code wiki / _hdl_build / nx_secret_selfmanage_register.nx
`nx_secret_selfmanage_register.nx` source

1// nx_secret_selfmanage_register.nx -- registers the SECRET SELF-MANAGEMENT organ via the
2// Librarian. ENGINEER evidence = nx_secret_scan_gate (5 KATs + production posture scan +
3// idempotent SENTINEL-RESOLVE + sentinel refresh) RE-RUN here -- no stale grades. On pass,
4// dual-writes the capability via cl_next_idx (atomic idx allocation).
5// license_tier: ORIGINAL
6import "nx_cap_register.nx"
7import "nx_capreg_librarian.nx"
8import "nx_syscalls.nx"
9
10func ssr_run(path: *u8) -> i64 {
11    let pid: i64 = sys_fork()
12    if pid == 0 {
13        let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
14        if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
15        let argv: *i64 = sys_mmap(32) as *i64; argv[0] = path as i64; argv[1] = 0
16        let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
17        sys_execve(path, argv, envp); sys_exit(127)
18    }
19    let st: *i64 = sys_mmap(16) as *i64
20    sys_wait4(pid, st, 0)
21    return st[0]
22}
23
24func main() -> i64 {
25    var allok: i64 = 1
26    if ssr_run("_offc/nx_secret_scan_gate.elf" as *u8) != 0 { allok = 0 }
27    cr_w(1, "ENGINEER: secret_scan_gate (5 KATs + prod posture + resolve + sentinel) pass=" as *u8); cr_wn(1, allok); cr_w(1, "\n" as *u8)
28    let eng: i64 = ig_engineer(1, 1, 1, allok)
29    let dec: i64 = ig_decision(eng, ig_council(eng, 1, 1, 2), 1)
30    if dec != IG_INGEST { cr_w(1, "HELD\n" as *u8); sys_exit(1) }
31    if cr_can_register(5, 2, 6, dec) != 1 { cr_w(1, "REFUSED\n" as *u8); sys_exit(1) }
32    let lp: *u8 = "/tmp/nishi_cap_registry.log" as *u8
33    let jp: *u8 = "knowledge/status/cap_registry_durable.log" as *u8
34    let idx: i64 = cl_next_idx(lp, jp)
35    let ok: i64 = cl_register_dual(lp, jp, idx, 5,
36        2, "GEN SECRET SELF-MANAGEMENT organ (security arc rung 3, after vault KDF v2 + Sentinel WATCH): nx_secret_scan (sovereign plaintext-credential detector -- data-driven pattern table PW/PASSWORD-quote (runtime-assembled, no self-match) + sshpass + PRIVATE-KEY, data-driven root table repo/bench-ops/_hdl_build/_offc depth-1, binary-sniff skip, EMPTY-literal intelligence: the PW-shred idiom is hygiene not a leak; findings -> ISSUE PLAINTEXT-SECRET lines into issues_durable.log) + sentinel row 5 PLAINTEXT-SECRET thr=1 (DETECT->WATCH->PM-ESCALATION loop) + nx_secret_scan_gate (5 KATs: clean-green, plant-red, plant-named-in-issues, returns-to-green, empty-literal-green; alt issues log so plants never pollute the prod signal stream; then PROD posture scan + IDEMPOTENT SENTINEL-RESOLVE append (count>mark only) + sentinel refresh) wired as Conductor pulse step (13/13 green). DEBT PAID: 18 deploy/diag scripts (17 known + _nv1_validate_ship caught LIVE mid-session by the new scanner as the concurrent session created it) migrated PW-literal -> _offc/nx_secret_cli.elf get nas (argon2id KDF v2 vault); secret stack made durable (/tmp-wipe immune): nx_machine_key + nx_secret_cli + nx_ssh_cmd sovereign-built into _offc, secret_cli exec path fixed /tmp->_offc; live verify _read_log fetched vault pw and tailed the NAS daemon log over own-SSH. Loop proven END-TO-END twice: scan RED 17 findings -> sentinel ESCALATE count=34 -> PM row -> migrate -> scan GREEN -> gate-green resolve at=36 -> sentinel QUIET; and live re-detection of a reintroduced literal (count 35->36 ESCALATE) healed same-session. Composes vault arc (commit 3cdeaca4)" as *u8)
37    if ok != 1 { cr_w(1, "DUAL-WRITE FAILED\n" as *u8); sys_exit(1) }
38    cr_w(1, "CAPREG idx=" as *u8); cr_wn(1, idx); cr_w(1, " REGISTERED (secret self-management organ)\n" as *u8)
39    sys_exit(0)
40    return 0
41}
nx_secret_selfmanage_register.nx source

`nx_secret_selfmanage_register.nx` source
