nx_modauth_arm.nx

nx_modauth_arm.nx -- PROVISION an admin into the canonical Modern Auth (the arming step that makes "all sites use modern_auth" deployable). File-driven by construction so the operator's passphrase NEVER touches chat / argv / stdout: it is read from a STAGED file, used to register the admin, and the one-time BIP39 24-word recovery mnemonic is written to an out-file for the operator to save then DELETE (it is never echoed). Idempotent: re-running supersedes the admin (additive-only store -- old passphrase dies, new lives; rows 8-9 of nx_modauth_e2e_gate prove this). ONE server-key bundle + ONE store serve every realm; realm+handle decide WHICH site+admin (a status token can't validate a wiki ctx -- realm-scoped hash). argv: [1]=keysfile [2]=storefile [3]=realm [4]=handle [5]=passphrase-file [6]=mnemonic-outfile e.g. nx_modauth_arm /vault/nishi_auth_keys /vault/nishi_auth_store nishi_status_adm elder /tmp/pw /tmp/mn Sovereign: nx_modern_auth_flow + nx_syscalls (no gcc, no 3rd-party). license_tier: ORIGINAL