nx_trust_state.nx source
↩ module page · 243 lines · 10704 B
1// nx_trust_state.nx -- bits-up trust-state classifier for substrate
2// primitives. Operationalizes the cardinal:
3//
4// "never trust anything just written till we real world test it
5// in the harsh conditions no theory, no lab, no optimal
6// conditions, working on mediocre suboptimal stuff and world
7// class stuff and barely function range type thinking"
8//
9// Per [[feedback-never-trust-just-written-until-real-world-harsh-
10// tested]] cardinal: every substrate primitive declares its
11// current trust state explicitly in its header. Trust escalates
12// only through empirical harsh-condition evidence.
13//
14// Composes:
15// nx_etg.nx (NxEtgEntry attestation; trust-state classifications
16// emit ETG entries so the substrate's audit chain carries
17// trust-state context)
18// [[feedback-physical-truth-over-published-docs-silicon-empirical-
19// gamification]] (G-ETG cardinal applied INWARD to substrate's
20// own primitives, not just to external silicon)
21// [[feedback-audits-are-ecosystem-citizens-not-islands]] (this
22// classifier IS an audit primitive; ecosystem-citizen wired
23// via NxEtgEntry)
24// [[NISHI_FLOW_DOCTRINE_ROADMAP]] (trust state contributes to
25// flow condition #9 sense-of-control: substrate knows what it
26// does + does not yet know about its own primitives)
27//
28// **Trust State:** WRITTEN_UNTESTED (this file is brand-new in
29// the current session; not yet KAT-passed; substrate-honest
30// initial declaration per the cardinal)
31
32// nx_safety_envelope:
33// intended_use: "trust-state classifier + escalation
34// accounting for substrate primitives;
35// operationalizes the never-trust-just-
36// written-until-real-world-harsh-tested
37// cardinal"
38// sil_target: SIL2
39// evidence: [kat_taxonomy_complete,
40// kat_escalation_rules,
41// kat_etg_attestation_emitted]
42// hazard_register: [bug-tape-trust-state-overstated,
43// bug-tape-escalation-skipped-bands,
44// bug-tape-attestation-claims-trust-not-evidence]
45// verdict: NOT_YET_EVALUATED
46
47import "nx_syscalls.nx"
48import "nx_etg.nx"
49
50// ===== Trust state sealed enum ====================================
51//
52// Numbers reserved (no renumbering); future audits replay historical
53// trust attestations.
54
55const NX_TRUST_UNWRITTEN: i64 = 0 // primitive doesn't exist yet
56const NX_TRUST_WRITTEN_UNTESTED: i64 = 1 // code exists; no KAT; DO NOT TRUST
57const NX_TRUST_LAB_TESTED_QEMU: i64 = 2 // KAT passes on qemu only; STILL DO NOT TRUST
58const NX_TRUST_LAB_TESTED_NATIVE: i64 = 3 // KAT passes on native single-arch; MINIMAL TRUST
59const NX_TRUST_CROSS_ARCH_TESTED: i64 = 4 // ≥2 ISAs; PROBATION TRUST
60const NX_TRUST_SUBOPTIMAL_HARDWARE_TESTED: i64 = 5 // mediocre real hardware; MID TRUST
61const NX_TRUST_BARELY_FUNCTIONAL_TESTED: i64 = 6 // barely-functional real hardware; HIGH TRUST
62const NX_TRUST_WORLD_CLASS_TESTED: i64 = 7 // flagship modern real hardware; UPPER BAND CONFIRMED
63const NX_TRUST_RANGE_TESTED: i64 = 8 // all three hardware bands; PRODUCTION-CANDIDATE
64const NX_TRUST_TIME_PROVEN: i64 = 9 // RANGE_TESTED + N months real-world; PRODUCTION_TRUSTED
65const NX_TRUST_N: i64 = 10
66
67func nx_trust_is_valid(t: i64) -> i64 {
68 if t < 0 { return 0 }
69 if t >= NX_TRUST_N { return 0 }
70 return 1
71}
72
73func nx_trust_name(t: i64) -> *u8 {
74 if t == NX_TRUST_UNWRITTEN { return "UNWRITTEN" }
75 if t == NX_TRUST_WRITTEN_UNTESTED { return "WRITTEN_UNTESTED" }
76 if t == NX_TRUST_LAB_TESTED_QEMU { return "LAB_TESTED_QEMU" }
77 if t == NX_TRUST_LAB_TESTED_NATIVE { return "LAB_TESTED_NATIVE" }
78 if t == NX_TRUST_CROSS_ARCH_TESTED { return "CROSS_ARCH_TESTED" }
79 if t == NX_TRUST_SUBOPTIMAL_HARDWARE_TESTED { return "SUBOPTIMAL_HARDWARE_TESTED" }
80 if t == NX_TRUST_BARELY_FUNCTIONAL_TESTED { return "BARELY_FUNCTIONAL_TESTED" }
81 if t == NX_TRUST_WORLD_CLASS_TESTED { return "WORLD_CLASS_TESTED" }
82 if t == NX_TRUST_RANGE_TESTED { return "RANGE_TESTED" }
83 if t == NX_TRUST_TIME_PROVEN { return "TIME_PROVEN" }
84 return "UNKNOWN"
85}
86
87// Returns 1 if the trust state implies the primitive is safe to
88// use in REAL workloads (composed by downstream primitives) without
89// substrate-honesty caveats. Threshold: SUBOPTIMAL_HARDWARE_TESTED
90// or above. Lower states are LAB / CROSS-ARCH only -- they prove
91// LOGIC but not real-world fitness.
