nx_sign_ceremony_lib.nx source
↩ module page · 46 lines · 2082 B
1// nx_sign_ceremony_lib.nx -- Nishi Sign CEREMONY (F504): the signing WORKFLOW over the
2// tamper-evident core. UETA/ESIGN by construction: a signer CANNOT sign without consent
3// (intent to sign + consent to transact electronically); attribution = signer in the
4// hash-chained event; retention = immutable seg_store; completion = sealed certificate
5// (CID over env+doc+signers+audit_head). Composes nx_sign_envelope_lib (the chain).
6// LIB (no main). license_tier: ORIGINAL
7
8import "nx_sign_envelope_lib.nx"
9
10// UETA consent gate: exactly "yes" == affirmative consent+intent.
11func sc_consent_ok(c: *u8) -> i64 {
12 if c[0] == 121 as u8 { if c[1] == 101 as u8 { if c[2] == 115 as u8 { if c[3] == (0 as u8) { return 1 } } } }
13 return 0
14}
15
16// sign: consent-GATED. On consent, chain the signing event -> new audit head; return 1.
17// Refused (no consent) -> 0, head untouched (UETA: no intent, no signature).
18func sc_sign(eid: *u8, seq: i64, name: *u8, ts: i64, consent: *u8, prev: *u8, out_head: *u8) -> i64 {
19 if sc_consent_ok(consent) == 0 { return 0 }
20 let ev: *u8 = sys_mmap(SE_EVT_CAP)
21 let el: i64 = se_event_encode(eid, seq, name, "signed" as *u8, ts, ev)
22 se_chain(prev, ev, el, out_head)
23 return 1
24}
25
26// completion certificate: canonical {audit_head, doc, env, signers, status} -> out; len.
27func sc_cert(eid: *u8, doc_cid: *u8, nsigned: *u8, head_hex: *u8, out: *u8) -> i64 {
28 let k: *i64 = sys_mmap(8 * 5) as *i64
29 let v: *i64 = sys_mmap(8 * 5) as *i64
30 k[0] = ("env" as *u8) as i64
31 v[0] = eid as i64
32 k[1] = ("doc" as *u8) as i64
33 v[1] = doc_cid as i64
34 k[2] = ("signers" as *u8) as i64
35 v[2] = nsigned as i64
36 k[3] = ("status" as *u8) as i64
37 v[3] = ("completed" as *u8) as i64
38 k[4] = ("audit_head" as *u8) as i64
39 v[4] = head_hex as i64
40 return canon_encode(k, v, 5, out)
41}
42
43// persist the completion cert under "cert:<eid>" (immutable retention).
44func sc_cert_put(prefix: *u8, eid: *u8, cert: *u8, certlen: i64) -> i64 {
45 return reg_put(prefix, "cert:" as *u8, "cert:__idx__" as *u8, eid, cert, certlen)
46}