nx_email_tool_register.nx source
↩ module page · 62 lines · 6024 B
1// nx_email_tool_register.nx -- register the EMAIL PROVISIONING PLANE into the sovereign tool registry
2// (operator 2026-07-09: "get all of this working and on our mcp api type stuff so we can deploy new emails
3// easily on these domains and allow the admin of those sites to do the same"). The registry IS what
4// nishifamily.com/api/tools + /mcp tools/list serve, so registration = DISCOVERABILITY. Mirrors
5// nx_compare_tool_register: DISCOVERY here; execution stays fail-closed in tool_allowlist.conf rows
6// (domain-PINNED args = the per-site-admin delegation boundary) + per-admin capability tokens.
7// Writes the CWD registry (knowledge/toolreg-); run ON THE NAS (CWD nishihost) to flip the live surface.
8// Idempotent (reg_put additive). Verifies by READBACK, not claim. expect_exit: 0 license_tier: ORIGINAL
9import "nx_tool_registry.nx"
10
11func er_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
12func er_putn(v: i64) -> i64 {
13 if v == 0 { sys_write(1, "0" as *u8, 1); return 0 }
14 var m: i64 = v
15 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
16 let d: *u8 = sys_mmap(24); var k: i64 = 0
17 while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
18 let o: *u8 = sys_mmap(24); var i: i64 = 0
19 while i < k { o[i] = d[k - 1 - i]; i = i + 1 }
20 sys_write(1, o, k)
21 return 0
22}
23func er_reg1(name: *u8, desc: *u8, invoke: *u8, status: *u8) -> i64 {
24 let w: i64 = tool_register(name, desc, invoke, status)
25 let p: *i64 = sys_mmap(8) as *i64
26 let l: *i64 = sys_mmap(8) as *i64
27 let g: i64 = tool_get(name, p, l)
28 er_puts(" " as *u8); er_puts(name); er_puts(" put-rc=" as *u8); er_putn(w); er_puts(" readback=" as *u8)
29 if g == 1 { if l[0] > 0 { er_puts("OK len=" as *u8); er_putn(l[0]); er_puts("\n" as *u8); return 1 } }
30 er_puts("MISSING -- REGISTER FAILED\n" as *u8)
31 return 0
32}
33
34func main() -> i64 {
35 er_puts("=== nx_email_tool_register -- email provisioning plane into the discovery registry (knowledge/toolreg-) ===\n" as *u8)
36 var ok: i64 = 0
37 ok = ok + er_reg1("nx_email_invite_aw" as *u8,
38 "mint ONE mailbox invite for @andelinwest.com. Creating a new email address = call this, hand the invite code to the person; they self-register at https://mail.andelinwest.com choosing their OWN passphrase (OPAQUE -- no admin ever sees or sets user secrets). Invite is realm-bound, single-use, 7-day expiry. This tool is the per-site-admin delegation seam: its allowlist row PINS store+realm+level+ttl server-side, so a cap granting it can only ever mint for andelinwest.com." as *u8,
39 "tools/call nx_email_invite_aw (argv IGNORED -- pinned: andelinwest_mail_store.invites andelinwest_mail level=1 ttl=604800) -> INVITE token=<64-hex>" as *u8,
40 "gate-GREEN 5/5 2026-07-09 (mint/accept/realm-bind/single-use/expiry vs the portal's own inv_check path)" as *u8)
41 ok = ok + er_reg1("nx_email_invite_jw" as *u8,
42 "mint ONE mailbox invite for @jasonewest.com (same delegation seam as _aw: pinned store+realm; cap-scoped per site admin). NOTE: the mail.jasonewest.com portal instance is a PENDING rung -- invites mint fine and become redeemable the moment that portal deploys." as *u8,
43 "tools/call nx_email_invite_jw (argv IGNORED -- pinned: jasonewest_mail_store.invites jasonewest_mail level=1 ttl=604800) -> INVITE token=<64-hex>" as *u8,
44 "gate-GREEN 5/5 2026-07-09; PORTAL-PENDING (mail.jasonewest.com daemon instance not yet deployed)" as *u8)
45 ok = ok + er_reg1("nx_email_provision_aw" as *u8,
46 "provision (or idempotently RE-provision) andelinwest.com email at the domain level: reuse-or-create the ed25519 DKIM keypair ON THIS HOST (key never transits) + emit the publishable DNS zone (MX/SPF/DKIM/DMARC, selector nishi1) + persist artifacts knowledge/status/andelinwest.com_{dns_zone.txt,dkim_priv.bin}. Re-running REUSES the key so a published DKIM record stays valid." as *u8,
47 "tools/call nx_email_provision_aw (argv IGNORED -- pinned: andelinwest.com mail.andelinwest.com 75.28.18.94 nishi1) -> prints the publishable zone" as *u8,
48 "gate-GREEN 4/4 2026-06-28 (DKIM roundtrip / zone structure / MTA accept-own-refuse-relay / DKIM e2e)" as *u8)
49 ok = ok + er_reg1("nx_email_provision_jw" as *u8,
50 "provision jasonewest.com email at the domain level (same generator as _aw, domain-pinned): ed25519 DKIM keypair + publishable MX/SPF/DKIM/DMARC zone + on-host artifacts. The zone is what the operator pastes into Porkbun DNS." as *u8,
51 "tools/call nx_email_provision_jw (argv IGNORED -- pinned: jasonewest.com mail.jasonewest.com 75.28.18.94 nishi1) -> prints the publishable zone" as *u8,
52 "gate-GREEN 4/4 (per-domain data-driven; same lib as _aw)" as *u8)
53 ok = ok + er_reg1("nx_smtp_probe" as *u8,
54 "sovereign outbound-SMTP reachability probe: resolve real Gmail MXes, TCP-connect :25, read the 220 banner (10s timeouts, never hangs) vs :587/:465 controls. THE empirical gate for full self-hosted MX -- run it from the mail host's uplink; verdict OPEN means direct-to-MX delivery is possible, BLOCKED means the ISP filters port 25 (get it unblocked or move the MTA edge)." as *u8,
55 "tools/call nx_smtp_probe (no args = Gmail MX battery; or argv [host, port]) -> per-target lines + SMTP-PROBE verdict; appends knowledge/status/smtp_probe.log" as *u8,
56 "gate-run 2026-07-09 from the dev uplink: port25_open=0 controls_reachable=1 verdict=BLOCKED (AT&T port-25 filter measured, both directions)" as *u8)
57 er_puts("registered+readback " as *u8); er_putn(ok); er_puts(" / 5\n" as *u8)
58 er_puts("NOTE: run on the NAS (CWD nishihost) to flip the LIVE registry. Execution = tool_allowlist.conf rows (pinned) + caps -- fail-closed, separate by design.\n" as *u8)
59 if ok == 5 { er_puts("verdict=GREEN (email provisioning plane discoverable in the sovereign tool surface)\n" as *u8); sys_exit(0); return 0 }
60 er_puts("verdict=RED\n" as *u8)
61 sys_exit(1); return 1
62}