code wiki / _hdl_build / nx_devcap_provision.nx
nx_devcap_provision.nx
buildroot/runtime/_hdl_build/nx_devcap_provision.nx
about
nx_devcap_provision.nx -- provision the DEV/CI API capability chain, sovereignly (operator 2026-07-02:
"get this all setup as api calls ... build our nishi lang to s class exceed"). Generates the HMAC secret
keyfile (32 random bytes from /dev/urandom, 0600 -- the file nx_dev_api's da_authz loads in prod, and the
file nx_cap_mint signs with), mints a `dev_build` capability valid for ~1 year, writes it to a token file,
and SELF-VERIFIES the full chain (capt_verify(keyfile-secret, minted-token, "dev_build", now) == CAPT_OK)
plus proves ISOLATION (a token minted with the const/dev secret does NOT verify against the keyfile secret).
Idempotent: reuses an existing keyfile so live caps keep verifying. Run once locally, then nx_aw_send the
keyfile to the NAS nishihost dir (0600) and keep the token operator-side (present as X-Nishi-Cap).
writes: dev_cap_secret.key (secret) + dev_cap.tok (an operator dev_build capability)
expect_exit: 0 license_tier: ORIGINAL
dependencies 1 imports · 0 importers
imports: nx_cap_token.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 12 | const DEV_MAGIC_31536000: i64 = 31536000 |
| 13 | const DEV_MAGIC_2048: i64 = 2048 |
| 15 | const KEYFILE: *u8 = "dev_cap_secret.key" as *u8 |
| 16 | const TOKFILE: *u8 = "dev_cap.tok" as *u8 |
| 17 | const DEV_CONST_SECRET: *u8 = "nishi-dev-cap-hmac-secret-v1-REPLACE-FROM-VAULT" as *u8 |
functions
| 19 | func pw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 1: main |
| 20 | func pn(v: i64) -> i64 { let b: *u8=sys_mmap(24); let n: i64=capt_catn(b,0,v); sys_write(1,b,n); return 0 } |
| 23 | func fill_rand(out: *u8, n: i64) -> i64 called by 1: main |
| 32 | func main() -> i64 |