nx_evoracle_emit.nx

nx_evoracle_emit.nx -- THE MISSING PRODUCER for EV_CLASS_ORACLE (closes M3). EV_CLASS_ORACLE had exactly ONE consumer (nx_sota_status.nx:220) and NO producer, so an oracle row was hand-typed prose: an agent could write `class=oracle ref=RFC7748` having compared nothing. Without a second class no mechanical domain can reach min_classes=2, which is why the board reads PROVEN 0/41 -- pinned by an EMPTY TABLE, not by any failed measurement. ★★★★★THE LAW THIS ENFORCES (nx_evoracle.nx): AN ORACLE ATTESTATION MUST BE DERIVED FROM AN EXECUTION, NEVER DECLARED IN PROSE. A signature buys attribution and tamper-evidence; it does NOT buy truth, because whoever holds the key can sign a false claim. What buys truth is RE-DERIVABILITY. So this organ REFUSES to accept a verdict as an argument -- it RUNS the named gate and reads the verdict off the actual exit code, and it pins WHICH external vector block was compared by digesting that file. Anti-gaming properties, by construction rather than by promise: - verdict is DERIVED (exit code), never passed in. There is no argument that can assert "pass". - a missing or unreadable vector file REFUSES (exit 3). "It matched" is not evidence unless it says what it matched. - a gate that cannot be executed REFUSES (exit 4). A row is never written for a run that did not happen -- the failure mode the whole evidence lane exists to kill. - ref= carries authority + digest, so a later reader re-runs the comparison and gets the same answer. The digest is FNV-1a 64: it pins WHICH block was used and detects drift. It is NOT cryptographic and is not claimed to be -- tamper-resistance here comes from re-derivability, not from the hash. nx_evoracle_emit <domain> <gate_elf> <vector_file> <authority> <scope> license_tier: ORIGINAL layer: evidence module: nishi-core.evidence.evoracle_emit