Nuclear command authorization¶

// NuclearCommandAuthority: a two-person-rule authorization workflow.
//
// This models the COMMAND-AUTHORITY layer of a high-assurance system:
// an action order is only valid once a threshold of distinct, authorized
// officers have each independently confirmed it, and any single officer
// can order a stand-down. It authenticates and authorizes orders. It is
// not a weapon system and carries no operational content; the order body
// lives off-chain and is anchored here only by its SHA3 fingerprint.
//
// Every roster change, confirmation, stand-down, and execution is a
// post-quantum-signed transaction, so caller() is a post-quantum
// authenticated officer identity.
contract NuclearCommandAuthority {
    storage commander: address @ 0;                 // authority who manages the roster
    storage threshold: uint @ 1;                    // distinct confirmations required to authorize
    storage is_officer: map[address, uint] @ 2;     // officer -> 1 if on the roster
    storage order_count: uint @ 3;

    storage order_hash: map[uint, uint] @ 4;        // id -> SHA3 fingerprint of the off-chain order
    storage order_proposer: map[uint, address] @ 5;
    storage order_deadline: map[uint, uint] @ 6;    // id -> expiry (unix seconds)
    storage order_confirms: map[uint, uint] @ 7;    // id -> distinct confirmations so far
    storage order_executed: map[uint, uint] @ 8;    // id -> 1 once executed
    storage order_aborted: map[uint, uint] @ 9;     // id -> 1 once stood down
    storage confirmed_by: map[uint, map[address, uint]] @ 10;  // id -> officer -> 1

    event OfficerAdded(officer: address);
    event OfficerRemoved(officer: address);
    event ThresholdSet(threshold: uint);
    event OrderIssued(id: uint, proposer: address, order_hash: uint);
    event OrderConfirmed(id: uint, officer: address, confirms: uint);
    event OrderAborted(id: uint, officer: address);
    event OrderExecuted(id: uint, order_hash: uint);

    // The deployer is the commander: they manage the officer roster and
    // set the confirmation threshold, but cannot authorize an order alone.
    fn init() {
        commander = caller();
    }

    pub fn add_officer(officer: address) {
        require(caller() == commander);
        is_officer[officer] = 1;
        emit OfficerAdded(officer);
    }

    pub fn remove_officer(officer: address) {
        require(caller() == commander);
        is_officer[officer] = 0;
        emit OfficerRemoved(officer);
    }

    pub fn set_threshold(m: uint) {
        require(caller() == commander);
        require(m >= 1);
        threshold = m;
        emit ThresholdSet(m);
    }

    // An authorized officer proposes an action order. The order body is
    // off-chain; only its SHA3 fingerprint is anchored. The proposer
    // counts as the first confirmation.
    pub fn issue_order(content_hash: uint, valid_seconds: uint) -> uint {
        require(is_officer[caller()] == 1);
        require(threshold >= 1);
        let id: uint = order_count;
        order_hash[id] = content_hash;
        order_proposer[id] = caller();
        order_deadline[id] = timestamp() + valid_seconds;
        order_confirms[id] = 1;
        confirmed_by[id][caller()] = 1;
        order_count = id + 1;
        emit OrderIssued(id, caller(), content_hash);
        return id;
    }

    // A distinct authorized officer independently confirms the order.
    pub fn confirm_order(id: uint) {
        require(is_officer[caller()] == 1);
        require(order_executed[id] == 0);
        require(order_aborted[id] == 0);
        require(timestamp() <= order_deadline[id]);
        require(confirmed_by[id][caller()] == 0);
        confirmed_by[id][caller()] = 1;
        order_confirms[id] = order_confirms[id] + 1;
        emit OrderConfirmed(id, caller(), order_confirms[id]);
    }

    // Fail-safe: any single authorized officer can stand the order down
    // before it executes. Going takes a quorum; stopping takes one.
    pub fn abort_order(id: uint) {
        require(is_officer[caller()] == 1);
        require(order_executed[id] == 0);
        order_aborted[id] = 1;
        emit OrderAborted(id, caller());
    }

    // Execute only when a full quorum has confirmed, the order is live,
    // and nobody has stood it down.
    pub fn execute_order(id: uint) {
        require(order_executed[id] == 0);
        require(order_aborted[id] == 0);
        require(timestamp() <= order_deadline[id]);
        require(order_confirms[id] >= threshold);
        order_executed[id] = 1;
        emit OrderExecuted(id, order_hash[id]);
    }

    pub fn confirmations(id: uint) -> uint {
        return order_confirms[id];
    }

    pub fn is_authorized(id: uint) -> uint {
        if order_aborted[id] == 1 {
            return 0;
        }
        if order_executed[id] == 1 {
            return 0;
        }
        if timestamp() > order_deadline[id] {
            return 0;
        }
        if order_confirms[id] >= threshold {
            return 1;
        }
        return 0;
    }

    pub fn get_order_hash(id: uint) -> uint {
        return order_hash[id];
    }
}

require(confirmed_by[id][caller()] == 0);   // this officer hasn't confirmed yet
confirmed_by[id][caller()] = 1;
order_confirms[id] = order_confirms[id] + 1;

pub fn abort_order(id: uint) {
    require(is_officer[caller()] == 1);
    require(order_executed[id] == 0);
    order_aborted[id] = 1;
    emit OrderAborted(id, caller());
}

order id: 0
after issue: confirms=1 authorized=0 (need 2)
outsider confirm blocked   : True
proposer double-confirm     : True
execute below quorum        : True
after 2nd confirm: confirms=2 authorized=1
executed once               : True
re-execute blocked          : True
single-officer stand-down   : True
execute after abort blocked : True
confirm after expiry block  : True
END-TO-END COMMAND AUTHORITY: PASS