Documentation
¶
Overview ¶
nova-check runs the record-layer checks described in SPEC.md: boot attestation, link integrity, the kernel size budget, the self/machinery separation, the SEED-CORE ↔ SEED.md floor-set parity, and the protected corpus a line has chosen never to lose silently. Exit 0 pass, 1 check failed, 2 could not run.
Every path and every budget comes from a flag. There are no defaults: a missing flag is a refusal, never a guess.
nova-check version: which build is running.
A refusal, a green or a line somebody pastes into a note is evidence about a BUILD, and until this verb existed this binary could not say which one it was: `nova-check version` was exit 2, unknown subcommand. So "we are all running the same nova-check" was a belief rather than a reading, and the release could not assert over the set what no member of the set would answer.
The version is NOT a constant maintained by hand -- a hand-maintained constant is wrong exactly at the commit after the release, where it still names the release. It is read from the build itself by internal/buildinfo, which holds the resolution order and the shape of the line for every binary here, so that eleven tools answer this question in one spelling rather than eleven.
Source Files