nx_conductor_live.nx

nx_conductor_live.nx -- the Nishi CONDUCTOR, v3: the LIVE, WARDEN-GATED tick that ticks the INVENTION ORGANS via the SOVEREIGN code path (NO .sh). v1 (nx_conductor.nx) was OBSERVE-ONLY (measure canaries + journal, no Warden, no action). v2 was LIVE+Warden-gated but dispatched each gate by fork+exec'ing a .sh WRAPPER via /bin/bash -- the LAST non-sovereign part. v3 REMOVES that: the beat now runs the invention organs (AUTHOR + VERIFY-BY-PROOF) directly via the gr_gate shape ported INTO the Conductor (cl_run/cl_gate): fork+exec the PINNED known-good compiler -> as -> ld -> nx_run_timeout, exit-code = verdict. No /bin/bash, no .sh anywhere on the dispatch path -- argv[0] is the known-good ELF / as / ld, never a shell. (Operator cardinal: sovereign NishiLang only.) Each BEAT it (1) asks the WARDEN to authorize the additive verify/author-to- memory action, then (2) ticks the two invention organs hang-safe (each stage, including cc/as/ld, runs under a self-SIGALRM deadline so a looping build- oracle or organ kills itself -- it cannot wedge the beat), and (3) journals the verdict to the event bus -- on cadence, UNATTENDED. This flips the build-> verify->invent loop from "a human runs it" to "the crew ticks itself." The Warden GATES, it does not rubber-stamp: each beat we show it ALLOW the safe (additive, read-only) verify/author-to-MEMORY tick AND DENY a forbidden source overwrite -- proving the cardinal gate is live in the loop (#13 additive-only). The author organ EMITs to MEMORY only; an EMIT-to-SOURCE would be a W_OVERWRITE_SRC -> DENIED. The exit code itself proves the deny fired on every beat (warden_denies must == CL_BEATS). Composes nx_run_timeout (hang-safety + nx_rt_alarm) + nx_warden_lib (the cardinal gate). Sovereign: raw syscalls, zero deps, ZERO shell. Bounded beats (testable); the unbounded daemon is a config flip once this is trusted. license_tier: ORIGINAL