nx_spore_germ_gate.nx source

1// nx_spore_germ_gate.nx -- V-SPORE-1 PROOF (X-SEED-002): germinate ONE ecosystem piece 2// from its content-addressed manifest entry and prove it by BEHAVIOR (KAT exit code). 3// A tampered piece is rejected on the INTEGRITY gate and is NEVER built or run. 4// 5// Per NISHI_SPORE_SEED_PORTABILITY_CHARTER germination loop (1:1 PROOF, KAT-as-oracle): 6// 1. PACK -- manifest entry = FNV-1a(canonical piece bytes) + kat_expect exit code. 7// 2. INTEGRITY -- received bytes FNV-1a == manifest hash, else REJECT (never run). 8// 3. MATERIALIZE-- write the VERIFIED bytes to runtime/_germ_scratch_<piece>.nx so the 9// piece's imports resolve via the normal runtime/ tree exactly as the 10// canonical organ's do. Fully isolated-dir germination needs explicit 11// import closures (charter [F2]) = the named follow-on V-SPORE-1b. 12// 4. REBUILD -- the SOVEREIGN toolchain rebuilds the materialized bytes via 13// _offc/nx_sov_build_run.elf (nx_cc_sovereign + nxasm, empty-.s guard). 14// 5. BEHAVIOR -- fork/exec the rebuilt ELF; exit code == manifest kat_expect = 1:1 proof. 15// ADMIT iff INTEGRITY-clean AND rebuild rc==0 AND kat_exit==kat_expect. 16// 17// Controls: POSITIVE = intact nx_exit42 piece -> ADMITTED (kat_exit 42). 18// NEGATIVE = same piece, one byte flipped -> INTEGRITY mismatch -> REJECTED, 19// build+run NEVER reached (admitted count must remain exactly 1). 20// 21// RUN FROM the nxc2 cwd (relative _offc/ runtime/ knowledge/ paths). 22// Build: _offc/nx_sov_build_run.elf nx_spore_germ_gate -> /tmp/nx_spore_germ_gate.sov.elf 23// Verdict line is appended to knowledge/status/spore_germ.log. 24// 25// genealogy_id: nishi_spore_seed_portability_charter_2026-05-28 (X-SEED-002 / V-SPORE-1) 26// lineage_id: spore_germ_proof_v1 27 28import "nx_syscalls.nx" 29 30// ---- FNV-1a over a byte buffer (inlined; matches nx_germinate_test, compiles clean) ---- 31const GERM_FNV_OFFSET: i64 = 0 - 3750763034362895579 // 0xcbf29ce484222325 32const GERM_FNV_PRIME: i64 = 1099511628211 // 0x100000001b3 33 34func germ_hash(buf: *u8, len: i64) -> i64 { 35 var h: i64 = GERM_FNV_OFFSET 36 var i: i64 = 0 37 while i < len { 38 h = h ^ (buf[i] as i64) 39 h = h * GERM_FNV_PRIME 40 i = i + 1 41 } 42 return h 43} 44 45func germ_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 46func germ_puts(s: *u8) -> i64 { sys_write(1, s, germ_slen(s)); return 0 } 47func germ_puts_fd(fd: i64, s: *u8) -> i64 { sys_write(fd, s, germ_slen(s)); return 0 } 48 49// decimal print to fd (matches sbr_putn spine) 50func germ_putn_fd(fd: i64, v: i64) -> i64 { 51 let bb: *u8 = sys_mmap(28) 52 var m: i64 = v 53 if m < 0 { m = 0 - m; sys_write(fd, "-" as *u8, 1) } 54 let t: *u8 = sys_mmap(28) 55 var k: i64 = 0 56 if m == 0 { t[0] = 48; k = 1 } 57 while m > 0 { t[k] = 48 + (m % 10); m = m / 10; k = k + 1 } 58 var i: i64 = 0 59 while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } 60 sys_write(fd, bb, k) 61 return 0 62} 63 64// hex print of an i64 (16 nibbles, MSB first) -- the content address, measured 65func germ_puthex_fd(fd: i64, v: i64) -> i64 { 66 let hx: *u8 = sys_mmap(20) 67 let digits: *u8 = "0123456789abcdef" as *u8 68 var i: i64 = 0 69 while i < 16 { 70 let shift: i64 = 60 - (i * 4) 71 let nib: i64 = (v >> shift) & 0xf 72 hx[i] = digits[nib] 73 i = i + 1 74 } 75 sys_write(fd, hx, 16) 76 return 0 77} 78 79// fork + optional stdout/stderr redirect + execve; parent waits; returns child's WEXITSTATUS, 80// OR 128+signal if the child died to a signal -- NO silent fake-success on a segfaulted tool 81// (replicates the nx_sov_build_run sbr_run evidence-driven runner spine). 