nx_pkg.nx

nx_pkg.nx -- THE SOVEREIGN CONTENT-ADDRESSED PACKAGE LANE (LR3 of /compare/lang), carrying the original dependency-resolution self-test it grew from (verb `selftest`, still the NO-ARG DEFAULT so no existing caller loses behaviour). WHY THIS EXISTS. The 2025 registry worms self-replicated across 500+ npm packages by exploiting exactly two assumptions: install-time code execution, and blind trust that a NAME resolves to whatever `latest` happens to be. Go answered with a module proxy, a signed transparency log (sumdb), and no install scripts. This lane does not GUARD that attack surface, it REMOVES it: THE IDENTITY OF A MODULE IS THE HASH OF ITS BYTES. There is no version negotiation, so there is no `latest` to poison. The resolve primitive takes a digest, not a name, so there is nothing to squat. And resolution never interprets, forks or executes one byte of module content -- it reads, verifies, and writes. THE ONE LAW: THE STORE PATH IS A HINT, THE HASH IS THE IDENTITY. A blob at <store>/<digest> is RE-HASHED on every resolve and REFUSED if it does not hash to the digest that was asked for. An attacker who can write the store cannot make it serve different bytes; the most they achieve is a named, loud refusal. EXTENDS THE ESTATE'S EXISTING CONTENT-ADDRESSING, DOES NOT ADD A SECOND ONE: sha256_digest (nx_sha256.nx) -- the same digest nx_filehash / nx_closurehash / nx_content_put use sys_read_file (nx_syscalls.nx) -- sizes its buffer from the file, so a module CANNOT short-read lcf_* (nx_lineconf_lib.nx) -- line-anchored conf, LCF_MISS -> REFUSE, never a silent default There is no new hash, no new store format, no second ruler. VERBS (every path and policy value comes from a conf file; an absent key REFUSES, it never defaults): nx_pkg cas_put <file> [conf] -> address a file by content; prints its digest nx_pkg cas_resolve <digest64> <dest> [conf] -> THE CONTRACT PRIMITIVE (pkg_cas_resolve) nx_pkg pin <name> <digest64> [conf] -> bind a logical name to a digest (THE TRUST BOUNDARY) nx_pkg resolve <name> <dest> [conf] -> exact-match pinned name -> digest -> cas_resolve nx_pkg logverify [conf] -> walk the hash-chained transparency journal nx_pkg selftest -> the original dep-resolution teeth (T1..T4) An UNRECOGNISED verb prints usage and exits 3. It never falls through to a permissive default -- the route-mode defect (an unknown token silently selecting the permissive branch) is live in this estate today and this is the one place it must not be repeated. WHAT THE TRANSPARENCY JOURNAL PROVES, STATED HONESTLY. Every put/resolve appends <seq>|<op>|<digest>|<bytes>|<prev_chain>|<chain> with chain = sha256(prev|digest|bytes) so a retroactive edit to any past row breaks every chain link after it, and an append REFUSES on a broken chain rather than extending it. That is TAMPER-EVIDENCE against an editor who does not rewrite the whole file. It is NOT Go's sumdb: there is one writer, no signature, no gossiped tree head and no inclusion proofs, so an attacker holding write access to the entire journal can recompute it from