code wiki / _hdl_build / nx_crew_live_verify.nx

nx_crew_live_verify.nx

buildroot/runtime/_hdl_build/nx_crew_live_verify.nx

15154 B260 linesdepth 19pulls 127 transitivereach 0 importersview sourcekind orphan librarytopic crew
docsdependenciesstructsconstsfunctions

about

nx_crew_live_verify.nx -- SOVEREIGN live verification of the nishi_crew MCP plane over the PUBLIC EDGE, every rung OURS on OUR hardware: DNS -> TCP -> our TLS 1.3 (X.509 vs Mozilla store) -> HTTP -> our parser -> byte assertions. Per the harshest standard (operator 2026-07-10 "no WebFetch in the mix" + sovereign-gates-not-curl): my earlier nishi_crew proofs were curl-in-sudo-script on LOOPBACK -- a shell probe, never the public edge. This gate RETIRES that: T1 GET /api/tools -> 200 + nishi_crew listed (discovery, sovereign fetch) T2 POST /mcp tools/call nishi_crew [] -> coverage_permil parsed live (structure + value printed) T3 POST /mcp tools/call nishi_crew doctor fix -> dispatched true + exit_code 0 (the WHOLE chain: edge TLS -> tools-api -> cap check -> fork-exec nishi_crew -> RACI gate -> fork-exec nx_doctor_serve -> heal byte-verified) T4 NEG-CONTROL: a garbage cap -> capability denied + NO data leaked (the auth wall has teeth) usage: nx_crew_live_verify <capfile> (capfile = one nishi_crew capability token; never baked into source) MCP envelope escapes quotes (\"coverage_permil\":600) -> value checks scan digits AFTER a label, no escape guessing. Pattern: nx_connect_live_verify (GREEN 4/4); POST via nx_https_req_complete (post_complete hangs on keep-alive). license_tier: ORIGINAL expect_exit: 0

dependencies 11 imports · 0 importers

nx_syscalls.nx nx_itoa_lib.nx nx_x509_trust_store.nx nx_trust_store_load_from_certdata. nx_tls13_client_validate_certifica nx_tls13_client_session_run.nx nx_https_url_for_fetch.nx nx_https_url_connect.nx nx_https_get_complete.nx nx_https_post_complete.nx nx_crew_live_verify.nx

diagram shows first 10 each side; +1 more imports, +0 more importers in the complete lists below.

imports: nx_syscalls.nxnx_itoa_lib.nxnx_x509_trust_store.nxnx_trust_store_load_from_certdata.nxnx_tls13_client_validate_certificate.nxnx_tls13_client_session_run.nxnx_https_url_for_fetch.nxnx_https_url_connect.nxnx_https_get_complete.nxnx_https_post_complete.nxnx_http_response_parse.nx

imported by: nobody (leaf or entry point)

structs

none

consts

25const K_MAGIC_262144: i64 = 262144
26const K_MAGIC_16384: i64 = 16384
27const K_MAGIC_4096: i64 = 4096
28const K_MAGIC_4095: i64 = 4095
29const K_MAGIC_4194304: i64 = 4194304
30const K_MAGIC_1024: i64 = 1024

functions

32func cv_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 1: cv_check calls 1: sys_write
37func cv_n(v: i64) -> i64 { nxi_out(v); return 0 }
calls 1: nxi_out
38func cv_check(pass: i64, label: *u8, fails: *i64) -> i64
calls 1: cv_w
43func cv_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
called by 3: cv_findcv_num_aftercv_true_after
44func cv_cat(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){dst[off+i]=s[i]; i=i+1} return off+i }
46func cv_cat2(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ if s[i]==(39 as u8) { dst[off+i]=34 as u8 } else { dst[off+i]=s[i] } i=i+1 } return off+i }
47func cv_catb(dst: *u8, off: i64, src: *u8, n: i64) -> i64 { var i: i64=0; while i<n { dst[off+i]=src[i]; i=i+1 } return off+n }
48func cv_catnum(dst: *u8, off: i64, v: i64) -> i64
calls 1: sys_mmap
59func cv_find(buf: *u8, n: i64, needle: *u8) -> i64
called by 3: cv_hascv_num_aftercv_true_after calls 1: cv_slen
72func cv_has(buf: *u8, n: i64, needle: *u8) -> i64 { if cv_find(buf,n,needle)>=0 { return 1 } return 0 }
calls 1: cv_find
74func cv_num_after(buf: *u8, n: i64, label: *u8, win: i64) -> i64
calls 2: cv_findcv_slen
85func cv_true_after(buf: *u8, n: i64, label: *u8, win: i64) -> i64
calls 2: cv_findcv_slen
98func cv_fetch(store: *TrustStore, is_post: i64, path: *u8, plen: i64, body: *u8, blen: i64, cap_tok: *u8,
157func main(argc: i64, argv: *i64) -> i64