Installing NaZelo Trust¶

NaZelo Trust wires four moving parts (NaZelo, PimaTika, Litatoli, and this harness). This is the one place that sets them up, and one command that tells you whether they are ready: nazelo-trust doctor. Run it after each step below — it reports exactly what is still missing.

What the three engines guarantee together, and what they need, is the integration contract.

Capabilities, in order¶

You do not need everything to start. Each capability builds on the last:

Capability	Needs	What it gives you
Isolate	the `nazelo` package	run a command in a sandbox
Seal	+ the `litatoli` binary and its keys	sign the run into an evidence chain
Egress	+ eBPF tools + root	enforce and observe network egress
Three bricks	+ `pimatika` + `pimatika-cli`	PimaTika decides from a signed BIM

1. The harness and the Python engines¶

pip install nazelo-trust        # pulls in nazelo, pimatika, pyyaml, click
nazelo-trust doctor             # → Isolate READY

(From a checkout: pip install -e ..)

2. Litatoli — the sealing binary + keys¶

Put the litatoli binary on PATH (or point $NAZELO_TRUST_LITATOLI_BINARY at it), then provision its two keys once:

litatoli keygen              # writes ~/.config/litatoli/{signing.key,ed25519.key}
nazelo-trust doctor             # → Seal READY

Now nazelo-trust run -- <cmd> works and seals (isolation + evidence, no network).

3. eBPF tooling + privilege (for egress enforcement)¶

sudo apt-get install -y bpftool iproute2 clang util-linux   # bpftool, tc, clang, nsenter
nazelo-trust doctor             # → Egress READY  (needs root / passwordless sudo)

A per-run network namespace needs CAP_SYS_ADMIN; run as root or with sudo.

4. pimatika-cli (for the three-brick BIM path)¶

Build pimatika-cli and put it on PATH (or set $PIMATIKA_CLI). It signs the BIM that PimaTika verifies:

nazelo-trust doctor             # → Three bricks READY

Verify the whole stack¶

nazelo-trust doctor
# every line ✓, all four capabilities READY, exit 0

doctor exits non-zero until the full three-brick path is ready — use it as a CI gate before the E2E.

Run against a simulated critical peer¶

Everything above runs the workload against nothing — the default policy is deny-all. To run it against a PLC, an HL7 listener, a FIX gateway or an ePassport chip, install nazelo-trust-critical:

pip install nazelo-trust-critical
nazelo-trust-critical presets   # one preset per domain, plus a microVM variant

It ships its own three commands, and the peers are on those. nazelo-trust, nazelo-policy and nazelo-evidence keep the three presets they had.

Run the reproducible demo¶

sudo env \
  LITATOLI_KEY_FILE=~/.config/litatoli/signing.key \
  LITATOLI_ED25519_KEY_FILE=~/.config/litatoli/ed25519.key \
  PATH="/path/to/litatoli/dir:$PATH" \
  PIMATIKA_CLI=/path/to/pimatika-cli \
  examples/ci/run-deterministic.sh

It denies 192.0.2.123, allows a local server, and prints: PimaTika's decisions, NaZelo's own drop count, and a chain that verify-chain accepts. See docs/CONCLUSIVE-TEST.md.