code wiki / _hdl_build / nx_cap_provision.nx

nx_cap_provision.nx

buildroot/runtime/_hdl_build/nx_cap_provision.nx

2747 B55 linesdepth 2pulls 2 transitivereach 1 importersview sourcekind tooltopic cap

docs dependencies structs consts functions

about

nx_cap_provision.nx -- FAIL-CLOSED capability-secret provisioning check (closes audit risk #1: the tools-api's baked placeholder HMAC secret is forgeable by anyone reading the binary). A cap- signing secret MUST come from the sovereign vault keyfile, NEVER the compiled placeholder. This PURE check lets the tools-api serve organ FAIL-FAST at startup (CLAUDE.md #20): if the key is absent / too short / still the placeholder -> refuse to bind rather than verify caps against a constant. ADDITIVE + zero-collision (new organ, no edit to the contended nx_tools_api gate suite). The serve-startup wiring + provisioning the real 0600 keyfile on the NAS = operator-coordinated last mile. license_tier: ORIGINAL

dependencies 1 imports · 1 importers

imports: nx_syscalls.nx

imported by: nx_cap_provision_gate.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

12	const CAP_MINKEY: i64 = 16
14	const CAP_PLACEHOLDER: u8 = "nishi-tools-cap-hmac-secret-v1-REPLACE-FROM-VAULT" as u8

functions

16	func cp_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 3: cp_eq_bytes cp_p main
19	func cp_eq_bytes(buf: u8, n: i64, pat: u8) -> i64 called by 1: cap_provisioned calls 1: cp_slen
29	func cap_provisioned(keyfile: *u8, minkey: i64) -> i64 called by 3: cap_provisioned_default main main calls 3: sys_mmap sys_read_file cp_eq_bytes
40	func cap_provisioned_default() -> i64 calls 1: cap_provisioned
44	func cp_p(s: *u8) -> i64 { let n: i64 = cp_slen(s); sys_write(1, s, n); return 0 } called by 3: main cpg_row main calls 2: cp_slen sys_write
46	func main(argc: i64, argv: *i64) -> i64 calls 3: cap_provisioned cp_p sys_exit