nx_sovereignty_audit_gate.nx source

1// nx_sovereignty_audit_gate.nx -- proves the Nishi Office suite's ENTIRE .nx dependency graph is sovereign 2// (no python/sh/java/qemu, every import a .nx module) by running the real /tmp/nx_sovereignty_audit.sov.elf, 3// AND proves the auditor is not a rubber stamp via a NEG-CONTROL: nx_engineer.nx genuinely execs /bin/bash, so 4// the auditor MUST flag it (liar-kill). GREEN iff 8/8. Durable knowledge/status/sovereignty_audit_gate.log. 5// Requires /tmp/nx_sovereignty_audit.sov.elf. license_tier: ORIGINAL 6import "nx_syscalls.nx" 7 8func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 9func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 10func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 11func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 12func g_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 13func g_read(path: *u8, buf: *u8, cap: i64) -> i64 { 14 let fd: i64=sys_openat_rd(path); if fd<0 { return 0 } 15 var total: i64=0; var nrd: i64=sys_read(fd, buf, cap) 16 while nrd>0 { total=total+nrd; if total>=cap { nrd=0 } else { nrd=sys_read(fd, ((buf as i64)+total) as *u8, cap-total) } } 17 sys_close(fd); return total 18} 19func g_contains(hay: *u8, n: i64, needle: *u8) -> i64 { 20 let nl: i64=g_strlen(needle); if nl==0 { return 0 } 21 var i: i64=0 22 while i+nl<=n { var j: i64=0; var hit: i64=1; while j<nl { if hay[i+j]!=needle[j] { hit=0; j=nl } else { j=j+1 } } if hit==1 { return 1 } i=i+1 } 23 return 0 24} 25func g_run(elf: *u8, args: *i64, nargs: i64, out_path: *u8) -> i64 { 26 let pid: i64=sys_fork() 27 if pid==0 { 28 let o: i64=sys_openat_wr(out_path, 0x1a4); if o>=0 { sys_dup3(o,1,0) } 29 let argv: *i64=sys_mmap(8*20) as *i64 30 argv[0]=elf as i64 31 var i: i64=0; while i<nargs { argv[1+i]=args[i]; i=i+1 } argv[1+nargs]=0 32 let envp: *i64=sys_mmap(16) as *i64; envp[0]="PATH=/usr/bin:/bin" as *u8 as i64; envp[1]=0 33 sys_execve(elf, argv, envp); sys_exit(127) 34 } 35 let st: *i64=sys_mmap(16) as *i64; sys_wait4(pid, st, 0); return (st[0]>>8)&0xff 36} 37 38func main() -> i64 { 39 g_puts("=== SOVEREIGNTY AUDIT GATE (office suite graph clean + neg-control liar-kill) ===\n" as *u8) 40 let AUDIT: *u8="/tmp/nx_sov_import_lint.sov.elf" as *u8 // checker renamed (collision resolved); rebuild this .sov.elf from nx_sov_import_lint.nx 41 let scr: *u8="/tmp/sov_audit_out.txt" as *u8 42 let obuf: *u8=sys_mmap(262144) 43 let a: *i64=sys_mmap(8*20) as *i64 44 45 // the office suite + its entire .nx dependency graph 46 a[0]="runtime/_hdl_build/nx_opc.nx" as *u8 as i64 47 a[1]="runtime/_hdl_build/nx_docx.nx" as *u8 as i64 48 a[2]="runtime/_hdl_build/nx_xlsx.nx" as *u8 as i64 49 a[3]="runtime/_hdl_build/nx_mailmerge.nx" as *u8 as i64 50 a[4]="runtime/_hdl_build/nx_estate_inventory.nx" as *u8 as i64 51 a[5]="runtime/nx_crc32.nx" as *u8 as i64 52 a[6]="runtime/nx_zip_header.nx" as *u8 as i64 53 a[7]="runtime/nx_deflate.nx" as *u8 as i64 54 a[8]="runtime/nx_seg_store.nx" as *u8 as i64 55 a[9]="runtime/nx_syscalls.nx" as *u8 as i64 56 let rc_office: i64=g_run(AUDIT, a, 10, scr) 57 var on: i64=g_read(scr, obuf, 262144) 58 59 var pass: i64=0; let rows: i64=8 60 g_puts(" R1 office-suite audit exits 0 (ALL SOVEREIGN)? " as *u8); if rc_office==0 { pass=pass+1; g_puts("YES PASS\n" as *u8) } else { g_puts("NO FAIL (exit=" as *u8); g_num(rc_office); g_puts(")\n" as *u8) } 61 g_puts(" R2 nx_opc.nx SOVEREIGN? " as *u8); if g_contains(obuf,on,"nx_opc.nx: SOVEREIGN" as *u8)==1 { pass=pass+1; g_puts("YES PASS\n" as *u8) } else { g_puts("NO FAIL\n" as *u8) } 62 g_puts(" R3 nx_docx.nx SOVEREIGN? " as *u8); if g_contains(obuf,on,"nx_docx.nx: SOVEREIGN" as *u8)==1 { pass=pass+1; g_puts("YES PASS\n" as *u8) } else { g_puts("NO FAIL\n" as *u8) } 63 g_puts(" R4 nx_xlsx.nx SOVEREIGN? " as *u8); if g_contains(obuf,on,"nx_xlsx.nx: SOVEREIGN" as *u8)==1 { pass=pass+1; g_puts("YES PASS\n" as *u8) } else { g_puts("NO FAIL\n" as *u8) } 64 g_puts(" R5 nx_mailmerge.nx SOVEREIGN? " as *u8); if g_contains(obuf,on,"nx_mailmerge.nx: SOVEREIGN" as *u8)==1 { pass=pass+1; g_puts("YES PASS\n" as *u8) } else { g_puts("NO FAIL\n" as *u8) } 65 g_puts(" R6 nx_estate_inventory.nx SOVEREIGN? " as *u8); if g_contains(obuf,on,"nx_estate_inventory.nx: SOVEREIGN" as *u8)==1 { pass=pass+1; g_puts("YES PASS\n" as *u8) } else { g_puts("NO FAIL\n" as *u8) } 66 67 // NEG-CONTROL: nx_engineer.nx execs /bin/bash -> MUST be flagged (proves the auditor really detects leaks) 68 a[0]="runtime/nx_engineer.nx" as *u8 as i64 69 let rc_neg: i64=g_run(AUDIT, a, 1, scr) 70 var nn: i64=g_read(scr, obuf, 262144) 71 g_puts(" R7 neg-control nx_engineer.nx FLAGGED for /bin/bash? " as *u8); if g_contains(obuf,nn,"FLAGGED" as *u8)==1 { if g_contains(obuf,nn,"/bin/bash" as *u8)==1 { pass=pass+1; g_puts("YES PASS\n" as *u8) } else { g_puts("NO FAIL\n" as *u8) } } else { g_puts("NO FAIL\n" as *u8) } 72 g_puts(" R8 neg-control audit exits NON-zero (liar-kill works)? " as *u8); if rc_neg!=0 { pass=pass+1; g_puts("YES PASS\n" as *u8) } else { g_puts("NO FAIL\n" as *u8) } 73 74 g_puts("----\nSOV-AUDIT rows=" as *u8); g_num(rows); g_puts(" pass=" as *u8); g_num(pass); g_puts("\n" as *u8) 75 let lg: i64=sys_openat_append("knowledge/status/sovereignty_audit_gate.log" as *u8, 0x1a4) 76 if lg>=0 { g_w(lg, "SOV-AUDIT rows=" as *u8); g_wn(lg, rows); g_w(lg, " pass=" as *u8); g_wn(lg, pass); if pass==rows { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } sys_close(lg) } 77 if pass==rows { g_puts("SOV-AUDIT GREEN (office suite 100% sovereign .nx graph; auditor proven to catch a real leak)\n" as *u8); sys_exit(0); return 0 } 78 g_puts("SOV-AUDIT RED\n" as *u8); sys_exit(1); return 1 79}