nx_install_attest.nx

nx_install_attest.nx -- defensive primitives around install_hash. Composes nx_install_plan + nx_install_hash with three small utilities that close the human-loop + replay-attestation gap: nx_install_hash_to_hex(digest, out_hex) 32-byte binary digest -> 64 ASCII lowercase hex chars. Human- readable form for logs / audit trails / cross-system transfer. nx_install_hash_from_hex(in_hex, out_digest) Inverse: 64 ASCII hex chars -> 32-byte binary digest. Accepts lowercase a-f, uppercase A-F, and 0-9. Rejects any other byte (including spaces / leading 0x / trailing newlines). Caller is responsible for stripping framing. nx_install_hash_verify_against(plan, expected_digest) Recompute install_hash from plan + compare to expected. Returns NX_ATTEST_VERIFIED on bit-equal, NX_ATTEST_TAMPERED on mismatch, NX_ATTEST_BAD_INPUT on null / canary-stomped plan. This is the replay-attestation loop: "given this attested plan + this attested hash, does the plan still hash to the expected value?" Per [[feedback-end-to-end-bit-traceability-architecture]]: the hex form is what gets written into install_attest.jsonl logs + embedded in audit trails. Binary form stays in memory for internal comparison. V1 scope: - lowercase hex emission ("a..f"); decoder tolerates both cases - exactly NX_INSTALL_HASH_BYTES (32) bytes / 64 hex chars; no length negotiation - no leading "0x" / no separators / no whitespace Deferred per roadmap: - cross-machine attestation (in-toto link metadata with signed install_hash) -- SA-7 remainder - Rekor-class append-only audit log -- SA-7 remainder - Byzantine N-of-M attestation chain (multiple independent compile paths must produce bit-equal install_hash) -- SA-7