82func germ_run(path: *u8, argv: *i64, envp: *i64, redir_out: i64, redir_err: i64) -> i64 { 83 let pid: i64 = sys_fork() 84 if pid == 0 { 85 if redir_out >= 0 { sys_dup3(redir_out, 1, 0) } 86 if redir_err >= 0 { sys_dup3(redir_err, 2, 0) } 87 sys_execve(path, argv, envp) 88 sys_exit(127) 89 } 90 let st: *i64 = sys_mmap(16) as *i64 91 sys_wait4(pid, st, 0) 92 let sig: i64 = st[0] & 0x7f 93 if sig != 0 { return 128 + sig } 94 return (st[0] >> 8) & 0xff 95} 96 97func main() -> i64 { 98 germ_puts("================================================================\n" as *u8) 99 germ_puts(" V-SPORE-1 GERMINATION PROOF -- one piece, content-addressed,\n" as *u8) 100 germ_puts(" rebuilt by the sovereign toolchain, proven by KAT (exit code).\n" as *u8) 101 germ_puts("================================================================\n" as *u8) 102 103 // ---- PACK: manifest entry computed from the canonical piece bytes ---- 104 let src_path: *u8 = "runtime/nx_exit42.nx" as *u8 105 let lenp: *i64 = sys_mmap(8) as *i64 106 let bytes: *u8 = sys_read_file(src_path, lenp) 107 let n: i64 = *lenp 108 if (bytes as i64) == 0 { germ_puts(" FAIL: canary source unreadable\n" as *u8); sys_exit(10); return 10 } 109 if n <= 0 { germ_puts(" FAIL: canary source empty\n" as *u8); sys_exit(10); return 10 } 110 let expect_hash: i64 = germ_hash(bytes, n) 111 let kat_expect: i64 = 42 112 113 germ_puts(" piece=nx_exit42 bytes=" as *u8); germ_putn_fd(1, n) 114 germ_puts(" expect_hash=" as *u8); germ_puthex_fd(1, expect_hash); germ_puts("\n" as *u8) 115 116 var admitted: i64 = 0 117 var neg_reject: i64 = 0 118 var build_rc: i64 = 0 - 1 119 var kat_exit: i64 = 0 - 1 120 121 // ---- POSITIVE control: intact piece -> integrity ok -> materialize -> rebuild -> KAT ---- 122 germ_puts("\n [+] POSITIVE: intact piece\n" as *u8) 123 let recv_hash: i64 = germ_hash(bytes, n) 124 if recv_hash != expect_hash { 125 germ_puts(" INTEGRITY mismatch on intact piece -- impossible; abort\n" as *u8) 126 sys_exit(11); return 11 127 } 128 germ_puts(" integrity: hash MATCH -> materialize\n" as *u8) 129 130 // MATERIALIZE the verified bytes into runtime/ (imports resolve via the normal tree) 131 let scratch_src: *u8 = "runtime/_germ_scratch_exit42.nx" as *u8 132 let wfd: i64 = sys_openat_wr(scratch_src, 0x1a4) 133 if wfd < 0 { germ_puts(" FAIL: cannot materialize scratch source\n" as *u8); sys_exit(12); return 12 } 134 sys_write(wfd, bytes, n) 135 sys_close(wfd) 136 germ_puts(" materialized -> runtime/_germ_scratch_exit42.nx\n" as *u8) 137 138 // REBUILD + BEHAVIOR via the sovereign build/run lane in ONE step: nx_sov_build_run 139 // compiles the materialized source (nx_cc -> nxasm, with the empty-.s nondeterminism 140 // guard) AND runs the result, propagating the program's run-exit as its own exit code. 141 // The canary's KAT exit (42) is deliberately distinct from the lane's build-fail codes 142 // (2/3/4), exec-fail (127), and signal deaths (128+sig) -- so germ_rc==42 unambiguously 143 // means: rebuilt clean AND KAT proven (1:1 PROOF, KAT-as-oracle). Reusing the proven 144 // lane (DRY) beats re-implementing cc->asm->run + its nondeterminism handling. 