nx_security_census.nx source
↩ module page · 115 lines · 12188 B
1// nx_security_census.nx -- HONEST measure of the ecosystem's SECURITY coverage across the four surfaces a
2// serious adversary actually works: OVER THE WIRE (transport/auth/crypto), IN THE NETWORK (host/lateral/
3// tenancy), ON THE DEVICE (firmware/boot/supply), and THE AGENTS (the surface unique to an AI-operated
4// substrate). For each control: HAVE iff a real sovereign organ opens on disk (existence != correctness ->
5// the per-organ gate is the ratchet); GAP = a ranked target the growth loop must BUILD = the roadmap.
6//
7// The headline number is the WEAKEST-LINK coverage_permil (critical controls, marked *, weigh 3x): a missing
8// CRITICAL control -- e.g. PQ built-but-UNWIRED, or the host NOT isolated -- drags the grade, because a
9// primitive that does not defend the LIVE path is not coverage. That number is written to the durable log and
10// the ecosystem-maturity rollup live-derives the `security` domain grade from it (measured, never asserted).
11//
12// Sibling of nx_adversarial_census (adversarial-VERIFICATION coverage); this is attack-SURFACE coverage.
13// license_tier: ORIGINAL
14import "nx_security_census_lib.nx"
15import "nx_gate.nx"
16
17// fd-parameterized writers for the durable log (nx_gate's gw/gn are stdout-only).
18func sw(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
19func sn(fd: i64, v: i64) -> i64 {
20 if v==0 { sys_write(fd,"0" as *u8,1); return 0 }
21 var m: i64=v
22 if m<0 { sys_write(fd,"-" as *u8,1); m=0-m }
23 let t: *u8=sys_mmap(24); var k: i64=0
24 while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 }
25 let o: *u8=sys_mmap(24); var w: i64=0; var q: i64=k-1
26 while q>=0 { o[w]=t[q]; w=w+1; q=q-1 }
27 sys_write(fd,o,w); return 0
28}
29
30// one control row: HAVE iff the organ opens on disk; accumulate raw count AND weakest-link-weighted coverage.
31func sc_ax(label: *u8, path: *u8, surf: i64, crit: i64, note: *u8, have: *i64, tot: *i64, cwh: *i64, cwt: *i64) -> i64 {
32 let h: i64 = sc_have(path)
33 let wt: i64 = sc_weight(crit)
34 tot[0] = tot[0] + 1
35 cwt[0] = cwt[0] + wt
36 if h == 1 { have[0]=have[0]+1; cwh[0]=cwh[0]+wt; gw(" [HAVE] " as *u8) } else { gw(" [GAP ] " as *u8) }
37 gw(sc_surf_name(surf)); gw(" " as *u8)
38 if crit == 1 { gw("* " as *u8) } else { gw(" " as *u8) }
39 gw(label); gw(" -> " as *u8); gw(note); gw("\n" as *u8)
40 return h
41}
42
43func main() -> i64 {
44 gw("=== nx_security_census: sovereign security coverage vs the 4 attack surfaces (measured, never asserted) ===\n" as *u8)
45 gw(" thesis: security = WEAKEST LINK. a research-grade primitive that is BUILT-BUT-UNWIRED does not defend the live path.\n" as *u8)
46 gw(" HAVE iff a real sovereign organ opens on disk; * = CRITICAL (weighs 3x -> a missing one drags coverage_permil, the rollup grade).\n\n" as *u8)
47 let have: *i64 = sys_mmap(16) as *i64; have[0]=0
48 let tot: *i64 = sys_mmap(16) as *i64; tot[0]=0
