nx_status_daemon.nx

nx_status_daemon.nx -- THE ACCESS WALL for nishifamily.com/status, on the CANONICAL Modern Auth (the SINGLE ecosystem-wide auth: OPAQUE-3DH + Argon2id KSF + BIP39 recovery + NO-COOKIE Ed25519 session). Operator 2026-06-16: "lets have that be how all the sites work." Composes the ONE shared gate (nx_sa_validate) -- no bespoke crypto, no cookies (the prior cms_pw + Set-Cookie build violated the charter's C1 no-cookie cardinal and is gone). A loopback HTTP daemon the sites daemon reverse-proxies to. The router is a PURE FUNCTION sd_handle(ctx, req_bytes, n, statusfile, out) -> out_n -- request bytes in, response bytes out, no socket. The socket loop is a thin shell over it; the gate drives it IN-PROCESS (sovereign Nishi test, no curl/shell). Routes: POST /status/login -> handle=<h>&passphrase=<p> (url-decoded) -> nx_modern_auth_login -> 200 {"token":"<base64 152B>"} | 401 {"error":"unauthorized"} (same for wrong-pw / unknown-handle: client-enumeration defense) GET /status/content -> X-Nishi-Session header validates (nx_sa_validate) ? serve <statusfile> : 401 GET /status (+ any) -> the no-cookie SPA shell: login form + fetch() that stores the token in sessionStorage and sends it as X-Nishi-Session (NEVER a cookie) Context armed at startup via nx_uas_server_keys_load_or_init + nx_auth_context_init; the admin is provisioned out-of-band by nx_modauth_arm (this daemon never registers). argv: [1]=port [2]=keysfile [3]=storefile [4]=realm [5]=statusfile [6]=request-budget. Sovereign: nx_site_auth + nx_modern_auth_flow + nx_http_server + nx_base64 + nx_syscalls. license_tier: ORIGINAL