nx_evattest.nx

nx_evattest.nx -- SIGNED EVIDENCE ATTESTATIONS, shared. Closes seq1367: the human leg of the evidence law was a plain-text row, so anything that could write knowledge/status/ could mint a human sign-off and drive a domain to PROVEN. The `require_human` clause exists precisely so an automated actor cannot certify its own work; an unsigned carrier let exactly that happen through the back door. (Named nx_evattest, not nx_attest: runtime/nx_attest.nx already exists and is a different organ -- an append-only Merkle log for privileged operations. Check before you name.) ★★WHAT SIGNING HONESTLY BUYS, AND WHAT IT DOES NOT. It does NOT create an absolute barrier against an agent that can read the filesystem -- a private key on disk is readable by anything with disk access, and pretending otherwise would be exactly the comfortable fiction this workstream exists to delete. What it DOES buy, all of it real: * ATTRIBUTION -- every attestation names the key that made it, verifiably. * TAMPER-EVIDENCE -- a row cannot be edited afterwards without invalidating its signature. * ROLE SEPARATION -- the structural one: a human-class row signed by a key REGISTERED AS A MACHINE KEY is REFUSED. The automation signing a human attestation is not merely discouraged, it is mechanically rejected, and forging one requires a key the automation is not supposed to hold. * AUDITABILITY -- if a human row ever were signed by the wrong key, that is provable afterwards. This library contains NO key generation and NO signing path. It verifies, and it refuses. Minting a human attestation is an act the operator performs with a key the operator holds -- that is the whole clause. ROW FORMAT (one attestation per line, knowledge/status/evclass_<domain>.conf): class=human verdict=pass scope=<what was examined> signer=<who> epoch=<ts> pub=<64hex> sig=<128hex> The signature covers the CLAIM PREFIX: every byte of the row up to (and excluding) " pub=". So class, verdict, scope, signer and epoch are all immutable under the signature -- a signed attestation cannot be re-pointed at a different class, claim, or time. The key and signature themselves sit outside the signed region, so a signer need not predict the encoding of its own key. KEY REGISTRY (knowledge/attest_keys.conf): role=human|llm|machine pub=<64hex> name=<who> An unregistered key verifies cryptographically but is still REFUSED: a valid signature from a stranger is not an authorisation. license_tier: ORIGINAL