145 let builder: *u8 = "_offc/nx_sov_build_run.elf" as *u8 146 let b1: *u8 = "_germ_scratch_exit42" as *u8 147 let bargv: *i64 = sys_mmap(32) as *i64 148 bargv[0] = builder as i64 149 bargv[1] = b1 as i64 150 bargv[2] = 0 151 build_rc = germ_run(builder, bargv, 0 as *i64, 0 - 1, 0 - 1) 152 kat_exit = build_rc 153 germ_puts(" rebuild+run: germ_rc=" as *u8); germ_putn_fd(1, build_rc) 154 germ_puts(" (kat_expect=" as *u8); germ_putn_fd(1, kat_expect); germ_puts(")\n" as *u8) 155 if kat_exit == kat_expect { 156 admitted = admitted + 1 157 germ_puts(" -> ADMITTED (integrity-clean, rebuilt by sovereign toolchain, KAT proven)\n" as *u8) 158 } else { 159 germ_puts(" -> REJECT: build-fail or KAT mismatch (liar caught)\n" as *u8) 160 } 161 162 // ---- NEGATIVE control: tampered piece -> integrity mismatch -> NEVER built/run ---- 163 germ_puts("\n [-] NEGATIVE: one byte flipped in transit\n" as *u8) 164 let cor: *u8 = sys_mmap(n + 16) 165 var c: i64 = 0 166 while c < n { cor[c] = bytes[c]; c = c + 1 } 167 cor[0] = (cor[0] ^ 1) as u8 168 let cor_hash: i64 = germ_hash(cor, n) 169 if cor_hash != expect_hash { 170 neg_reject = neg_reject + 1 171 germ_puts(" integrity: hash MISMATCH -> REJECTED, build+run never reached\n" as *u8) 172 } else { 173 germ_puts(" integrity: collision?! tampered piece passed -- gate broken\n" as *u8) 174 } 175 176 // ---- VERDICT (sealed): GREEN iff exactly the known answer ---- 177 var green: i64 = 1 178 if admitted != 1 { green = 0 } 179 if neg_reject != 1 { green = 0 } 180 if kat_exit != kat_expect { green = 0 } 181 182 let lfd: i64 = sys_openat_append("knowledge/status/spore_germ.log" as *u8, 0x1a4) 183 if lfd >= 0 { 184 germ_puts_fd(lfd, "SPOREGERM-GATE epoch=" as *u8); germ_putn_fd(lfd, sys_now_realtime_sec()) 185 germ_puts_fd(lfd, " piece=nx_exit42 bytes=" as *u8); germ_putn_fd(lfd, n) 186 germ_puts_fd(lfd, " expect_hash=" as *u8); germ_puthex_fd(lfd, expect_hash) 187 germ_puts_fd(lfd, " pos_integrity=1 germ_rc=" as *u8); germ_putn_fd(lfd, build_rc) 188 germ_puts_fd(lfd, " kat_expect=" as *u8); germ_putn_fd(lfd, kat_expect) 189 germ_puts_fd(lfd, " admitted=" as *u8); germ_putn_fd(lfd, admitted) 190 germ_puts_fd(lfd, " neg_integrity_reject=" as *u8); germ_putn_fd(lfd, neg_reject) 191 if green == 1 { germ_puts_fd(lfd, " verdict=GREEN\n" as *u8) } else { germ_puts_fd(lfd, " verdict=RED\n" as *u8) } 192 sys_close(lfd) 193 } 194 195 germ_puts("----------------------------------------------------------------\n" as *u8) 196 if green == 1 { 197 germ_puts(" verdict=GREEN -- a content-addressed piece germinated and proved out;\n" as *u8) 198 germ_puts(" the tampered piece was rejected before it could build or run.\n" as *u8) 199 sys_exit(0); return 0 200 } 201 germ_puts(" verdict=RED -- see fields above\n" as *u8) 202 sys_exit(1); return 1 203}