`nx_warden_lib.nx` source

1// nx_warden_lib.nx -- the Warden's reusable POLICY (no main). The single source
2// of cardinal-truth for autonomous actions, so every role-program that must
3// authorize an action (the Conductor/guardian self-heal, the demo cockpit) shares
4// ONE policy -- no duplicated cardinals (the genealogist's reuse discipline).
5//
6// Law (inherited cardinals): #13 additive-only (never hard-delete, never overwrite
7// source autonomously); additive-safe heal (swap-to-known-good only if a proven
8// backup exists AND the target is a regenerable build artifact); DENY-by-default.
9// license_tier: ORIGINAL
10
11import "nx_syscalls.nx"
12
13const W_HEAL_SWAP:     i64 = 1   // restore a pinned known-good over a build artifact
14const W_DELETE:        i64 = 2   // hard-delete a path
15const W_OVERWRITE_SRC: i64 = 3   // overwrite a source file
16const W_ADDITIVE:      i64 = 4   // append / write a NEW file (additive)
17
18const W_ALLOW: i64 = 1
19const W_DENY:  i64 = 0
20
21const W_AUDIT: *u8 = "/mnt/c/Users/elder/nishi-core/nxc2/_offc/nx_warden_audit.log"
22const W_MODE_FILE: i64 = 420
23
24func w_wstr(fd: i64, s: *u8) -> i64 {
25    var n: i64 = 0
26    while s[n] != 0 as u8 { n = n + 1 }
27    sys_write(fd, s, n)
28    return 0
29}
30
31// substring scan: does haystack contain needle? 1/0.
32func w_contains(hay: *u8, needle: *u8) -> i64 {
33    var hn: i64 = 0; while hay[hn] != 0 as u8 { hn = hn + 1 }
34    var nn: i64 = 0; while needle[nn] != 0 as u8 { nn = nn + 1 }
35    if nn == 0 { return 1 }
36    if nn > hn { return 0 }
37    var i: i64 = 0
38    while i <= hn - nn {
39        var j: i64 = 0
40        var matched: i64 = 1
41        while j < nn { if hay[i + j] != needle[j] { matched = 0; j = nn } else { j = j + 1 } }
42        if matched == 1 { return 1 }
43        i = i + 1
44    }
45    return 0
46}
47
48func w_kind_name(k: i64) -> *u8 {
49    if k == W_HEAL_SWAP { return "HEAL_SWAP" as *u8 }
50    if k == W_DELETE { return "DELETE" as *u8 }
51    if k == W_OVERWRITE_SRC { return "OVERWRITE_SRC" as *u8 }
52    if k == W_ADDITIVE { return "ADDITIVE" as *u8 }
53    return "UNKNOWN" as *u8
54}
55
56// a build artifact (regenerable) lives under _offc/ or ends in a built-binary
57// suffix; SOURCE lives under runtime/ etc. Only artifacts may be auto-restored.
58func w_is_build_artifact(path: *u8) -> i64 {
59    if w_contains(path, "/_offc/" as *u8) == 1 { return 1 }
60    if w_contains(path, ".elf" as *u8) == 1 { return 1 }
61    return 0
62}
63
64// THE GATE. has_backup = does a proven known-good copy of the target exist?
65func warden_check(kind: i64, target: *u8, has_backup: i64) -> i64 {
66    if kind == W_DELETE { return W_DENY }
67    if kind == W_OVERWRITE_SRC { return W_DENY }
68    if kind == W_HEAL_SWAP {
69        if has_backup == 0 { return W_DENY }
70        if w_is_build_artifact(target) == 0 { return W_DENY }
71        return W_ALLOW
72    }
73    if kind == W_ADDITIVE { return W_ALLOW }
74    return W_DENY
75}
76
77func w_audit(kind: i64, target: *u8, verdict: i64) -> i64 {
78    let fd: i64 = sys_openat_append(W_AUDIT, W_MODE_FILE)
79    if fd < 0 { return 0 - 1 }
80    w_wstr(fd, "action="); w_wstr(fd, w_kind_name(kind))
81    w_wstr(fd, " target="); w_wstr(fd, target)
82    w_wstr(fd, " verdict=")
83    if verdict == W_ALLOW { w_wstr(fd, "ALLOW") } else { w_wstr(fd, "DENY") }
84    w_wstr(fd, "\n")
85    sys_close(fd)
86    return 0
87}
88
89// authorize = check + audit. The one call any role makes before acting.
90func warden_authorize(kind: i64, target: *u8, has_backup: i64) -> i64 {
91    let v: i64 = warden_check(kind, target, has_backup)
92    w_audit(kind, target, v)
93    return v
94}
nx_warden_lib.nx source

`nx_warden_lib.nx` source
