nx_transponder_quiescence.nx source
↩ module page · 162 lines · 6220 B
1// nx_transponder_quiescence.nx -- "off means off" (Captain Moroni M2).
2//
3// Per [[feedback-captain-moroni-doctrine]]: "Substrate refuses code
4// that activates cellular/GPS/BT/WiFi when device is in declared-
5// quiescent state. 'Off means off' -- declared-off transponders
6// cannot be silently enabled."
7//
8// Defends against silent tracking activation by baseband / vendor
9// firmware / IMSI catchers. When a user explicitly puts their device
10// in airplane mode or family quiet hours, the substrate REFUSES any
11// code that would emit RF.
12//
13// Composes:
14// nx_intent -- caller must declare Defensive (operator override)
15// intent to activate; default-deny
16// nx_xenocell -- baseband as a hostile xenocell may attempt
17// silent activation; this primitive catches it
18// nx_evict_journal -- every refused activation logged
19// nx_battery_safety -- pair: substrate's substrate-level refusal
20// of physical-harm operations
21
22import "nx_syscalls.nx"
23import "nx_tier.nx"
24import "nx_intent.nx"
25
26// ===== Sealed enum: NxTransponderKind ==============================
27
28const NX_TX_TR_CELLULAR: nx_int = 0
29const NX_TX_TR_GPS: nx_int = 1
30const NX_TX_TR_WIFI: nx_int = 2
31const NX_TX_TR_BLUETOOTH: nx_int = 3
32const NX_TX_TR_NFC: nx_int = 4
33const NX_TX_TR_UWB: nx_int = 5
34const NX_TX_TR_LORA: nx_int = 6
35const NX_TX_TR_N_KINDS: nx_int = 7
36
37// ===== Sealed enum: NxQuiescenceMode ===============================
38
39const NX_QM_FULL_RF_ON: nx_int = 0 // normal operation
40const NX_QM_AIRPLANE_MODE: nx_int = 1 // all transponders OFF
41const NX_QM_QUIET_HOURS: nx_int = 2 // family quiet; only emergency cellular allowed
42const NX_QM_SANCTUARY: nx_int = 3 // declared-off; even emergency requires twin-key
43const NX_QM_N_MODES: nx_int = 4
44
45// ===== Sealed enum: NxTransponderVerdict ===========================
46
47const NX_TX_ALLOWED: nx_int = 0
48const NX_TX_REFUSED_QUIESCENCE: nx_int = 1
49const NX_TX_REFUSED_BAD_INTENT: nx_int = 2
50const NX_TX_REFUSED_BAD_KIND: nx_int = 3
51const NX_TX_REFUSED_BAD_MODE: nx_int = 4
52
53// ===== Struct: NxTransponderDeclaration ============================
54//
55// Per-device, per-transponder declaration of intended state. mode
56// is the current quiescence mode of the device; emergency_override
57// is non-zero if operator has twin-key authorized SANCTUARY override.
58
59struct NxTransponderDeclaration {
60 device_id: nx_int,
61 mode: nx_int,
62 emergency_override: nx_int,
63 declared_at_us: nx_size,
64}
65
66func nx_tx_kind_is_valid(k: nx_int) -> nx_int {
67 if k < 0 { return 0 }
68 if k >= NX_TX_TR_N_KINDS { return 0 }
69 return 1
70}
71
72func nx_qm_mode_is_valid(m: nx_int) -> nx_int {
73 if m < 0 { return 0 }
74 if m >= NX_QM_N_MODES { return 0 }
75 return 1
76}
77
78func nx_transponder_decl_new(device_id: nx_int,
79 mode: nx_int,
80 now_us: nx_size) -> *NxTransponderDeclaration {
81 if nx_qm_mode_is_valid(mode) == 0 { return (0 as i64) as *NxTransponderDeclaration }
82 let d: *NxTransponderDeclaration = (sys_mmap(32)) as *NxTransponderDeclaration
83 d.device_id = device_id
84 d.mode = mode
85 d.emergency_override = 0
86 d.declared_at_us = now_us
87 return d
88}
89
90// ===== nx_transponder_check_activation ============================
91//
92// THE STRUCTURAL REFUSAL POINT. Substrate decides whether the RF
93// activation request is admissible given the declaration + intent.
94//
95// Decision matrix:
96// FULL_RF_ON + any intent + any kind -> ALLOWED
97// AIRPLANE_MODE + any intent + any kind -> REFUSED_QUIESCENCE
98// (no override at this level)
99// QUIET_HOURS + Defensive + CELLULAR -> ALLOWED (emergency calls)
100// QUIET_HOURS + non-Defensive + any -> REFUSED_QUIESCENCE
101// QUIET_HOURS + Defensive + non-CELLULAR -> REFUSED_QUIESCENCE
102// SANCTUARY + emergency_override + Def -> ALLOWED
103// SANCTUARY + no override -> REFUSED_QUIESCENCE
104
105func nx_transponder_check_activation(decl: *NxTransponderDeclaration,
106 intent: nx_int,
107 kind: nx_int) -> nx_int {
108 if nx_intent_is_valid(intent) == 0 { return NX_TX_REFUSED_BAD_INTENT }
109 if nx_tx_kind_is_valid(kind) == 0 { return NX_TX_REFUSED_BAD_KIND }
110 if (decl as i64) == 0 { return NX_TX_REFUSED_QUIESCENCE }
111
112 if decl.mode == NX_QM_FULL_RF_ON { return NX_TX_ALLOWED }
113
114 if decl.mode == NX_QM_AIRPLANE_MODE {
115 return NX_TX_REFUSED_QUIESCENCE
116 }
117
118 if decl.mode == NX_QM_QUIET_HOURS {
119 if intent == NX_INTENT_DEFENSIVE {
120 if kind == NX_TX_TR_CELLULAR { return NX_TX_ALLOWED }
121 }
122 return NX_TX_REFUSED_QUIESCENCE
123 }
124
125 if decl.mode == NX_QM_SANCTUARY {
126 if decl.emergency_override == 1 {
127 if intent == NX_INTENT_DEFENSIVE {
128 // Emergency override is scoped to cellular distress only;
129 // operator MUST explicitly clear sanctuary for other RF.
130 if kind == NX_TX_TR_CELLULAR { return NX_TX_ALLOWED }
131 }
132 }
133 return NX_TX_REFUSED_QUIESCENCE
134 }
135
136 return NX_TX_REFUSED_BAD_MODE
137}
138
139// ===== nx_transponder_authorize_emergency =========================
140//
141// Operator (twin-key authorized) sets emergency_override=1 for a
142// SANCTUARY-mode device. The override is logged + time-limited
143// (caller's responsibility to clear after the emergency).
144
145func nx_transponder_authorize_emergency(decl: *NxTransponderDeclaration) -> nx_int {
146 if decl.mode != NX_QM_SANCTUARY { return NX_TX_REFUSED_BAD_MODE }
147 decl.emergency_override = 1
148 return NX_TX_ALLOWED
149}
150
151// ===== nx_transponder_clear_emergency =============================
152
153func nx_transponder_clear_emergency(decl: *NxTransponderDeclaration) -> nx_int {
154 decl.emergency_override = 0
155 return NX_TX_ALLOWED
156}
157
158// ===== nx_transponder_mode ========================================
159
160func nx_transponder_mode(decl: *NxTransponderDeclaration) -> nx_int {
161 return decl.mode
162}