92func nx_trust_is_production_capable(t: i64) -> i64 {
93 if t >= NX_TRUST_SUBOPTIMAL_HARDWARE_TESTED { return 1 }
94 return 0
95}
96
97// Returns 1 if the trust state is "fully production-trusted"
98// (RANGE_TESTED across all three hardware bands or TIME_PROVEN).
99func nx_trust_is_fully_proven(t: i64) -> i64 {
100 if t >= NX_TRUST_RANGE_TESTED { return 1 }
101 return 0
102}
103
104// ===== Hardware band sealed enum =================================
105//
106// Three bands for the "range type thinking" cardinal. A primitive
107// reaches RANGE_TESTED only when passing on ALL THREE bands.
108
109const NX_HW_BAND_NONE: i64 = 0
110const NX_HW_BAND_BARELY_FUNCTIONAL: i64 = 1 // RPi Zero / old laptop thermal-throttled / MCU
111const NX_HW_BAND_SUBOPTIMAL: i64 = 2 // 5-year-old laptop / consumer-SKU binned-down
112const NX_HW_BAND_WORLD_CLASS: i64 = 3 // flagship modern; well-cooled; fully-featured
113const NX_HW_BAND_N: i64 = 4
114
115func nx_hw_band_is_valid(b: i64) -> i64 {
116 if b < 0 { return 0 }
117 if b >= NX_HW_BAND_N { return 0 }
118 return 1
119}
120
121func nx_hw_band_name(b: i64) -> *u8 {
122 if b == NX_HW_BAND_NONE { return "NONE" }
123 if b == NX_HW_BAND_BARELY_FUNCTIONAL { return "BARELY_FUNCTIONAL" }
124 if b == NX_HW_BAND_SUBOPTIMAL { return "SUBOPTIMAL" }
125 if b == NX_HW_BAND_WORLD_CLASS { return "WORLD_CLASS" }
126 return "UNKNOWN"
127}
128
129// ===== NxTrustRecord struct =======================================
130//
131// Caller-allocated; tracks a primitive's current trust state +
132// the hardware bands it has been tested on.
133
134struct NxTrustRecord {
135 primitive_id_hash: i64, // content-hash of primitive name + version
136 trust_state: i64, // NX_TRUST_*
137 bands_passed_bits: i64, // bitmask: bit 1 = barely-functional, bit 2 = suboptimal, bit 3 = world-class
138 timestamp_q14: i64,
139 attestation_hash: i64,
140}
141
142func nx_trust_record_init(r: *NxTrustRecord, primitive_id_hash: i64) {
143 r.primitive_id_hash = primitive_id_hash
144 r.trust_state = NX_TRUST_WRITTEN_UNTESTED // substrate-honest default
145 r.bands_passed_bits = 0
146 r.timestamp_q14 = 0
147 r.attestation_hash = 0
148}
149
150// Record a pass on a specific hardware band. Returns 1 if the
151// band was newly recorded; 0 if already recorded. Updates
152// bands_passed_bits + escalates trust_state if appropriate.
