code wiki / (root) / nx_mtls_census.nx

nx_mtls_census.nx

buildroot/runtime/nx_mtls_census.nx

14173 B120 linesdepth 2pulls 2 transitivereach 0 importersview sourcekind tooltopic mtls

docs dependencies structs consts functions

about

nx_mtls_census.nx -- the MEASURED scoreboard for the mTLS (CLIENT-CERTIFICATE) no-cookie session carrier. Operator 2026-06-22: "we dont use cookies and other stuff we use opaque like it says." The login bug ("logs in but isn't let in") is that a top-level browser NAVIGATION carries no X-Nishi-Session header, so the OPAQUE wall bounces to login. The chosen NO-COOKIE fix is a CLIENT CERTIFICATE bound to the OPAQUE export_key: the browser presents it at the TLS layer on EVERY connection (navs, refresh, new tab) -- zero cookie, zero header, zero auth-carrier JS. This census grades the LIVE sovereign TLS/X.509 stack against that goal, NEVER self-scored: each cell is PROVEN by reading the REAL organ on disk (PRESENT requires the implementing symbol to EXIST; a GAP requires its rung-output file to NOT exist = honest worklist). Liar- killed: the foundation must really be on disk, a neg-control symbol must read ABSENT, research-grounded. FOUNDATION axes (already built -> compose) ..... MC1..MC8 EXECUTION GAPS (the worklist, 7 build rungs) .... GAP1..GAP7 Run: ./_offc/nx_sov_build_run.elf nx_mtls_census expect_exit: 0 license_tier: ORIGINAL

dependencies 1 imports · 0 importers

imports: nx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

15	const K_MAGIC_262144: i64 = 262144

functions

17	func lc_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } called by 3: lc_n lc_cell main calls 1: sys_write
18	func lc_n(v: i64) -> i64 called by 1: main calls 3: lc_w sys_mmap sys_write
24	func lc_read(path: u8, buf: u8, cap: i64) -> i64 called by 1: lc_file_has calls 3: sys_openat_rd sys_read sys_close
30	func lc_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 } called by 1: main calls 2: sys_openat_rd sys_close
31	func lc_has(buf: u8, n: i64, needle: u8) -> i64 called by 1: lc_file_has
38	func lc_file_has(path: u8, needle: u8, buf: *u8, cap: i64) -> i64 called by 1: main calls 2: lc_read lc_has
42	func lc_cell(cls: u8, id: u8, txt: *u8) -> i64 { lc_w(" ["); lc_w(cls); lc_w("] "); lc_w(id); lc_w(" "); lc_w(txt); lc_w("\n"); return 0 } called by 1: main calls 1: lc_w
44	func main() -> i64 calls 7: lc_w sys_mmap lc_file_has lc_exists lc_n lc_cell+1