nx_adoptgate_review_candidate_t371.nx

nx_adoptgate.nx -- THE ENFORCED GATE BETWEEN /api/build AND /api/promote (2026-08-07). WHY: the 4-step adoption recipe exists and is correct, and I ran it BY HAND and therefore ran it INCONSISTENTLY -- 35 organs promoted on step 2 alone because step 3 was something I had to remember. *A LAW I HAVE TO REMEMBER IS A LAW I WILL SKIP; PUT IT IN THE PATH.* This collapses steps 2 and 3 into ONE call that emits ONE machine-checkable token, so a promote can be gated on `APPROVED` instead of on my good intentions. IT DOES NOT BUILD AND IT DOES NOT PROMOTE, and that is deliberate: - build must go through /api/build because only that stages the artifact where /api/promote LOOKS (a direct nx_sov_build_run drops it in /tmp or _build -- provably the wrong place, and exactly the artifacts-never-placed-where-consumers-look defect this whole campaign is about). - promotion stays an explicit operator act. A gate that also performs the action it authorises cannot be re-run to audit its own decision. COMPOSES THE INCUMBENTS, never reimplements them (one duplicate ruler was already built and retracted this session): nx_contentdiff = NECESSARY half, nx_behaveprobe = SUFFICIENCY half. nx_adoptgate <target> [workload-args...] -> ADOPT-GATE <target> verdict=APPROVED|REFUSED reason=... content=... behave=... evidence=... exit 0 APPROVED | 1 REFUSED | 2 missing artifact | 3 usage license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0