code wiki / _hdl_build / nx_vault_lease.nx
nx_vault_lease.nx
buildroot/runtime/_hdl_build/nx_vault_lease.nx
about
nx_vault_lease.nx -- sovereign LEASE / TTL / auto-expiry (HashiCorp Vault "leasing" gap from
vault_capability_census.tsv). Every issued secret carries a lease: issued_at + ttl, capped by a hard
max_ttl, renewable, revocable. Time-bound access with auto-expiry is what BOUNDS the blast radius when a
secret leaks -- a stolen lease dies on its own. Pure deterministic logic: "now" is INJECTED, never
wall-clock (correct for a gate AND for replay). license_tier: ORIGINAL
dependencies 1 imports · 5 importers
imports: nx_syscalls.nx
imported by: nx_vault_auth.nxnx_vault_dynamic.nxnx_vault_lease_test.nxnx_vault_rotation.nxnx_vault_suite_test.nx
structs
| none |
consts
| 8 | const LEASE_OK: i64 = 1 |
| 9 | const LEASE_EXPIRED: i64 = 0 |
| 10 | const LEASE_REVOKED: i64 = 0 - 1 |
functions
| 13 | func lease_valid(now: i64, issued_at: i64, ttl: i64, revoked: i64) -> i64 |
| 20 | func lease_remaining(now: i64, issued_at: i64, ttl: i64, revoked: i64) -> i64 |
| 28 | func lease_renew_expiry(now: i64, issued_at: i64, ttl: i64, max_ttl: i64) -> i64 called by 1: main |
| 36 | func lease_state(now: i64, issued_at: i64, ttl: i64, revoked: i64) -> i64 called by 1: main |