / reach behind CGNAT" as *u8, "NAT" as *u8, "runtime/nx_relay_NONE.nx" as *u8, subj, ns, buf, cap) 58 demo_row("DDoS / WAF protection" as *u8, "DDoS" as *u8, "runtime/nx_waf_NONE.nx" as *u8, subj, ns, buf, cap) 59 demo_row("audit log / observability" as *u8, "audit" as *u8, "runtime/nx_audit_NONE.nx" as *u8, subj, ns, buf, cap) 60 demo_row("mTLS client certificates" as *u8, "mTLS" as *u8, "runtime/nx_mtls_NONE.nx" as *u8, subj, ns, buf, cap) 61 62 w("\n EXCEED AXIS = SOVEREIGN/no-middleman/no-snoop (incumbents route through THEIR cloud); GAPS = NAT-traversal, DDoS/WAF, audit, mTLS\n" as *u8) 63 w("\n=== nx_remote_access_census_gate " as *u8); wn(pass); w("/" as *u8); wn(total) 64 if pass == total { w(" GREEN (remote-access map: we EXCEED on sovereignty; the S-class gaps = NAT-traversal + DDoS/WAF + audit + mTLS)\n" as *u8); sys_exit(0); return 0 } 65 w(" RED\n" as *u8); sys_exit(1); return 1 66}