nx_vault_suite_test.nx source

1// nx_vault_suite_test.nx -- SUITEGATE: the workstream regression-lock for the whole sovereign Vault. Imports 2// ALL engines (transit / lease / acl / dynamic / auth / shamir / rotation) into ONE binary and runs a 3// canonical check from each. This proves (a) they all still COMPILE + COMPOSE together (catches a cross-organ 4// regression that 7 separate gates would miss), and (b) each core property holds. One unit, one verdict. 5// exit 0 on 7/7. license_tier: ORIGINAL 6import "nx_vault_transit.nx" 7import "nx_vault_lease.nx" 8import "nx_vault_acl.nx" 9import "nx_vault_dynamic.nx" 10import "nx_vault_auth.nx" 11import "nx_vault_shamir.nx" 12import "nx_vault_rotation.nx" 13import "nx_syscalls.nx" 14 15func su_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 16func su_eq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { if a[i] != b[i] { return 0 } i = i + 1 } return 1 } 17func su_fill(buf: *u8, val: i64, n: i64) -> i64 { var i: i64 = 0; while i < n { buf[i] = val as u8; i = i + 1 } return 0 } 18func su_recon3(x0: i64, x1: i64, x2: i64, y0: i64, y1: i64, y2: i64) -> i64 { 19 let xs: *i64 = sys_mmap(24) as *i64 20 let ys: *i64 = sys_mmap(24) as *i64 21 xs[0]=x0; xs[1]=x1; xs[2]=x2; ys[0]=y0; ys[1]=y1; ys[2]=y2 22 return sh_reconstruct(xs, ys, 3) 23} 24 25func main() -> i64 { 26 su_puts("=== SOVEREIGN VAULT SUITE GATE (all engines compose + pass as ONE unit) ===\n" as *u8) 27 28 // 1) TRANSIT: real AES-128-GCM roundtrip 29 let kr: *u8 = sys_mmap(16); su_fill(kr, 0x11, 16) 30 let iv: *u8 = sys_mmap(16); su_fill(iv, 0xA1, 12) 31 let env: *u8 = sys_mmap(128) 32 let elen: i64 = tr_encrypt(kr, 1, iv, "abcd" as *u8, 4, env) 33 let outp: *u8 = sys_mmap(128) 34 let dlen: i64 = tr_decrypt(kr, 1, env, elen, outp) 35 var t_transit: i64 = 0; if dlen == 4 { if su_eq(outp, "abcd" as *u8, 4) == 1 { t_transit = 1 } } 36 37 // 2) LEASE: valid in ttl, expired after 38 var t_lease: i64 = 0; if lease_valid(1050, 1000, 100, 0) == 1 { if lease_valid(1100, 1000, 100, 0) == 0 { t_lease = 1 } } 39 40 // 3) ACL: allow granted path, deny unknown (deny-by-default) 41 let ap: *i64 = sys_mmap(8) as *i64; let al: *i64 = sys_mmap(8) as *i64; let ad: *i64 = sys_mmap(8) as *i64; let ac: *i64 = sys_mmap(8) as *i64 42 ap[0] = ("kv/" as *u8) as i64; al[0] = 3; ad[0] = 0; ac[0] = CAP_READ 43 var t_acl: i64 = 0 44 if acl_eval(ap, al, ad, ac, 1, "kv/x" as *u8, 4, CAP_READ) == 1 { if acl_eval(ap, al, ad, ac, 1, "no/x" as *u8, 4, CAP_READ) == 0 { t_acl = 1 } } 45 46 // 4) DYNAMIC: two issues distinct 47 var t_dyn: i64 = 0; if dyn_gen_cred(1, 0, 9) != dyn_gen_cred(1, 1, 9) { t_dyn = 1 } 48 49 // 5) AUTH: token login -> policy, wrong secret -> deny 50 let mt: *i64 = sys_mmap(8) as *i64; let mi: *i64 = sys_mmap(8) as *i64; let ms: *i64 = sys_mmap(8) as *i64; let mp: *i64 = sys_mmap(8) as *i64 51 mt[0] = AM_TOKEN; mi[0] = 0; ms[0] = 42; mp[0] = 7 52 var t_auth: i64 = 0; if auth_login(mt, mi, ms, mp, 1, AM_TOKEN, 0, 42) == 7 { if auth_login(mt, mi, ms, mp, 1, AM_TOKEN, 0, 99) == (0 - 1) { t_auth = 1 } } 53 54 // 6) SHAMIR: K shares reconstruct the secret 55 let cf: *i64 = sys_mmap(24) as *i64; cf[0] = 777; cf[1] = 5; cf[2] = 9 56 let y1: i64 = sh_eval(cf, 3, 1); let y2: i64 = sh_eval(cf, 3, 2); let y3: i64 = sh_eval(cf, 3, 3) 57 var t_shamir: i64 = 0; if su_recon3(1, 2, 3, y1, y2, y3) == 777 { t_shamir = 1 } 58 59 // 7) ROTATION: due after interval, not before 60 var t_rot: i64 = 0; if rot_due(1300, 1000, 200) == 1 { if rot_due(1100, 1000, 200) == 0 { t_rot = 1 } } 61 62 let r: *i64 = sys_mmap(8*8) as *i64 63 r[0] = t_transit; r[1] = t_lease; r[2] = t_acl; r[3] = t_dyn; r[4] = t_auth; r[5] = t_shamir; r[6] = t_rot 64 var pass: i64 = 0; var i: i64 = 0 65 while i < 7 { pass = pass + r[i]; i = i + 1 } 66 su_puts("\n engines: transit/lease/acl/dynamic/auth/shamir/rotation\n passed " as *u8) 67 let pb: *u8 = sys_mmap(8); pb[0] = (48 + pass) as u8; sys_write(1, pb, 1); su_puts("/7\n" as *u8) 68 if pass == 7 { 69 su_puts("SUITEGATE engines=7 all_compose_in_one_binary=1 all_pass=1 exceed[whole sovereign Vault regression-locked as ONE unit -- a cross-organ break now fails here, not silently; bits-up no-HashiCorp-binary] verdict=GREEN\n" as *u8) 70 sys_exit(0); return 0 71 } 72 su_puts("SUITEGATE verdict=RED\n" as *u8); sys_exit(1); return 1 73}