nx_inventory_serve.nx

nx_inventory_serve.nx -- nishifamily.com/inventory : paste a storefront URL, get a LIVING CHECKLIST of what in it you already own. REBUILT 2026-08-07 TO MATCH THE KNOWN GOOD (nx_status_daemon), after the first cut shipped three defects the template would have prevented outright: 1. it bound INADDR_ANY, so an UNAUTHENTICATED, SSRF-capable fetcher answered from another host on the LAN the instant it started (measured, then killed). Now: nx_http_server_addr_loopback. 2. it had NO AUTH, and I intended to route it with proxy mode=gated believing that WAS the login gate. It is not -- `gated` means fail-closed 302 when the BACKEND IS DOWN. Site auth is nx_sa_validate over X-Nishi-Session, NO cookies (charter C1). Now every route but /health is validated, so an unauthenticated request cannot make this daemon fetch anything. 3. its handler was welded to a socket, so the only way to test it was curl from a shell script -- the exact break-glass shape rule 29 forbids. Now the router is a PURE FUNCTION iv_handle(ctx, req, req_n, ...) -> out_n, so a NishiLang gate drives it IN-PROCESS. THIN BY DESIGN. It orchestrates two binaries already proven rather than reimplementing them: 1. ./nx_https_get_cli2.elf <url> -- the sovereign TLS-1.3 client (own trust store) 2. ./nx_ownlib.elf scan <file> -- the ledger diff, selftest 19/19, match key included The match key (ol_norm) is the correctness-critical part, and a daemon holding its own copy is how two components drift into disagreeing about what "the same game" is. So the daemon owns NO matching logic -- it owns a socket, an auth check, and an HTML wrapper. SSRF: this fetches an operator-supplied URL from INSIDE the estate, where mgmt (:18098) and the tools daemon (:18096) sit on loopback. Auth alone is NOT sufficient -- it only means the attacker must be logged in. So the guard is structural and runs before any socket: https only; loopback/private/ link-local refused by construction. nx_inventory_serve <port> <keysfile> <storefile> <realm> <budget> license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0