nx_game_manifest.nx

nx_game_manifest.nx -- sovereign game-update manifest generator (Steam depot-manifest / itch wharf equivalent, sovereign). Reads content/games.versions, hashes each game's served wasm with SHA-256 (FIPS 180-4, inlined from the canonical nx_sha256.nx -- the crypto organs import the RV64 nx_syscalls.nx which collides with the x86_64 file-I/O layer, so we inline the pure core; see [[nishi-serving-syscall-dup-gotcha]]), and emits: dist/api/games.json -- the registry (all games + latest + hash) dist/api/games/<id>.json -- per-game manifest (versions + channels + per-version sha256 + bytes + changelog) The in-browser auto-update client (/assets/nx-update.js) channels off these. SHA-256 already EXCEEDS Steam's SHA-1 depot hashes; Ed25519 signing is the next exceed rung. A known-answer test (sha256("abc")) runs first -- a wrong hash aborts rather than publishing bad integrity. Build: ./nxc2.exe --target x86_64 runtime/nx_game_manifest.nx > /tmp/gm.s wsl bash -c "gcc -no-pie /tmp/gm.s -o /tmp/nx_game_manifest" Run: cd nishi-pages && mkdir -p dist/api/games && /tmp/nx_game_manifest nx_capability_claims: needs: [x86_64_syscalls, sha256_fips_180_4] provides: [game_update_manifest, content_hash_integrity, version_channels, publish_registry] safety: [sha256_KAT_gated, no_floating_point, json_escape_changelog] verdict: [exit_0_ok, exit_9x_KAT_fail] license: ORIGINAL (sha256 core: INDEPENDENT_REDERIVE nx_sha256.nx) kind: nishi_pages_specialist layer: L4 (crypto-integrity over L1 syscalls) raci: [R=nishi_pages_builder, A=elder_west, C=nx_sha256_owner, I=conductor]