nova-check

Overview ¶

nova-check runs the record-layer checks described in SPEC.md: boot attestation, link integrity, the kernel size budget, the self/machinery separation, the SEED-CORE ↔ SEED.md floor-set parity, and the protected corpus a line has chosen never to lose silently. Exit 0 pass, 1 check failed, 2 could not run.

Every path and every budget comes from a flag. There are no defaults: a missing flag is a refusal, never a guess.