nx_sign_envelope.nx source
↩ module page · 89 lines · 3496 B
1// nx_sign_envelope.nx -- Nishi Sign CLI/MCP organ: self-verifying demo over the CORE LIB
2// (nx_sign_envelope_lib.nx -- the same shipped code the independent gate imports).
3// Proves live per call: tamper=DETECTED + determinism + seg_store persist round-trip.
4// license_tier: ORIGINAL
5
6import "nx_sign_envelope_lib.nx"
7const K_MAGIC_1100: i64 = 1100
8const K_MAGIC_1200: i64 = 1200
9const K_MAGIC_4096: i64 = 4096
10
11func main() -> i64 {
12 let e0: *u8 = sys_mmap(SE_EVT_CAP)
13 let e1: *u8 = sys_mmap(SE_EVT_CAP)
14 let e2: *u8 = sys_mmap(SE_EVT_CAP)
15 let l0: i64 = se_event_encode("ENV-1" as *u8, 0, "alice@firm" as *u8, "created" as *u8, 1000, e0)
16 let l1: i64 = se_event_encode("ENV-1" as *u8, 1, "bob@client" as *u8, "signed" as *u8, K_MAGIC_1100, e1)
17 let l2: i64 = se_event_encode("ENV-1" as *u8, 2, "alice@firm" as *u8, "completed" as *u8, K_MAGIC_1200, e2)
18
19 let g: *u8 = sys_mmap(40)
20 se_genesis(g)
21 let h1: *u8 = sys_mmap(40)
22 let h2: *u8 = sys_mmap(40)
23 let h3: *u8 = sys_mmap(40)
24 se_chain(g, e0, l0, h1)
25 se_chain(h1, e1, l1, h2)
26 se_chain(h2, e2, l2, h3)
27
28 // DETERMINISM: recompute identical chain -> equal head
29 let r1: *u8 = sys_mmap(40)
30 let r2: *u8 = sys_mmap(40)
31 let r3: *u8 = sys_mmap(40)
32 se_chain(g, e0, l0, r1)
33 se_chain(r1, e1, l1, r2)
34 se_chain(r2, e2, l2, r3)
35 if se_eq32(h3, r3) == 0 { return __syscall(93, 21, 0, 0, 0, 0, 0) }
36
37 // TAMPER-EVIDENCE: flip one byte of the signed event -> head MUST differ
38 let t1b: *u8 = sys_mmap(SE_EVT_CAP)
39 var c: i64 = 0
40 while c < l1 { t1b[c] = e1[c]; c = c + 1 }
41 t1b[l1 - 1] = (t1b[l1 - 1] + 1) as u8
42 let x1: *u8 = sys_mmap(40)
43 let x2: *u8 = sys_mmap(40)
44 let x3: *u8 = sys_mmap(40)
45 se_chain(g, e0, l0, x1)
46 se_chain(x1, t1b, l1, x2)
47 se_chain(x2, e2, l2, x3)
48 if se_eq32(h3, x3) == 1 { return __syscall(93, 22, 0, 0, 0, 0, 0) }
49
50 // PERSIST round-trip: canonical envelope -> CID -> reg_put -> reg_get
51 let h3hex: *u8 = sys_mmap(80)
52 se_hex(h3, h3hex)
53 let ek: *i64 = sys_mmap(8 * 3) as *i64
54 let ev: *i64 = sys_mmap(8 * 3) as *i64
55 ek[0] = ("env" as *u8) as i64
56 ev[0] = ("ENV-1" as *u8) as i64
57 ek[1] = ("status" as *u8) as i64
58 ev[1] = ("completed" as *u8) as i64
59 ek[2] = ("audit_head" as *u8) as i64
60 ev[2] = h3hex as i64
61 let rec: *u8 = sys_mmap(K_MAGIC_4096)
62 let rl: i64 = canon_encode(ek, ev, 3, rec)
63 let cid: *u8 = sys_mmap(80)
64 cid_of(rec, rl, cid)
65
66 let prefix: *u8 = "/tmp/nx_sign_demo-" as *u8
67 reg_put(prefix, "env:" as *u8, "env:__idx__" as *u8, "ENV-1" as *u8, rec, rl)
68 let po: *i64 = sys_mmap(16) as *i64
69 let lo: *i64 = sys_mmap(16) as *i64
70 let got: i64 = reg_get(prefix, "env:" as *u8, "ENV-1" as *u8, po, lo)
71 if got < 1 { return __syscall(93, 23, 0, 0, 0, 0, 0) }
72 if lo[0] != rl { return __syscall(93, 24, 0, 0, 0, 0, 0) }
73 let src: *u8 = po[0] as *u8
74 var y: i64 = 0
75 while y < rl { if src[y] != rec[y] { return __syscall(93, 25, 0, 0, 0, 0, 0) } y = y + 1 }
76
77 let out: *u8 = sys_mmap(512)
78 var o: i64 = 0
79 o = se_catcopy(out, o, "NISHI-SIGN OK env=ENV-1 events=3 tamper=DETECTED determinism=OK persist=OK head=" as *u8)
80 var z: i64 = 0
81 while z < 64 { out[o] = h3hex[z]; o = o + 1; z = z + 1 }
82 o = se_catcopy(out, o, " cid=" as *u8)
83 z = 0
84 while z < 69 { out[o] = cid[z]; o = o + 1; z = z + 1 }
85 out[o] = 10 as u8
86 o = o + 1
87 sys_write(1, out, o)
88 return __syscall(93, 0, 0, 0, 0, 0, 0)
89}