code wiki / (root) / nx_cap_invoke_gate.nx

nx_cap_invoke_gate.nx

buildroot/runtime/nx_cap_invoke_gate.nx

5121 B89 linesdepth 9pulls 25 transitivereach 0 importersview sourcekind gate/prooftopic cap
docsdependenciesstructsconstsfunctions

about

nx_cap_invoke_gate.nx -- proves R2: MCP tools/call over R0 is CAPABILITY-SCOPED. Drives ta_handle_pfx in-process with POST /mcp tools/call requests carrying (or lacking) an X-Nishi-Cap token. The beyond-MCP property: invocation requires an unforgeable capability that GRANTS THE SPECIFIC TOOL -- there is NO ambient authority, so confused-deputy is structurally impossible. license_tier: ORIGINAL

dependencies 2 imports · 0 importers

nx_tools_api.nx nx_gate.nx nx_cap_invoke_gate.nx

imports: nx_tools_api.nxnx_gate.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main gw sys_write ta_slen capt_issue capt_payload capt_catb capt_catn signed_cookie_sign sc_sign_bytes sys_mmap hmac_sha256 sys_mmap ↻ sha256_digest sys_mmap ↻ sha256_init sha256_update sha256_final sha256_init ↻ sha256_update ↻ sha256_final ↻ b64_encode b64_enc_char civ_req ta_cat ta_catb ta_handle_pfx ta_reqline ta_emit_lit ta_emit ta_cat ↻ ta_catn ta_catb ↻ ta_slen ↻ ta_streq_n ta_tools ta_cat ↻ ta_emit_tools tool_list_pfx reg_index

structs

none

consts

none

functions

9func civ_req(cap: *u8, caplen: i64, tool: *u8, out: *u8) -> i64
called by 1: main calls 2: ta_catta_catb
21func civ_has(out: *u8, n: i64, needle: *u8) -> i64 { if ta_indexof(out, n, needle) >= 0 { return 1 } return 0 }
called by 1: main calls 1: ta_indexof
22func civ_mark(cond: i64, pass: *i64, tot: *i64, label: *u8) -> i64
called by 1: main calls 1: gw
29func main() -> i64
calls 8: gwta_slencapt_issueciv_reqta_handle_pfxciv_has+2