153func nx_trust_record_band_pass(r: *NxTrustRecord, band: i64) -> i64 {
154 if nx_hw_band_is_valid(band) != 1 { return -1 }
155 if band == NX_HW_BAND_NONE { return -1 }
156 let bit_mask: i64 = 1 << band // bits 1, 2, 3 for the three bands
157 if (r.bands_passed_bits & bit_mask) != 0 { return 0 } // already recorded
158 r.bands_passed_bits = r.bands_passed_bits | bit_mask
159
160 // Escalate trust_state based on which band(s) have passed.
161 // Priority: WORLD_CLASS_TESTED < BARELY_FUNCTIONAL_TESTED <
162 // SUBOPTIMAL_HARDWARE_TESTED < RANGE_TESTED (all three).
163 if band == NX_HW_BAND_WORLD_CLASS {
164 if r.trust_state < NX_TRUST_WORLD_CLASS_TESTED {
165 r.trust_state = NX_TRUST_WORLD_CLASS_TESTED
166 }
167 }
168 if band == NX_HW_BAND_SUBOPTIMAL {
169 if r.trust_state < NX_TRUST_SUBOPTIMAL_HARDWARE_TESTED {
170 r.trust_state = NX_TRUST_SUBOPTIMAL_HARDWARE_TESTED
171 }
172 }
173 if band == NX_HW_BAND_BARELY_FUNCTIONAL {
174 if r.trust_state < NX_TRUST_BARELY_FUNCTIONAL_TESTED {
175 r.trust_state = NX_TRUST_BARELY_FUNCTIONAL_TESTED
176 }
177 }
178
179 // RANGE_TESTED iff all three bands' bits set: 1<<1 | 1<<2 | 1<<3 = 14
180 if (r.bands_passed_bits & 14) == 14 {
181 r.trust_state = NX_TRUST_RANGE_TESTED
182 }
183 return 1
184}
185
186// Explicit trust-state set (for non-band escalations: WRITTEN ->
187// LAB_TESTED_QEMU -> LAB_TESTED_NATIVE -> CROSS_ARCH_TESTED).
188// Substrate-honest: caller cannot SET ABOVE TIME_PROVEN externally;
189// TIME_PROVEN is earned by N months of real-world use.
190func nx_trust_record_set_state(r: *NxTrustRecord, state: i64) -> i64 {
191 if nx_trust_is_valid(state) != 1 { return -1 }
192 // Substrate-honest: prevent skipping bands. RANGE_TESTED requires
193 // bands_passed_bits == 14; TIME_PROVEN earned over time.
194 if state == NX_TRUST_RANGE_TESTED {
195 if (r.bands_passed_bits & 14) != 14 { return -2 }
196 }
197 if state == NX_TRUST_TIME_PROVEN { return -3 } // not externally settable
198 r.trust_state = state
199 return 0
200}
201
202// ===== ETG attestation ============================================
203//
204// Emits NxEtgEntry capturing the primitive's current trust state +
205// hardware bands. Outcome maps:
206// trust >= RANGE_TESTED -> CONFIRMED (production-trusted)
207// SUBOPTIMAL <= trust < RANGE -> INCONCLUSIVE (production-capable
208// but not range-proven)
209// trust < SUBOPTIMAL -> FALSIFIED (NOT production-ready;
210// substrate-honest
211// about lab-only state)
212
213func nx_trust_to_etg_outcome(r: *NxTrustRecord) -> i64 {
214 if r.trust_state >= NX_TRUST_RANGE_TESTED { return NX_ETG_OUTCOME_CONFIRMED }
215 if r.trust_state >= NX_TRUST_SUBOPTIMAL_HARDWARE_TESTED {
216 return NX_ETG_OUTCOME_INCONCLUSIVE
217 }
218 return NX_ETG_OUTCOME_FALSIFIED
219}
220
221func nx_trust_attest(
222 r: *NxTrustRecord,
223 entry: *NxEtgEntry,
224 silicon_serial: i64,
225 selector_version: i64,
226 timestamp_q14: i64
227) -> i64 {
228 let outcome: i64 = nx_trust_to_etg_outcome(r)
229 let rc: i64 = nx_etg_entry_init(
230 entry,
231 silicon_serial,
232 NX_ETG_PROBE_AUDIT_TOOL_GENEALOGY, // reusing audit probe family
233 NX_ETG_CLAIM_PRIOR_CALIBRATION,
234 r.bands_passed_bits, // claim: bands recorded
235 r.trust_state, // measurement: current trust state
236 outcome,
237 selector_version,
238 timestamp_q14
239 )
240 if rc != 0 { return rc }
241 r.attestation_hash = entry.attestation_hash
242 return 0
243}