49 let cwh: *i64 = sys_mmap(16) as *i64; cwh[0]=0
50 let cwt: *i64 = sys_mmap(16) as *i64; cwt[0]=0
51
52 gw(" -- OVER THE WIRE: transport, auth, crypto --\n" as *u8)
53 sc_ax("sovereign TLS 1.3 transport " as *u8, "runtime/nx_tls13.nx" as *u8, SC_SURF_WIRE, 1, "own stack, own trust store, forward-secret" as *u8, have, tot, cwh, cwt)
54 sc_ax("AEAD (ChaCha20-Poly1305) " as *u8, "runtime/nx_chacha20_poly1305.nx" as *u8, SC_SURF_WIRE, 0, "authenticated encryption for bulk records" as *u8, have, tot, cwh, cwt)
55 sc_ax("CSPRNG (getrandom->urandom) " as *u8, "runtime/nx_csprng.nx" as *u8, SC_SURF_WIRE, 0, "seed material for keys + nonces" as *u8, have, tot, cwh, cwt)
56 sc_ax("constant-time primitive " as *u8, "runtime/nx_ct.nx" as *u8, SC_SURF_WIRE, 0, "timing-side-channel-resistant compare/select" as *u8, have, tot, cwh, cwt)
57 sc_ax("cap-token authz + forge gate " as *u8, "runtime/nx_cap_token_gate.nx" as *u8, SC_SURF_WIRE, 1, "HMAC-signed least-authority caps; the gate TRIES to forge" as *u8, have, tot, cwh, cwt)
58 sc_ax("PQ KEM impl (ML-KEM-768) " as *u8, "runtime/nx_ml_kem_768_wasm.nx" as *u8, SC_SURF_WIRE, 0, "FIPS 203 REAL impl (round-trip gate nx_mlkem_verify GREEN); bare ml_kem_768.nx is a STUB; FIPS-203 KAT still pending" as *u8, have, tot, cwh, cwt)
59 sc_ax("PQ sig impl (ML-DSA-65) " as *u8, "runtime/nx_ml_dsa_65_wasm.nx" as *u8, SC_SURF_WIRE, 0, "FIPS 204 impl present, verify WIP; bare ml_dsa_65.nx is a STUB" as *u8, have, tot, cwh, cwt)
60 sc_ax("PQ KAT (FIPS-203 interop) " as *u8, "runtime/nx_mlkem_kat_gate.nx" as *u8, SC_SURF_WIRE, 1, "F-sec-04.0 DONE: ML-KEM-768 ek BYTE-EXACT vs NIST ACVP FIPS-203 tcId26 (nx_mlkem_kat_gate GREEN) -- interop-correct, now safe to wire" as *u8, have, tot, cwh, cwt)
61 sc_ax("PQ hybrid engine (X25519MLKEM768)" as *u8, "runtime/nx_x25519mlkem768.nx" as *u8, SC_SURF_WIRE, 0, "0x11EC ML-KEM-first, round-trip PASS + ML-KEM KAT-verified = interop-correct-by-composition; engine READY to wire" as *u8, have, tot, cwh, cwt)
62 sc_ax("ECH encrypted client hello " as *u8, "runtime/nx_tls13_ech.nx" as *u8, SC_SURF_WIRE, 0, "GAP conn-SOTA: encrypt SNI in the ClientHello (privacy frontier -- hides which host we fetch)" as *u8, have, tot, cwh, cwt)
63 sc_ax("HTTP/3 + QUIC (RFC 9000/9002) " as *u8, "runtime/nx_quic_hs.nx" as *u8, SC_SURF_WIRE, 0, "BUILT (I was WRONG this was a gap): full sovereign QUIC stack incl loss-recovery + FEC; gap = EXPOSURE (fetch verb) per nx_conn_catalog" as *u8, have, tot, cwh, cwt)
64 sc_ax("HTTP/2 (HPACK) " as *u8, "runtime/nx_hpack.nx" as *u8, SC_SURF_WIRE, 0, "BUILT: HTTP/2 HPACK header codec; exposure (fetch verb) is the gap, not the capability" as *u8, have, tot, cwh, cwt)
65 sc_ax("connection capability catalogue" as *u8, "runtime/nx_conn_catalog.nx" as *u8, SC_SURF_WIRE, 0, "MCP-EXPOSED discoverable BUILT-vs-EXPOSED index; quantifies the exposure debt = 13 unexposed conn caps (722permil)" as *u8, have, tot, cwh, cwt)
