nx_dev_api_gate.nx

nx_dev_api_gate.nx -- in-process gate for the sovereign DEV/CI API (nx_dev_api). Drives da_handle with byte requests (NO socket, NO real fork). Proves routing + the TWO boundaries that make it safe to expose: AUTH (object-capability): mutating routes need an X-Nishi-Cap granting "dev_build"; no-cap/forged -> 401. INJECTION: with a VALID cap, the organ name is still charset-validated -> traversal/injection -> 400 BEFORE any exec (fixed-argv). Defence in depth: authority AND input both checked. T1 GET index 200 T2 GET status 200 T3 unknown 404 T4 build NO cap -> 401 T5 build FORGED cap -> 401 T6 build valid-cap + ../etc/passwd -> 400 T7 build valid-cap + empty -> 400 T8 da_valid_name unit T9 da_form_field unit T10 injection charset expect_exit: 0 license_tier: ORIGINAL