code wiki / _hdl_build / nx_connect_appd.nx
nx_connect_appd.nx
buildroot/runtime/_hdl_build/nx_connect_appd.nx
about
nx_connect_appd.nx -- the DEPLOYABLE CONNECT app daemon (ops shell around the pure core
nx_connect_serve). Binds 0.0.0.0:8032 (LAN: http://192.168.8.227:8032/). Route /connect -> this port
on the sovereign edge. Build with --build-only; run deliberately. license_tier: ORIGINAL
2026-07-10 PERSISTENCE + PER-SESSION: anonymous nxc_sess cookie -> an isolated persistent world.
2026-07-25 SHARED CONTENT-BLIND PLANE (E2E): daemon-owned pubkey directory + routed ciphertext, replayed
from the append-only connect/shared.cbl at boot.
2026-07-25 REAL LOGIN (the accounts rung -- gates everything): full OPAQUE aPAKE (RFC 9807) via the shared
nx_opaque_login seam, in CONNECT's OWN realm (nishi_connect, self-provisioned keys+store). The server
stores only an OPAQUE envelope -- NO password-equivalent at rest. A signed session token rides the
nxc_auth cookie; each request resolves it via olg_whoami to a stable 32-byte user-id -> the world binds
to identity, not to an anonymous cookie. The display handle is resolved from a per-account file the
daemon writes at register/login. Crypto lives HERE (the shell); the pure core only renders from the
auth slots stamped into ctx. Unifying with one family-wide realm (nishi_site_admin) is the next rung.
dependencies 3 imports · 0 importers
imports: nx_connect_accounts.nxnx_connect_album.nxnx_opaque_login.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 19 | const CD_MAGIC_262144: i64 = 262144 |
| 20 | const CD_MAGIC_1048576: i64 = 1048576 |
| 21 | const CD_MAGIC_1024: i64 = 1024 // shared-plane delta-append emit buffer (one row max ~350B) |
| 23 | const CD_PORT: i64 = 0x1f60 // 8032 (8031 = survey lane) |
| 26 | const CD_REALM: *u8 = "nishi_connect" |
| 27 | const CD_REALM_N: i64 = 13 |
| 28 | const CD_DISP: *u8 = "Nishi Connect" |
| 29 | const CD_DISP_N: i64 = 13 |
| 30 | const CD_AUTH_KEYS: *u8 = "connect_auth_keys.bin\x00" |
| 31 | const CD_AUTH_STORE: *u8 = "connect_auth_store.log\x00" |
| 32 | const CD_SESS_TTL: i64 = 86400 // 24h == NX_MAUTH_HARD_MAX_TTL_S (the modauth hard cap; a longer TTL is |
| 35 | const CD_ARGON_M: i64 = 19456 // 19 MiB argon2id (OWASP 2026 alt profile) -- real KSF, snappy on the NAS |
| 36 | const CD_ARGON_T: i64 = 2 |
| 37 | const CD_ARGON_P: i64 = 1 |
| 38 | const CD_PW_MIN: i64 = 8 // minimum passphrase length |
| 39 | const CD_COMPACT_EVERY: i64 = 16 // after this many delete-on-delivery acks, physically compact shared.cbl |
functions
| 41 | func cd_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 1: main |
| 42 | func cd_addr(out: *u8, port: i64) -> i64 called by 1: main |
| 51 | func cd_is_post(req: *u8) -> i64 |
| 58 | func cd_cookie_val(req: *u8, reqlen: i64, key: *u8, keylen: i64, out: *u8, cap: i64) -> i64 |
| 86 | func cd_req_path(req: *u8, reqlen: i64, out: *u8, cap: i64) -> i64 |
| 101 | func cd_lower(buf: *u8, n: i64) -> i64 |
| 108 | func cd_handle_path(acct: i64, out: *u8) -> i64 |
| 123 | func cd_write_handle(acct: i64, handle: *u8, hn: i64) -> i64 |
| 132 | func cd_read_handle(acct: i64, out: *u8, cap: i64) -> i64 |
| 158 | func cd_inject_line(resp: *u8, resp_len: i64, line: *u8, out: *u8, cap: i64) -> i64 |
| 173 | func cd_setcookie(val: *u8, val_len: i64, maxage: i64, out: *u8) -> i64 |
| 193 | func cd_atoi_n(s: *u8, n: i64) -> i64 |
| 199 | func cd_json_resp(body: *u8, bn: i64, out: *u8, cap: i64) -> i64 |
| 216 | func main() -> i64 |