Validate execution targets against Nexus instead of accepting free text

Finding 3 of REVIEW-2026-07-30.md. target_entity_id was accepted as any
non-empty string; the engine only compared it against a pinned TargetEntityID,
which is empty for every registered capability. Spec §4.3: "Hexis never
accepts a free-text target. Ever."

Targets are now checked in order: ent_ shape (free, never touches the
network), pinned target, existence in Nexus, entity still active, and a match
against the capability's TargetTypes. Validation runs before a confirmation is
consumed, so a bad target cannot burn one, and at confirmation-mint time too,
since a confirmation binds a target.

Two deliberate calls:

Nexus unreachable fails closed (503, ErrTargetUnverifiable). Failing open
would reinstate exactly this hole the moment Nexus blips, and hand it to
anyone able to degrade Nexus. Hexis holds no entity table, so "unreachable"
and "I cannot tell if this target is real" are the same statement. The cost is
that executes now require Nexus liveness; the lookup is bounded at 5s so a
hung Nexus fails fast rather than consuming the capability timeout.

An empty TargetTypes means no type constraint, not a bypass — the entity must
still exist, be canonical and be active. Rejecting empty outright would
disable 16 of the 19 registered capabilities, since only the docker.* entries
declare a target type.

The spec's stronger blessing guard is not implementable: Nexus has no blessing
concept at all. This is the achievable guard, and strictly weaker.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uea55zaiWuEByEDC4UBSdd

cmd/hexisd/main.go

@@ -33,7 +33,7 @@ func main() {
 	flag.BoolVar(&mcpMode, "mcp", false, "Run in MCP stdio mode")
 	flag.StringVar(&workspaceURL, "workspace-url", "", "Workspace MCP HTTP API URL (e.g. http://localhost:9930)")
 	flag.StringVar(&workspaceAllowlist, "workspace-allowlist", "", "Path to workspace tool allowlist YAML")
-	flag.StringVar(&nexusURL, "nexus", "", "Nexus base URL for hexis.resolve_target (default http://localhost:8987)")
+	flag.StringVar(&nexusURL, "nexus", "", "Nexus base URL for hexis.resolve_target (default http://localhost:9740)")
 	flag.Parse()
 
 	if dataDir == "" {
@@ -52,7 +52,7 @@ func main() {
 		nexusURL = os.Getenv("HEXIS_NEXUS_URL")
 	}
 	if nexusURL == "" {
-		nexusURL = "http://localhost:8987"
+		nexusURL = "http://localhost:9740"
 	}
 
 	dbPath := filepath.Join(dataDir, "hexis.db")
@@ -64,7 +64,6 @@ func main() {
 	defer store.Close()
 
 	reg := provider.NewRegistry()
-	reg.Register(provider.NewSystemdProvider())
 
 	// Register workspace MCP provider if configured
 	if workspaceURL != "" {
@@ -112,18 +111,30 @@ func main() {
 		}
 	}
 
-	engine := execution.New(store, reg)
+	// Nexus is the sole authority on entity identity: Hexis refuses any
+	// target it cannot confirm exists there (ECOSYSTEM-SPEC.md §4.3, "Hexis
+	// never accepts a free-text target. Ever."). If Nexus is down, executes
+	// fail closed with 503 rather than accepting the target on trust.
+	nexus := nexusclient.New(nexusURL)
+	engine := execution.New(store, reg, execution.WithEntityLookup(nexus))
 
 	if mcpMode {
 		log.Printf("starting MCP stdio adapter")
-		adapter := mcp.New(store, engine, nexusclient.New(nexusURL))
+		adapter := mcp.New(store, engine, nexus)
 		if err := adapter.ServeStdio(); err != nil {
 			log.Fatalf("MCP error: %v", err)
 		}
 		return
 	}
 
-	srv := api.NewServer(store, engine)
+	// Shared bearer token for /api/v1/. Required: the HTTP surface can start
+	// and stop containers, and it is reverse-proxied on a public hostname.
+	apiToken := os.Getenv("HEXIS_API_TOKEN")
+	if apiToken == "" {
+		log.Fatalf("HEXIS_API_TOKEN is not set: refusing to serve /api/v1/ unauthenticated")
+	}
+
+	srv := api.NewServer(store, engine, apiToken)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()