nx_attest.nx

nx_attest.nx -- append-only Merkle log for cryptographic attestation of every state-changing operation. Per docs/SECURITY_POSTURE.md principle P11: every privileged operation (commit, signing, key gen, deploy, capability grant, rate-limit lockout) gets logged with a chained SHA-256 hash that external witnesses can verify and that prevents tampering with the historical record. Append-only Merkle structure: record_n = sha256(prev_hash || record_n_data) prev_hash for record_0 is a published genesis hash Anyone holding a later record_k can verify all earlier records by walking back to genesis. Tampering with any historical record breaks the chain at that point and every subsequent hash; instantly detectable. Use: log = nx_attest_log_new(genesis_hash) nx_attest_record(log, op_type, op_data, op_data_len) nx_attest_verify(log, expected_head_hash) -> 1 / 0 The genesis hash is committed to git + signed by the K-of-N authority keys. Forking history from genesis is detectable by any verifier with a different genesis (i.e. external witness). Pairs with: sha256.nx (chain hash), nx_rate_limit.nx (logs failures), nx_caps.nx (logs capability grants/revokes), nx_pqc.nx (signs the log head with PQ-safe keys).