code wiki / _hdl_build / nx_bip39_register.nx
`nx_bip39_register.nx` source

1// nx_bip39_register.nx -- registers V-MODAUTH-3 (BIP39 recovery) = the sealed 5-fn auth API COMPLETE.
2// ENGINEER evidence = both gates REBUILT + rerun here (prove-all):
3//   nx_bip39_kat         11 official trezor vectors byte-exact + rejections
4//   nx_modauth_e2e_gate  14/14 incl. recover/rotate rows
5// Atomic alloc via the Librarian. license_tier: ORIGINAL
6import "nx_cap_register.nx"
7import "nx_capreg_librarian.nx"
8import "nx_syscalls.nx"
9
10func bkr_build_run(name: *u8) -> i64 {
11    let pid: i64 = sys_fork()
12    if pid == 0 {
13        let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
14        if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
15        let argv: *i64 = sys_mmap(32) as *i64
16        argv[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64
17        argv[1] = name as i64
18        argv[2] = 0
19        let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
20        sys_execve("_offc/nx_sov_build_run.elf" as *u8, argv, envp); sys_exit(127)
21    }
22    let st: *i64 = sys_mmap(16) as *i64
23    sys_wait4(pid, st, 0)
24    return st[0]
25}
26
27func main() -> i64 {
28    var allok: i64 = 1
29    if bkr_build_run("nx_bip39_kat" as *u8) != 0 { allok = 0; cr_w(1, "RED nx_bip39_kat\n" as *u8) }
30    if bkr_build_run("nx_modauth_e2e_gate" as *u8) != 0 { allok = 0; cr_w(1, "RED nx_modauth_e2e_gate\n" as *u8) }
31    cr_w(1, "ENGINEER: BIP39+recover 2-gate rebuild+rerun pass=" as *u8); cr_wn(1, allok); cr_w(1, "\n" as *u8)
32    let eng: i64 = ig_engineer(1, 1, 1, allok)
33    let dec: i64 = ig_decision(eng, ig_council(eng, 1, 1, 2), 1)
34    if dec != IG_INGEST { cr_w(1, "HELD\n" as *u8); sys_exit(1) }
35    if cr_can_register(5, 2, 6, dec) != 1 { cr_w(1, "REFUSED\n" as *u8); sys_exit(1) }
36    let lp: *u8 = "/tmp/nishi_cap_registry.log" as *u8
37    let jp: *u8 = "knowledge/status/cap_registry_durable.log" as *u8
38    let idx: i64 = cl_next_idx(lp, jp)
39    let ok: i64 = cl_register_dual(lp, jp, idx, 2, 2, "SEC BIP39-RECOVERY (V-MODAUTH-3; the sealed 5-fn modern-auth API now COMPLETE: register/login/validate/refresh/RECOVER all implemented + gated). hub/nx_bip39 entropy<->mnemonic (ENT 128..256, checksum verify; wordlist module GENERATED from canonical bitcoin/bips english.txt sha256=2f5eed53.. verified at staging, 64x32-word parser-safe chunks) GATED vs the standard's own trezor vectors: 11 vectors (8x24-word + 3x12-word) BYTE-EXACT both directions + swapped-word=BAD_CHECKSUM + alien-word + bad-count + CSPRNG round trip. EXCEEDS charter section-6 sketch: mnemonic entropy = a SECOND OPAQUE credential under handle||rec (KSF=Identity by design: 256-bit CSPRNG entropy has no dictionary) so recovery ALSO stores nothing offline-crackable (charter sketched a recovery_hash = weaker). nx_modern_auth_register issues 24 words when allow_recovery=1; nx_modern_auth_recover decodes (typo=checksum fail, store untouched) -> full OPAQUE-3DH verify vs rec record -> sets new passphrase + ROTATES mnemonic (old pw + old mnemonic both die, additive latest-wins). mauth refactored to shared cores _ma_register_credential/_ma_verify_credential (register/login/recover compose them; no copy-paste flows). GATE nx_modauth_e2e_gate extended 10->14 rows ALL GREEN (recover/rotate/old-mnemonic-dead/typo-mismatch); wiki live gate 8/8 + OPAQUE RFC KAT regression GREEN post-refactor. Composes CAPREG342/343")
40    if ok != 1 { cr_w(1, "DUAL-WRITE FAILED\n" as *u8); sys_exit(1) }
41    cr_w(1, "CAPREG idx=" as *u8); cr_wn(1, idx); cr_w(1, " REGISTERED (BIP39 recovery, auth API complete)\n" as *u8)
42    sys_exit(0)
43    return 0
44}
nx_bip39_register.nx source

`nx_bip39_register.nx` source
