nova-check

Overview ¶

nova-check runs the record-layer checks described in SPEC.md: boot attestation, link integrity, the kernel size budget, and the self/machinery separation. Exit 0 pass, 1 check failed, 2 could not run.

Every path and every budget comes from a flag. There are no defaults: a missing flag is a refusal, never a guess.