nx_evoracle.nx

nx_evoracle.nx -- THE INDEPENDENCE LAW. Sibling of nx_evidence_verdict.nx (which grades what a claim's EXECUTION earns); this grades WHOSE AUTHORITY that execution rests on. OPERATOR DIRECTIVE 2026-07-31: real 3rd party validated evidence, judged independently, so nishi cant game the system but has to climb the hard thorough way like a PhD or a government certification. THE GAP THIS EXISTS TO KILL, MEASURED LIVE ON THE NAS 2026-07-31 (not inferred): M1 knowledge/status/evclass_*.conf -- ZERO rows existed anywhere. find evclass . over 176,764 files returned 0 matches (reader proven before the corpus was blamed). The whole attestation plane -- built, crypto-enforced, oracle-aware -- had never carried a single row. Every domain therefore carried exactly ONE class (MECH), min_classes=2 could not be met, and PROVEN=0/40 was produced by an EMPTY TABLE, not by any failed measurement. M2 knowledge/attest_keys.conf is ABSENT, so at_verify_row refuses every signature. M3 EV_CLASS_ORACLE had ONE consumer (nx_sota_status.nx:220) and NO producer (now nx_evoracle_sweep). M4 nx_evattest.nx knew MECH|LLM|HUMAN only -- oracle rows verified by FALL-THROUGH. Now declared. THE FINDING THIS LIBRARY ENCODES -- KAT NAMES THE FORM, NOT THE PROVENANCE. nx_x25519_kat_gate.nx cites RFC 7748 5.2/6.1 and cross-checks OpenSSL: questions AND answers authored outside Nishi. It even found the RFC own 8448-3 vector internally inconsistent. nx_lex_kat.nx tests all 256 bytes vs INLINED ground truth defined in that same file, by us. A known-answer test whose answers you wrote yourself is a CONSISTENCY test, not an INDEPENDENCE test. This is why independence must NEVER be classified by FILENAME: both files above end in _kat. The name-suffix rule (gate|test|kat) is correct for PROMOTABILITY and catastrophic for INDEPENDENCE. PARTY-NESS (ISO/IEC 17000 series -- the vocabulary the accreditation world already settled). FIRST the subject attests to itself (a supplier declaration of conformity). Self-consistency only. SECOND a party with a user interest attests. THE OPERATOR OWN SIGNATURE IS THIS, NOT THIRD. It is a management assertion, exactly as in a SOC 2 report -- which is why such reports carry a SEPARATE auditor opinion. Valuable; not independence. THIRD authority external to both provider and user, editable by neither: published normative vectors (RFC/FIPS/NIST/ISO/IEEE/BIP/W3C/Khronos/ITU/Unicode) and differential agreement with a reference implementation we did not write. We can never hire an accredited lab -- but we can SIT AN EXTERNALLY SET EXAM. THE ANTI-GAMING PRINCIPLE: AN ORACLE ATTESTATION MUST BE DERIVED FROM AN EXECUTION, NEVER DECLARED. A signature buys attribution and tamper-evidence; it does NOT buy truth, because whoever holds the key can sign a false claim. What buys truth for a mechanical claim is RE-DERIVABILITY: ref= (the external authority), refdig= (digest of the exact bytes compared -- prose can CLAIM RFC 7748, a digest COMMITS to the bytes) and gate= (the re-derivation recipe). ENFORCED AT THE VERIFIER (nx_evattest at_verify_row), not only in the producer -- the producer is one program among many. Same structure the field converged