nx_evattest_cli.nx

nx_evattest_cli.nx -- the OPERATOR's tool for the human leg of the evidence law. The evidence law requires a human attestation before any domain can read PROVEN, and nx_evattest verifies that attestation cryptographically. This is the other half: how a human actually mints one. ★THIS TOOL EXISTS SO THE OPERATOR CAN SIGN. It is deliberately NOT wired into any automated path, any beat, or any agent workflow. An agent running `sign` against a human-role key would be certifying its own work -- the precise thing require_human forbids -- and the verifier's role check is what makes that forgery detectable rather than merely discouraged. Keep the human key somewhere the automation does not operate, and never register a key the automation holds as role=human. VERBS keygen <keyfile> -- 32 CSPRNG bytes -> keyfile (0600); prints ONLY the public key pub <keyfile> -- print the public key hex for the registry sign <keyfile> <class> <verdict> <scope> <signer> -- print a complete signed attestation row on stdout The signed region is the CLAIM PREFIX (up to " pub="), so class/verdict/scope/signer/epoch are all immutable under the signature. Redirect the row into knowledge/status/evclass_<domain>.conf. license_tier: ORIGINAL expect_exit: 2