code wiki / _hdl_build / nx_ttrust_response.nx
`nx_ttrust_response.nx` source

1// nx_ttrust_response.nx -- the CAPTAIN MORONI active-defense FSM (operator: "a true captain moroni -- i
2// wont attack you but if you attack me ill put you in the ground and find where you came from and scorched
3// earth back on that connection WITH PROPER AUTHORIZATION"). Makes the horse-on-fire protocol from
4// nishi-trusting-trust-defense executable: the graded response when a lattice-layer refusal fires. Pure
5// logic; the thresholds are the operator's doctrine. TWO disciplines are enforced:
6//   (1) NO 90s-car-alarm -- escalation requires ALL THREE independent evidence axes (behavior + context +
7//       provenance) to violate a stated invariant. Wind violates no contract, so wind never trips.
8//   (2) NO vigilante -- the phase-6 counter-offensive (scorched earth on the attacker's own pipe) fires ONLY
9//       with an explicit Auth(counter_offensive) token rooted in hex0. Without it the FSM STOPS at phase 5
10//       (signed evidence held privately, no counter-pipe). license_tier: ORIGINAL
11// Composes nx_ttrust_lattice (the refusal that triggers this response).
12import "nx_syscalls.nx"
13
14// the seven phases (0..6) of the Captain Moroni doctrine
15const CM_PRINCIPLED:  i64 = 0   // principled defense posture only (no escalation)
16const CM_DETECT:      i64 = 1   // multi-axis detection confirmed
17const CM_DOCUMENT:    i64 = 2   // capture bytes + parent_id chain
18const CM_SOFT_REFUSE: i64 = 3   // fake-return + narrate to the attacker
19const CM_ENTRAP:      i64 = 4   // sandbox in a fishbowl, observe full intent
20const CM_ATTRIBUTE:   i64 = 5   // hex0-rooted signed attribution, held privately
21const CM_SCORCH:      i64 = 6   // counter-narrate: signed indictment via attacker's own channel
22
23// multi-axis confirmation: ALL THREE independent axes must violate a stated invariant (anti-car-alarm).
24func cm_axes_confirmed(behavior: i64, context: i64, provenance: i64) -> i64 {
25    if behavior == 1 { if context == 1 { if provenance == 1 { return 1 } } }
26    return 0
27}
28
29// the graded response FSM. returns the highest phase reached. tiered: each step needs more evidence; the
30// scorched-earth step additionally needs authorization (no vigilante).
31func cm_phase(confirmed: i64, attacker_continued: i64, attack_completed: i64, has_auth_token: i64) -> i64 {
32    if confirmed == 0 { return CM_PRINCIPLED }          // wind doesn't trip: no confirmed multi-axis violation
33    if attacker_continued == 0 { return CM_SOFT_REFUSE } // documented + soft-refused; attacker desisted -> stop
34    if attack_completed == 0 { return CM_ENTRAP }        // attacker persisted -> entrapped, still observing
35    if has_auth_token == 0 { return CM_ATTRIBUTE }       // attack done: signed evidence held, NO counter w/o auth
36    return CM_SCORCH                                      // AUTHORIZED -> scorched earth on the attacker's pipe
37}
38
39// did the response stay defensive (never fired the counter-offensive)? true unless phase 6 reached.
40func cm_stayed_defensive(phase: i64) -> i64 { if phase == CM_SCORCH { return 0 } return 1 }
nx_ttrust_response.nx source

`nx_ttrust_response.nx` source
