nx_cap_grant_e2e_gate.nx
buildroot/runtime/nx_cap_grant_e2e_gate.nx
about
nx_cap_grant_e2e_gate.nx -- THE CAPSTONE: proves the ENTIRE production MCP-grant path end-to-end, offline, with a
REAL CSPRNG keyfile on disk (NOT the placeholder). Composes every piece that ships to the NAS in the exact wiring
a granted mcp__nishi__* call hits in production:
nx_cap_keygen (ck_provision writes tools_cap_secret.key) -> the SERVER's own loader (ta_load_cap_secret reads it)
-> mint a token against that same on-disk key (capt_issue) -> present it via the X-Nishi-Cap HEADER on a real
POST /mcp tools/call -> ta_handle_pfx verifies vs the loaded keyfile + runs the GREEN-allowlisted organ with the
parsed argv -> real fork+capture. The ONLY thing not exercised here is the network/edge relay + the deploy.
license_tier: ORIGINAL expect_exit: 0
dependencies 3 imports · 0 importers
imports: nx_tools_api.nxnx_cap_keygen.nxnx_gate.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 34 | const GE_KEYFILE: *u8 = "tools_cap_secret.key" as *u8 // MUST equal nx_tools_api TA_CAP_KEYFILE (CWD-relative) |
| 35 | const GE_CONF: *u8 = "tool_allowlist.conf" as *u8 // MUST equal nx_tool_exec_allow TEA_CONF |
| 36 | const GE_REVOKED: *u8 = "cap_revoked.list" as *u8 // cleared for determinism |
| 37 | const GE_SANDBOX: *u8 = "/tmp/nx_capgrant_e2e" as *u8 // every relative path above resolves in HERE |
functions
| 49 | func ge_exists(p: *u8) -> i64 called by 1: ge_sandbox_enter |
| 56 | func ge_getcwd(buf: *u8, cap: i64) -> i64 called by 1: ge_sandbox_enter |
| 62 | func ge_sandbox_enter(argecho_abs: *u8) -> i64 |
| 86 | func ge_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ d[o+i]=s[i]; i=i+1 } return o+i } |
| 87 | func ge_catb(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64=0; while i<n { d[o+i]=s[i]; i=i+1 } return o+n } called by 1: ge_build_call_hdr |
| 88 | func ge_has(out: *u8, n: i64, needle: *u8) -> i64 { if ta_indexof(out, n, needle) >= 0 { return 1 } return 0 } |
| 89 | func ge_eqn(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 } called by 1: main |
| 90 | func ge_write_file(path: *u8, content: *u8) -> i64 called by 1: main |
| 99 | func ge_build_call_hdr(req: *u8, tool: *u8, tok: *u8, tlen: i64, argvj: *u8) -> i64 |
| 109 | func ge_expect(cond: i64, pass: *i64, tot: *i64, label: *u8) -> i64 |
| 116 | func main() -> i64 |