nx_cap_grant_e2e_gate.nx
buildroot/runtime/nx_cap_grant_e2e_gate.nx
about
nx_cap_grant_e2e_gate.nx -- THE CAPSTONE: proves the ENTIRE production MCP-grant path end-to-end, offline, with a
REAL CSPRNG keyfile on disk (NOT the placeholder). Composes every piece that ships to the NAS in the exact wiring
a granted mcp__nishi__* call hits in production:
nx_cap_keygen (ck_provision writes tools_cap_secret.key) -> the SERVER's own loader (ta_load_cap_secret reads it)
-> mint a token against that same on-disk key (capt_issue) -> present it via the X-Nishi-Cap HEADER on a real
POST /mcp tools/call -> ta_handle_pfx verifies vs the loaded keyfile + runs the GREEN-allowlisted organ with the
parsed argv -> real fork+capture. The ONLY thing not exercised here is the network/edge relay + the deploy.
license_tier: ORIGINAL expect_exit: 0
dependencies 3 imports · 0 importers
imports: nx_tools_api.nxnx_cap_keygen.nxnx_gate.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 13 | const GE_KEYFILE: *u8 = "tools_cap_secret.key" as *u8 // MUST equal nx_tools_api TA_CAP_KEYFILE (CWD-relative) |
| 14 | const GE_CONF: *u8 = "tool_allowlist.conf" as *u8 // MUST equal nx_tool_exec_allow TEA_CONF |
| 15 | const GE_REVOKED: *u8 = "cap_revoked.list" as *u8 // cleared for determinism |
functions
| 17 | func ge_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ d[o+i]=s[i]; i=i+1 } return o+i } called by 1: ge_build_call_hdr |
| 18 | func ge_catb(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64=0; while i<n { d[o+i]=s[i]; i=i+1 } return o+n } called by 1: ge_build_call_hdr |
| 19 | func ge_has(out: *u8, n: i64, needle: *u8) -> i64 { if ta_indexof(out, n, needle) >= 0 { return 1 } return 0 } |
| 20 | func ge_eqn(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 } called by 1: main |
| 21 | func ge_write_file(path: *u8, content: *u8) -> i64 called by 1: main |
| 30 | func ge_build_call_hdr(req: *u8, tool: *u8, tok: *u8, tlen: i64, argvj: *u8) -> i64 |
| 40 | func ge_expect(cond: i64, pass: *i64, tot: *i64, label: *u8) -> i64 |
| 47 | func main() -> i64 |