code wiki / (root) / nx_cap_invoke_gate.nx

nx_cap_invoke_gate.nx

buildroot/runtime/nx_cap_invoke_gate.nx

5137 B89 linesdepth 9pulls 34 transitivereach 0 importersview sourcekind gate/prooftopic cap
docsdependenciesstructsconstsfunctions

about

nx_cap_invoke_gate.nx -- proves R2: MCP tools/call over R0 is CAPABILITY-SCOPED. Drives ta_handle_pfx in-process with POST /mcp tools/call requests carrying (or lacking) an X-Nishi-Cap token. The beyond-MCP property: invocation requires an unforgeable capability that GRANTS THE SPECIFIC TOOL -- there is NO ambient authority, so confused-deputy is structurally impossible. license_tier: ORIGINAL

dependencies 2 imports · 0 importers

nx_tools_api.nx nx_gate.nx nx_cap_invoke_gate.nx

imports: nx_tools_api.nxnx_gate.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main gw sys_write ta_slen civ_req ta_cat ta_catb ta_handle_pfx ta_reqline ta_emit_lit ta_emit ta_cat ↻ ta_catn ta_catb ↻ ta_slen ↻ ta_streq_n ta_tools ta_cat ↻ ta_emit_tools tool_list_pfx reg_index_read reg_index_open ta_rank_path ta_cat ↻ ta_cap_grants ta_rank_calls tool_get_pfx reg_get reg_key ss_get ta_cat ↻ ta_emit_field ta_json_esc ta_put2 ta_put1 ta_hexd ta_desc_is_stub ta_slen ↻ ta_schema_title_buf ta_tsv_field

structs

none

consts

none

functions

9func civ_req(cap: *u8, caplen: i64, tool: *u8, out: *u8) -> i64
called by 1: main calls 2: ta_catta_catb
21func civ_has(out: *u8, n: i64, needle: *u8) -> i64 { if ta_indexof(out, n, needle) >= 0 { return 1 } return 0 }
called by 1: main calls 1: ta_indexof
22func civ_mark(cond: i64, pass: *i64, tot: *i64, label: *u8) -> i64
called by 1: main calls 1: gw
29func main() -> i64
calls 7: gwta_slenciv_reqta_handle_pfxciv_hasciv_mark+1