nx_content_get_gate.nx

nx_content_get_gate.nx -- THE GATE FOR THE NAS->LAPTOP DOOR, 2026-09-03. SUBJECT: the BUILT nx_content_get elf, forked end-to-end. Its verbs are the whole contract, so an in-process gate could not test the thing that matters (argv parsing, exit codes, the wire receipt). argv[1] overrides the subject path so nx_gate_bite can hand it a mutant. THE TEETH THAT CARRY THE CLAIM ARE T4/T5 AND T10, and each is a law this estate has been bitten by: T4 IS A FIXTURE ASSERTION, NOT AN OUTCOME. It proves the big fixture actually forced nchunks>1 BEFORE T5 judges reassembly. Without it, a subject that fits in one chunk would let T5 pass while the multi-chunk path -- the only path that can corrupt -- was never executed. The single-chunk case looks identical to a working transfer from the outside. T10 IS THE POSITIVE CONTROL FOR THE REFUSALS. T7/T8/T9 all assert a REFUSAL, and a guard that refuses EVERYTHING passes every one of them. T10 demands a legitimate path be ACCEPTED, so the deny-tests can only pass on a guard that actually discriminates. T3 uses the gate's OWN one-shot sha256_digest against the tool's STREAMING sha256_update path -- genuinely different code, so it is a cross-check rather than the subject grading itself. T2 re-reads chunk_raw FROM THE PROBE rather than re-deriving it here: re-deriving would install a second ruler that drifts the moment the reserve changes. Teeth, in order: T1 the probe partition RECONCILES: skel+pathcap+digits+shahex == reserve. T2 chunk_raw is positive and an exact multiple of 3 (so base64 emits no interior padding). T3 begin's whole-file digest equals an INDEPENDENTLY computed digest of the same bytes. T4 FIXTURE ASSERTION: the large fixture forces nchunks > 1. T5 multi-chunk reassembly is byte-identical to the original. T6 the partition SUMS: the per-chunk raw sizes total exactly total_bytes. T7 NEG-CONTROL: a path-traversal source is REFUSED (exit 4). T8 NEG-CONTROL: a source outside the allowlist is REFUSED (exit 4). T9 NEG-CONTROL: credential material is REFUSED (exit 4). T10 POSITIVE CONTROL: an allowlisted source is ACCEPTED -- without this T7/T9 pass on a guard that refuses everything. T11 an index past end of file is a RANGE refusal (exit 5), distinct from a source refusal. MEASURED 11/11 GREEN 2026-09-03 on the laptop, bite-proven killed=1 with the source and the deployed subject both restored byte-identical (12665 / 40212 bytes). license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0