nx_content_put_client_gate.nx

nx_content_put_client_gate.nx -- THE GATE FOR THE SOVEREIGN UPLOAD CLIENT, 2026-09-03. SUBJECT: the BUILT nx_content_put_client elf, forked in `dryrun` mode so the JSON-RPC envelope it would put on the wire becomes a deterministic artifact with no socket involved. WHY dryrun IS THE RIGHT SUBJECT. A malformed envelope is rejected by the SERVER, and the server's refusal names neither the client nor the real fault -- it reports a schema or argument error about a request nobody can see. The first draft of CC_PRE carried a DOUBLED "params" key with a four-brace tail that balanced against itself: syntactically valid JSON of entirely the wrong SHAPE. Nothing in a live run would have named that. T2 exists precisely for it. T3 IS AN EXTERNAL KAT, NOT OUR OWN ARITHMETIC. The fixture is the three bytes "abc", whose SHA-256 is published in FIPS 180-2 as ba7816bf...f20015ad. The client computes the digest it sends with our sha256, and the gate compares against the PUBLISHED constant -- so this tooth cannot pass by our implementation agreeing with itself. If our sha256 were wrong, every upload would carry a digest the server would reject at commit, and this is the cheapest possible place to catch that. T6/T7 ARE THE REFUSAL PAIR. T6 requires a destination carrying a double-quote to be REFUSED rather than escaped -- the client's stated design is refuse-never-escape, because a hand-rolled JSON escaper is wrong in exactly the cases nobody tests. On its own T6 would pass on a client that refused everything, so T7 requires a safe destination to be ACCEPTED. Teeth, in order: T1 the envelope's braces and brackets balance, and it ends with the declared tail. T2 "params" appears EXACTLY ONCE (the doubled-key defect that shipped in the first draft). T3 EXTERNAL KAT: the digest sent for "abc" is the FIPS 180-2 published SHA-256. T4 the destination appears verbatim in the envelope. T5 the capability token appears verbatim (a client that dropped it would 401 for the wrong reason). T6 NEG-CONTROL: a destination containing a quote is REFUSED (exit 4), never escaped. T7 POSITIVE CONTROL: a safe destination is ACCEPTED (exit 0), so T6 cannot pass on a client that refuses everything. T8 the argv array's first element is the verb "begin". MEASURED 8/8 GREEN 2026-09-03: braces 3/3, brackets 1/1, params key exactly once, FIPS vector present, quote-in-destination refused at exit 4 with the safe destination accepted at exit 0. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0