66 sc_ax("PQ hybrid WIRED into fetch/edge " as *u8, "runtime/nx_tls13_pq_client.nx" as *u8, SC_SURF_WIRE, 1, "F-sec-04.1 GAP: engine READY (nx_x25519mlkem768 0x11EC round-trip PASS) -- wire 0x11EC into ClientHello + 1216B share + feed 64B secret to schedule + verify vs Cloudflare" as *u8, have, tot, cwh, cwt)
67 sc_ax("short-TTL / channel-bound cap " as *u8, "runtime/nx_cap_bind.nx" as *u8, SC_SURF_WIRE, 1, "GAP W3: DPoP-style proof-of-possession -- retires the ~2yr plaintext bearer" as *u8, have, tot, cwh, cwt)
68 sc_ax("asymmetric cap signatures " as *u8, "runtime/nx_cap_asym_sign.nx" as *u8, SC_SURF_WIRE, 1, "GAP W3: verify-only servers -- one key read stops forging every cap" as *u8, have, tot, cwh, cwt)
69 sc_ax("crypto differential test " as *u8, "runtime/nx_crypto_difftest.nx" as *u8, SC_SURF_WIRE, 0, "GAP W5: fuzz TLS/handshake vs a reference oracle (rustls/BoringSSL)" as *u8, have, tot, cwh, cwt)
70
71 gw("\n -- IN THE NETWORK: host, lateral movement, tenancy --\n" as *u8)
72 sc_ax("authenticated session tokens " as *u8, "runtime/nx_session_id.nx" as *u8, SC_SURF_NET, 0, "mgmt session identity" as *u8, have, tot, cwh, cwt)
73 sc_ax("host isolation / bind-scope " as *u8, "runtime/nx_bind_scope_gate.nx" as *u8, SC_SURF_NET, 1, "GAP W2: off shared DSM/:443; admin planes loopback-only -- PROVEN by an organ" as *u8, have, tot, cwh, cwt)
74 sc_ax("key sealed to hardware (TPM) " as *u8, "runtime/nx_tpm_seal.nx" as *u8, SC_SURF_NET, 1, "GAP W3: root-of-trust off the flat filesystem" as *u8, have, tot, cwh, cwt)
75 sc_ax("fault injection / chaos " as *u8, "runtime/nx_fault_inject.nx" as *u8, SC_SURF_NET, 0, "GAP: census flags it ABSENT -- inject faults, assert graceful degradation" as *u8, have, tot, cwh, cwt)
76 sc_ax("SSH-retire / cap-gated ops " as *u8, "runtime/nx_break_glass_gate.nx" as *u8, SC_SURF_NET, 0, "GAP W2: SSH to break-glass only, short-lived certs, alarmed audit" as *u8, have, tot, cwh, cwt)
77
78 gw("\n -- ON THE DEVICE: firmware, boot, supply chain --\n" as *u8)
79 sc_ax("never-brick genesis gate " as *u8, "runtime/_hdl_build/nx_genesis_trace.nx" as *u8, SC_SURF_DEV, 1, "any firmware node lacking a never-brick guarantee -> VERDICT RED (Rule 26)" as *u8, have, tot, cwh, cwt)
80 sc_ax("signed install attestation " as *u8, "runtime/nx_install_attest_signed.nx" as *u8, SC_SURF_DEV, 0, "tamper-evident provenance on install" as *u8, have, tot, cwh, cwt)
81 sc_ax("measured boot (TPM PCRs) " as *u8, "runtime/nx_boot_attest.nx" as *u8, SC_SURF_DEV, 1, "GAP W7: never-brick != never-persist-malicious -- attest from CMOS/POST up" as *u8, have, tot, cwh, cwt)
82 sc_ax("reproducible+signed deploy gate" as *u8, "runtime/nx_repro_sign_gate.nx" as *u8, SC_SURF_DEV, 0, "GAP W8: no promote without a reproduced hash + PQ signature + attestation" as *u8, have, tot, cwh, cwt)
