nx_reg_sign.nx

nx_reg_sign.nx -- SOVEREIGN registry integrity tool (operator directive 2026-07-16, the security debt the maturity census SURFACED: "daemons.reg is owner-writable plain file -> local write grants revive-exec"). Signs / verifies a registry file with HMAC-SHA256 keyed by the machine-bound secret, so the daemon supervisor can REFUSE to apply a registry that was changed without going through the signer. HONEST SCOPE (stated, not oversold -- this session's whole ethic): this is TAMPER-EVIDENCE + FAIL-SAFE integrity, NOT prevention against a same-uid attacker who can read the 0600 key. What it genuinely gives: - a corrupt/truncated/partial-written registry FAILS verify -> supervisor holds last-good (never-brick) - a different-uid or remote-dropped registry can't be validly signed (they can't read the 0600 key) - ANY change to daemons.reg without re-signing is CAUGHT + surfaced (SECURITY event on /status) within one supervisor cycle -> silent revive-exec injection becomes impossible; it is seen + held. The L3 rung (root-held ed25519 asymmetric key so even the same uid as the supervisor can't forge) is the stated next step; signing is a DELIBERATE act (not auto-run), so an un-re-signed change genuinely means "changed outside the signer" = the threat. usage: nx_reg_sign sign <reg-path> <key-path> -> writes <reg-path>.sig (64 hex chars), exit 0 nx_reg_sign verify <reg-path> <key-path> -> exit 0 match · 3 mismatch · 4 sig-absent · 5 reg-unreadable · 2 usage license_tier: ORIGINAL module: nishi-core.ops.reg_sign