nx_trust_corroborate.nx source

1// nx_trust_corroborate.nx -- the SPORE's sovereign trust bootstrap (operator 2026-06-05: "how do we build from 2// the hardware layer up so the spore can get this -- thats the approach vs shortcuts or hacks"). A sovereign 3// system cannot derive trust from nothing, but it must NOT trust a downloaded blob (certdata.txt) or the 4// substrate's store. The spore carries a RULE, not a trusted file: a root CA is admitted ONLY IF >= K 5// INDEPENDENT sources present the EXACT SAME bytes -- verified by the team's OWN SHA-256, never a source's 6// self-claimed hash. This is the team's own >=2-source research-corroboration gate applied to trust anchors: 7// trust EMERGES from independent agreement, hardware-up. A single tampered/poisoned source cannot reach K alone. 8// After bootstrap the spore self-updates over its OWN now-trusted HTTPS. license_tier: ORIGINAL 9import "nx_sha256.nx" 10import "nx_syscalls.nx" 11 12const TC_HASHLEN: i64 = 32 13 14// the team's OWN fingerprint of a presented root -- WE hash the bytes, we never trust a source's claimed hash. 15func tc_fingerprint(der: *u8, n: i64, out32: *u8) -> i64 { return sha256_digest(der, n, out32) } 16 17// equal 32-byte fingerprints? (constant structure; trust decisions are on bytes WE computed) 18func tc_hash_eq(a: *u8, b: *u8) -> i64 { 19 var i: i64 = 0 20 while i < TC_HASHLEN { if a[i] != b[i] { return 0 } i = i + 1 } 21 return 1 22} 23 24// how many of n_sources independently presented a root whose TEAM-COMPUTED fingerprint equals target_fp? 25// source_fps = n_sources * 32 bytes, each = the team's own hash of THAT source's view of the root. 26func tc_agreement_count(target_fp: *u8, source_fps: *u8, n_sources: i64) -> i64 { 27 var c: i64 = 0; var s: i64 = 0 28 while s < n_sources { 29 if tc_hash_eq(target_fp, source_fps + s * TC_HASHLEN) == 1 { c = c + 1 } 30 s = s + 1 31 } 32 return c 33} 34 35// ADMIT a root iff >= K independent sources agree on its exact bytes. K is the spore's carried RULE (the only 36// axiom -- and it's a threshold, not a trusted blob). K=1 is hearsay (forbidden); K>=2 is corroboration. 37func tc_admit(agreement: i64, k: i64) -> i64 { 38 if k < 2 { return 0 } // hearsay floor: a lone source is never trust (matches the research gate) 39 if agreement >= k { return 1 } 40 return 0 41} 42 43// full decision for one candidate root: hash each source's view with OUR sha256, count agreement, admit iff >=K. 44// sources = n_sources * der_stride bytes (each source's presented DER of this root, fixed stride); der_len = the 45// real DER length to hash. Returns 1 = admit into the trust store, 0 = reject (uncorroborated or poisoned). 46func tc_admit_root(sources: *u8, der_stride: i64, der_len: i64, n_sources: i64, k: i64) -> i64 { 47 let fps: *u8 = sys_mmap(n_sources * TC_HASHLEN) 48 var s: i64 = 0 49 while s < n_sources { 50 tc_fingerprint(sources + s * der_stride, der_len, fps + s * TC_HASHLEN) // WE hash each source 51 s = s + 1 52 } 53 // the candidate fingerprint = source 0's (any honest source yields the same; poisoned ones diverge) 54 let agree: i64 = tc_agreement_count(fps, fps, n_sources) 55 return tc_admit(agree, k) 56} 57 58// the count of sources that AGREE with the majority view of source 0 (for reporting how strong the corroboration is). 59func tc_corroboration_strength(sources: *u8, der_stride: i64, der_len: i64, n_sources: i64) -> i64 { 60 let fps: *u8 = sys_mmap(n_sources * TC_HASHLEN) 61 var s: i64 = 0 62 while s < n_sources { tc_fingerprint(sources + s * der_stride, der_len, fps + s * TC_HASHLEN); s = s + 1 } 63 return tc_agreement_count(fps, fps, n_sources) 64}