nx_security_census_lib.nx source
↩ module page · 52 lines · 2550 B
1// nx_security_census_lib.nx -- PURE core for the SECURITY maturity census. NO main (a lib), so the census
2// organ AND its gate import the SAME measured core and can never diverge -- the nx_ecomat_lib pattern.
3//
4// It carries three things the rest of the census composes on:
5// 1. sc_have(path) -- HAVE iff a real sovereign organ opens on disk (auditor discipline, no false-green;
6// existence != full correctness -> the per-organ gate is the ratchet). Same oracle
7// nx_adversarial_census uses.
8// 2. sc_weight(crit) -- WEAKEST-LINK weighting: a critical control counts SC_CRIT_W(3)x, standard 1x, so a
9// missing CRITICAL control drags the grade hard. Encodes the "security = weakest link"
10// maturity principle mechanically (a research-grade primitive that is BUILT-BUT-UNWIRED
11// does not defend the live path, and must not read as coverage).
12// 3. sc_permil(hw,tw)-- have_weight*1000/total_weight (0 if none). THE number the ecosystem-maturity rollup
13// live-derives the `security` domain grade from.
14// license_tier: ORIGINAL
15import "nx_syscalls.nx"
16
17// attack-surface tags (which surface a control defends)
18const SC_SURF_WIRE: i64 = 0 // over the wire: transport, auth, crypto
19const SC_SURF_NET: i64 = 1 // in the network: host, lateral movement, tenancy
20const SC_SURF_DEV: i64 = 2 // on the device: firmware, boot, supply chain
21const SC_SURF_AI: i64 = 3 // ai-operational: the agents
22
23// weakest-link multiplier: a missing CRITICAL control weighs SC_CRIT_W as much as a standard one.
24const SC_CRIT_W: i64 = 3
25
26func sc_surf_name(s: i64) -> *u8 {
27 if s == SC_SURF_WIRE { return "wire" as *u8 }
28 if s == SC_SURF_NET { return "net " as *u8 }
29 if s == SC_SURF_DEV { return "dev " as *u8 }
30 if s == SC_SURF_AI { return "ai " as *u8 }
31 return "??? " as *u8
32}
33
34// HAVE iff a real sovereign organ opens on disk. one-way disk oracle (no fabrication).
35func sc_have(path: *u8) -> i64 {
36 let fd: i64 = sys_openat_rd(path)
37 if fd < 0 { return 0 }
38 sys_close(fd)
39 return 1
40}
41
42// weakest-link weight for a control: critical -> SC_CRIT_W, standard -> 1.
43func sc_weight(crit: i64) -> i64 {
44 if crit == 1 { return SC_CRIT_W }
45 return 1
46}
47
48// coverage permille (0..1000) = have_weight * 1000 / total_weight ; guarded div-by-zero -> 0.
49func sc_permil(have_w: i64, total_w: i64) -> i64 {
50 if total_w <= 0 { return 0 }
51 return (have_w * 1000) / total_w
52}