nx_autofix_intake_gate_t138.nx

nx_autofix_intake_gate.nx -- THE FOREIGN-BUG INTAKE GATE (2026-07-16; envelope + untrusted-input admission added autodev AD3/AD6, 2026-08-27). Any lane appends `name|path[|origin=external|prov=h..| merged=yes]` rows to knowledge/forge/fix/mut_proposed.txt; this gate ADMITS each (deny by default), BUILDS+RUNS every LOCAL row in a SANDBOX and keeps only instances whose bug REPRODUCES (>=1 failing FNRES row) -- the equivalent-mutant discipline. EXTERNAL rows are DATA-ONLY (provenance-pinned AND maintainer-merged) and are NEVER built or run; anything else is refused BY NAME. Output: knowledge/forge/fix/mut_manifest.txt (nx_autofix_auto's episode list of LOCAL, reproducing instances). WHY THE REWRITE: the old gate exited 1 RED with no proposal plane (there was no mut_proposed.txt), and it built each candidate in place with no untrusted-input admission -- the two sev-8 poisoning rows (1784661149, 1784661346) demand deny-by-default before any ingestion. It now composes nx_autofix_lib: one admission ruler, one sandbox, one FNRES reader -- shared with the loop and the auto gate so they cannot disagree. SKIP (gv_need) when the proposal plane is absent: a host with no plane is not a failure. TEETH T0 precondition: the proposal plane resolves (else SKIP, never a false RED) T1 parsed >=1 proposed row T2 kept >=1 reproducing LOCAL instance T3 DISCARD TOOTH: the deliberate equivalent mutant (nx_autofix_mut_eqv, all-pass) is ABSENT from output T4 ADMISSION: a planted unmerged EXTERNAL row is refused BY NAME and never built (neg-control) T5 the verified manifest is written and every kept row was BUILT+RUN inside a sandbox (tree untouched) expect_exit: 0 license_tier: ORIGINAL