nx_evoracle_attest.nx

nx_evoracle_attest.nx -- THE ORACLE PRODUCER. The missing writer that makes an oracle attestation a DERIVED FACT instead of hand-typed prose. WHY THIS ORGAN EXISTS (measured 2026-07-31): EV_CLASS_ORACLE had exactly ONE consumer (nx_sota_status.nx:220) and NO producer. The only way an oracle row could ever exist was for an agent to type `class=oracle ref=RFC7748` into a conf file -- having compared absolutely nothing. A class whose only writer is prose is not evidence, it is a claim wearing evidence's clothes. WHAT "DERIVED" MEANS HERE, MECHANICALLY. This organ refuses to emit a row unless it has itself just: 1 READ the subject source and classified its party-ness with nx_evoracle -- and got THIRD. A first-party subject is REFUSED. Its answers are ours; agreement with ourselves is not independence. 2 EXTRACTED the external authority actually named in that source, so ref= is a QUOTE, not a label. 3 HASHED the exact bytes it classified (sha256) -> refdig=. Prose can CLAIM RFC 7748; a digest commits to the bytes. If the vectors are later edited, the digest moves and the old row stops matching. 4 FORKED AND RUN the gate binary and required exit 0. ★A GREEN GATE IS THE ONLY THING THAT LICENSES THE WORD "pass". An attestation written without running anything is the exact defect this whole workstream was opened to delete. Any step failing is a REFUSAL with a named reason, never a downgraded row: a partially-earned oracle row looks like proof while being unverifiable, which is strictly worse than no row. ⚠⚠HONESTY BOUNDARY, STATED IN THE ORGAN SO IT CANNOT BE MISREAD AS WORKING: THE ROW THIS EMITS IS UNSIGNED, AND at_verify_row WILL REFUSE IT. That is correct and deliberate. knowledge/attest_keys.conf is ABSENT, and nx_fs_write DENIES paths matching `key` -- a load-bearing refusal, because an agent that can write the signer registry can register its own key as role=human and certify its own work. This organ does NOT route around that. It produces the DERIVATION; a registered key must supply the ATTRIBUTION. Emitting an unsigned row that is visibly refused is the honest end state for an agent; silently minting a key to make the number move would be the dishonest one. ⚠ALSO MEASURED: nx_evattest.nx defines MECH|LLM|HUMAN and has NO AT_CLASS_ORACLE. Oracle rows are permitted there only by FALL-THROUGH (the role rules constrain HUMAN and LLM and never mention oracle). Permitted by omission is not permitted by declaration -- a future default-deny would silently kill the class, and the loader and the verifier currently disagree about the vocabulary. license_tier: ORIGINAL expect_exit: 0