code wiki / mgmt
topic: mgmt
24 modules sharing the mgmt name family (derived from the tree's prefix discipline).
The 'mgmt' topic family in the Nishi sovereign ecosystem provides the control-plane infrastructure for managing and securing the system. It includes the nx_mgmt_api, which serves as the primary adapter for the API ring, and nx_mgmt_authz, which handles authorization to close privilege-escalation gaps. The nx_mgmt_client acts as a sovereign client for interacting with the live control-plane API, ensuring secure and measured management across the ecosystem.
auto-narrated by the local model from this topic's module headers; links verified against the wiki index.
narrated overview -- maintained by the narration lane, module links verified against this wiki.
| module | description | lines | funcs |
|---|---|---|---|
| nx_mgmt_api.nx | THE IO / TRANSPORT ring of the sovereign ecosystem control-plane API (the primary adapter). | 3990 | 120 |
| nx_mgmt_api_gate.nx | SOVEREIGN in-process referee for the ecosystem control-plane API. NO socket, NO | 330 | 13 |
| nx_mgmt_authz.nx | the AUTHORIZATION tier of the management plane (closes the documented privilege-escalation: | 75 | 6 |
| nx_mgmt_authz_gate.nx | PURE isolation gate for the management AUTHORIZATION tier (nx_mgmt_authz). | 53 | 7 |
| nx_mgmt_call.nx | the mgmt-API driver forked as an MCP tool. Mints a FRESH admin session from the NAS key bundle | 94 | 4 |
| nx_mgmt_cap_mint_gate.nx | prove POST /api/cap/mint is fail-closed least-authority. In-process referee | 140 | 10 |
| nx_mgmt_census.nx | the MEASURED, HONEST ecosystem-MANAGEMENT scorecard vs the June-2026 SOTA (operator: | 104 | 9 |
| nx_mgmt_client.nx | SOVEREIGN CLIENT for the live control-plane mgmt API (nx_mgmt_api.nx, https://<host>/api). | 687 | 23 |
| nx_mgmt_client_gate.nx | in-process referee for the sovereign mgmt-API client codec. NO socket / NO creds: | 142 | 7 |
| nx_mgmt_core.nx | the LOGIC / DOMAIN layer of the management plane (the hexagonal CORE). | 37 | 5 |
| nx_mgmt_core_gate.nx | PURE unit gate for the management LOGIC layer. The whole point of the layering: the | 54 | 4 |
| nx_mgmt_data.nx | the DATA / ADAPTER layer of the management plane (the OUTER ring; secondary adapters). | 2142 | 87 |
| nx_mgmt_promote_gate.nx | prove POST /api/promote (organ ELF) is fail-closed + never-brick. In-process | 182 | 11 |
| nx_mgmt_publish_bin.nx | submit the ecosystem CONTROL-PLANE binary (nx_mgmt_api) to the publisher | 48 | 4 |
| nx_mgmt_research.nx | THIN structured ECOSYSTEM-MANAGEMENT / CONTROL-PLANE research source organ. | 46 | 1 |
| nx_mgmt_session_mint.nx | CLI over nx_session_mint_lib: mint an M5 no-cookie session token (the X-Nishi-Session | 21 | 1 |
| nx_mgmt_session_mint_gate.nx | proves the session minter: a token minted by msm_mint_raw (loading ed_priv from a | 90 | 3 |
| nx_mgmt_snapshot.nx | R1b: the LIVE health-snapshot PRODUCER for the sovereign management plane. | 180 | 9 |
| nx_mgmt_snapshot_gate.nx | PURE isolation gate for the R1b health-snapshot PRODUCER (nx_mgmt_snapshot). | 102 | 7 |
| nx_mgmt_snapshot_run.nx | the COMPLETE, self-contained health-snapshot PRODUCER binary (R1b, live path). | 274 | 9 |
| nx_mgmt_snapshot_run_gate.nx | PURE isolation gate for the producer's INSTANCE-vs-fork-child rule | 61 | 4 |
| nx_mgmt_tools_register_gate.nx | prove POST /api/tools/register is fail-closed + idempotent. In-process | 206 | 10 |
| nx_mgmt_upload.nx | CAP-API-UPLOAD: the #1 census gap = binary UPLOAD over /api, the "not-on-LAN deploy" | 53 | 3 |
| nx_mgmt_upload_gate.nx | SOVEREIGN in-process referee for the /api/upload keystone (chunked artifact publish). | 319 | 12 |