Native daemon

The Termux / edge stack. Same architecture this DApp executes in-browser: packed accounts, decoy tripwire, validator shield, ChaCha20-Poly1305. Kernel DROP is native-only. The console applies four hardenings on the live path.

Unique AEAD nonces

Native. Static 12-byte nonce b"threat_advsry" reused on every packet.

DApp. Each mesh frame prepends a fresh 12-byte nonce. ChaCha20-Poly1305 forbids reuse under one key.

Rotated mesh key

Native. Hardcoded 32-byte ASCII secret compiled into the binary.

DApp. First boot mints a CSPRNG key and stores it on this device. Blueprint secret is display-only.

Constant-time owner compare

Native. Discriminator uses XOR-fold; owner uses Rust != (variable time).

DApp. Both discriminator and owner are compared with a full-length XOR fold.

IP validation before DROP

Native. BLOCK: payload is passed straight to iptables -s.

DApp. IPv4 is regex-validated before a kernel rule is recorded. No shell, no iptables in the browser.

src/main.rs

use chacha20poly1305::{aead::{Aead, KeyInit}, ChaCha20Poly1305, Key, Nonce};
use std::net::UdpSocket;
use std::process::Command;
use std::thread;
use std::time::Duration;
use std::ptr::read_unaligned;
use std::mem::size_of;

// ============================================================================
// 1. SENTINEL SECURITY PROTOCOL: ZERO-COPY ACCOUNT & INSTRUCTION ENGINE
// ============================================================================
#[repr(C, packed)]
pub struct SentinelAccountHeader {
    pub discriminator: [u8; 8],
    pub owner_pubkey: [u8; 32],
    pub is_signer: u8,
    pub reserve_balance: u64,
}

#[inline(always)]
pub fn constant_time_eq_8(a: &[u8; 8], b: &[u8; 8]) -> bool {
    let mut res = 0u8;
    for i in 0..8 { res |= a[i] ^ b[i]; }
    res == 0
}

pub fn verify_sentinel_state(buffer: &[u8], expected_owner: &[u8; 32], expected_disc: &[u8; 8]) -> Result<u64, &'static str> {
    if buffer.len() < size_of::<SentinelAccountHeader>() {
        return Err("ERR_BUFFER_UNDERFLOW");
    }
    let ptr = buffer.as_ptr() as *const SentinelAccountHeader;
    let (disc, owner, signer, reserve) = unsafe {
        (
            read_unaligned(std::ptr::addr_of!((*ptr).discriminator)),
            read_unaligned(std::ptr::addr_of!((*ptr).owner_pubkey)),
            read_unaligned(std::ptr::addr_of!((*ptr).is_signer)),
            read_unaligned(std::ptr::addr_of!((*ptr).reserve_balance)),
        )
    };

    if !constant_time_eq_8(&disc, expected_disc) { return Err("ERR_INVALID_DISCRIMINATOR"); }
    if &owner != expected_owner { return Err("ERR_OWNER_MISMATCH"); }
    if signer == 0 { return Err("ERR_MISSING_SIGNATURE"); }

    Ok(reserve)
}

// ============================================================================
// 2. THE REMOTE VIEWER: DECOY TRIPWIRE (Auxiliary Threat Radar)
// ============================================================================
pub fn spawn_decoy_tripwire(decoy_port: u16, validator_mesh_addr: String, shared_secret: [u8; 32]) {
    thread::spawn(move || {
        let decoy_socket = UdpSocket::bind(format!("0.0.0.0:{}", decoy_port)).expect("CRITICAL: Decoy bind failed");
        let tx_socket = UdpSocket::bind("0.0.0.0:0").expect("CRITICAL: TX bind failed");
        let cipher = ChaCha20Poly1305::new(Key::from_slice(&shared_secret));
        let nonce = Nonce::from_slice(b"threat_advsry");
        let mut buf = [0u8; 512];

        loop {
            if let Ok((_, src)) = decoy_socket.recv_from(&mut buf) {
                let hostile_ip = src.ip().to_string();
                let mut payload = b"BLOCK:".to_vec();
                payload.extend_from_slice(hostile_ip.as_bytes());

                if let Ok(encrypted) = cipher.encrypt(nonce, payload.as_ref()) {
                    let _ = tx_socket.send_to(&encrypted, &validator_mesh_addr);
                }
            }
        }
    });
}

// ============================================================================
// 3. THE REMOTE VIEWER: VALIDATOR SHIELD (Kernel-Level Defense)
// ============================================================================
pub fn spawn_validator_shield(listen_port: u16, shared_secret: [u8; 32]) {
    thread::spawn(move || {
        let socket = UdpSocket::bind(format!("0.0.0.0:{}", listen_port)).expect("CRITICAL: Shield bind failed");
        let cipher = ChaCha20Poly1305::new(Key::from_slice(&shared_secret));
        let nonce = Nonce::from_slice(b"threat_advsry");
        let mut buf = [0u8; 1024];

        loop {
            if let Ok((size, _)) = socket.recv_from(&mut buf) {
                if let Ok(decrypted) = cipher.decrypt(nonce, &buf[..size]) {
                    if let Ok(msg) = std::str::from_utf8(&decrypted) {
                        if msg.starts_with("BLOCK:") {
                            let ip = msg.trim_start_matches("BLOCK:");
                            let _ = Command::new("iptables").args(["-A", "INPUT", "-s", ip, "-j", "DROP"]).status();
                        }
                    }
                }
            }
        }
    });
}

// ============================================================================
// 4. MAIN NATIVE ENTRYPOINT (Sentinel OS Initialization)
// ============================================================================
fn main() {
    println!("[*] Initializing Sentinel Security Protocol & Remote Viewer Daemon...");

    let shared_secret = *b"sentinel_archetecht_32_byte_key!";
    let validator_port = 44321;
    let decoy_port = 44399;

    spawn_decoy_tripwire(decoy_port, format!("127.0.0.1:{}", validator_port), shared_secret);
    spawn_validator_shield(validator_port, shared_secret);

    println!("[+] Sentinel OS Parallel Subsystems Active.");
    println!("[+] Decoy Tripwire active on port {decoy_port}. Validator Shield active on port {validator_port}.");

    loop {
        thread::sleep(Duration::from_secs(3600));
    }
}