83 sc_ax("system-wide constant-time audit" as *u8, "runtime/nx_ct_audit.nx" as *u8, SC_SURF_DEV, 0, "GAP: flag secret-dependent branches across the crypto + auth core" as *u8, have, tot, cwh, cwt)
84
85 gw("\n -- THE AGENTS: the surface unique to an AI-operated substrate --\n" as *u8)
86 sc_ax("threat-model taxonomy " as *u8, "runtime/nx_threat_model.nx" as *u8, SC_SURF_AI, 0, "STRIDE + AI vectors + actors to nation-state/quantum" as *u8, have, tot, cwh, cwt)
87 sc_ax("adversarial census + CI " as *u8, "runtime/nx_adversarial_census.nx" as *u8, SC_SURF_AI, 0, "honest HAVE/GAP; property/mutation/red-team/regression-bank" as *u8, have, tot, cwh, cwt)
88 sc_ax("red-team automation " as *u8, "runtime/nx_redteam.nx" as *u8, SC_SURF_AI, 0, "attack playbook over the live edge" as *u8, have, tot, cwh, cwt)
89 sc_ax("enforced injection boundary " as *u8, "runtime/nx_injection_guard.nx" as *u8, SC_SURF_AI, 1, "GAP W6: prompt-injection guard at every ingest parser, ENFORCED at deploy" as *u8, have, tot, cwh, cwt)
90 sc_ax("N-of-M Byzantine codegen " as *u8, "runtime/nx_quorum_codegen.nx" as *u8, SC_SURF_AI, 1, "GAP W6: independent-agent quorum for auth/crypto/firmware/never-brick changes" as *u8, have, tot, cwh, cwt)
91 sc_ax("control-provenance registry " as *u8, "runtime/nx_control_provenance.nx" as *u8, SC_SURF_AI, 0, "GAP W9: every control maps to a threat x vector or it is CUT (theater-kill)" as *u8, have, tot, cwh, cwt)
92
93 let raw: i64 = sc_permil(have[0], tot[0])
94 let cov: i64 = sc_permil(cwh[0], cwt[0])
95
96 gw("\n=== security coverage: HAVE " as *u8); gn(have[0]); gw("/" as *u8); gn(tot[0])
97 gw(" controls (raw " as *u8); gn(raw); gw(" permil); WEAKEST-LINK coverage_permil=" as *u8); gn(cov); gw(" ===\n" as *u8)
98 gw("ROADMAP (critical GAPs, big-rocks-first): W1 measure[this] -> W4 wire-PQ -> W2 isolate-host -> W3 bind+seal caps -> W6 injection-gate+quorum -> W5 attest-crypto -> W7 measured-boot -> W8 supply-gate -> W9 cut-theater.\n" as *u8)
99 gw("HONEST: existence != correctness -- a HAVE control still owes its own adversarial gate; a GAP is a ranked target for the growth loop (nx_ecomat_target_emit).\n" as *u8)
100
101 // durable evidence line -- the ecosystem-maturity rollup live-derives the `security` domain from coverage_permil= here.
102 let lfd: i64 = sys_openat_append("knowledge/status/security_census.log" as *u8, 0x1a4)
103 if lfd >= 0 {
104 sw(lfd, "SECCENSUS epoch=" as *u8); sn(lfd, sys_now_realtime_sec())
105 sw(lfd, " have=" as *u8); sn(lfd, have[0]); sw(lfd, " total=" as *u8); sn(lfd, tot[0])
106 sw(lfd, " raw_permil=" as *u8); sn(lfd, raw)
107 sw(lfd, " crit_have_w=" as *u8); sn(lfd, cwh[0]); sw(lfd, " crit_total_w=" as *u8); sn(lfd, cwt[0])
108 sw(lfd, " coverage_permil=" as *u8); sn(lfd, cov)
109 sw(lfd, " src=disk-existence verdict=GREEN\n" as *u8)
110 sys_close(lfd)
111 }
112 gw("durable: knowledge/status/security_census.log (coverage_permil consumed by nx_ecosystem_maturity_rollup -> domain `security`)\n" as *u8)
113 sys_exit(0)
114 return 0
115}