nx_attest_ceremony.nx

nx_attest_ceremony.nx -- the OPERATOR-SIDE key ceremony for the attestation plane, PROVEN against the real verifier before any real key exists. WHY: PROVEN=0/41 is bound on knowledge/attest_keys.conf (operator-held Ed25519 key). The recipe existed only as PROSE derived from reading nx_evattest.nx -- and an untested recipe handed to the operator is litter: if the claim-prefix boundary is off by one byte, every genuine attestation reads BAD-SIGNATURE while all refusal paths still pass (nx_evattest.nx:136 warns exactly this). This organ makes the ceremony EXECUTABLE and proves it byte-exact with a THROWAWAY key that is never registered anywhere real -- the real key stays with the operator, never in an agent session. THE LINE THIS TOOL DOES NOT CROSS: it contains no path that writes knowledge/attest_keys.conf. Registration is the operator's act (the whole clause, per nx_evattest: "Minting a human attestation is an act the operator performs with a key the operator holds"). This tool only makes that act one command and PROVES the output verifies. nx_attest_ceremony keygen <priv_out> -- 32B seed from /dev/urandom -> file; prints pub=<64hex> (pub is PUBLIC; the priv file never prints) nx_attest_ceremony sign <priv_file> <row_file> -- signs the row file's CLAIM PREFIX (trailing newline stripped), prints the full signed row nx_attest_ceremony -- GATE: 6 teeth against the REAL at_verify_row license_tier: ORIGINAL layer: evidence module: nishi-core.evidence.attest_ceremony