nx_asset_provenance_gate.nx

nx_asset_provenance_gate.nx -- KAT + TEETH for nx_asset_provenance (R2 of the universal org-tooling arc). Proves CRYPTOGRAPHICALLY SIGNED, tamper-evident provenance: we can TRULY KNOW an artifact's class (generated image / downloaded video / human-authored) because the credential is ed25519-SIGNED and BOUND (via the W3C-PROV `entity` = the asset's record CID) to that exact content. DENY-BY-DEFAULT. ANCHOR RFC 8032 §7.1 TEST 1 KAT the SAME ed25519 we sign with derives the published public key byte-for-byte -> the crypto base is GENUINE (RFC 8032), not a stub and not rolled here (reused from nx_ed25519_signature). (a) VALID a credential signed by key K verifies against pubkey K for its record CID -> ALLOW (b) TAMPER flip one byte of the assertion inside the credential -> REJECT (c) FORGE sign with key K2, verify against trusted pubkey K1 (what a plain hash can't catch) -> REJECT (d) REBIND a credential minted for record A, verified with expect_record_cid = B (binding) -> REJECT (e) 3 CLASSES human / machine(tool+model) / downloaded(source URL) each sign+verify ALLOW and carry their payload in the assertion. Verdict logged to knowledge/status/asset_provenance_gate.log (append-only; ADDITIVE law #13). expect_exit: 0 license_tier: ORIGINAL