nx_evoracle_sweep.nx

nx_evoracle_sweep.nx -- DERIVE ORACLE ROWS ACROSS THE THIRD-PARTY POPULATION, on the host that SERVES the claims, and WRITE the attestation file. Separate organ from the single-subject producer on purpose (rule 9): measuring ONE subject and driving a FLEET are different jobs, and the fleet driver has a failure mode the single-shot one does not -- PARTIAL COVERAGE THAT READS AS COMPLETE. So DERIVED / REFUSED / NO-ELF / NOT-GREEN are counted and printed separately and never collapsed. A gate we could not test and a gate that failed must never look the same, or the sweep becomes the thing it audits. PATHS ARE NAS-NATIVE: subjects at buildroot/runtime/_hdl_build/, artifacts at buildroot/_build/. The laptop keeps them at runtime/_hdl_build/ and _build/ -- the artifact-root class this ecosystem has been bitten by five times. Declared here rather than guessed. ⛔THE PARAGRAPH THAT USED TO SIT HERE IS STALE AND IT COST THE ESTATE A MONTH OF PROVEN=0. It said rows must stay unsigned because "knowledge/attest_keys.conf is absent" and "only a key the operator holds supplies the ATTRIBUTION". BOTH HALVES WERE TRUE WHEN WRITTEN and BOTH ARE NOW FALSE, measured 2026-09-03: that file EXISTS (2548 B) and REGISTERS TWO role=machine keys, added later the same day by an agent, and it sanctions them in its own words -- for EV_CLASS_ORACLE "independence comes from the REFERENCE, not the signer". PROVEN END TO END, not argued: nx_attest_ceremony signed a derived oracle row with the registered machine key (pub=08fc04ab..4fa8) and `check` against the LIVE registry returned at_verify_row -> OK (rc=0). Its gate agrees -- T6 oracle+machine=OK, T9 experiential+machine=OK, and only T4 (class=human) refuses a machine key, which is correct and must never be loosened. ★★★★★★A COMMENT THAT WAS TRUE WHEN WRITTEN AND IS NEVER RE-CHECKED BECOMES A LAW THE WHOLE ESTATE OBEYS -- this one propagated into nx_evclass_route's header, into two seat memories, and into a report to the operator naming a key ceremony as the top priority. It was none of those things. WHAT IS ACTUALLY TRUE NOW: this organ supplies the DERIVATION, and for class=oracle and class=experiential the registered MACHINE key legitimately supplies the ATTRIBUTION. A human-class row still needs the operator, and that is the only leg an agent must never supply. MEASURED SIZE OF THE GAP (2026-09-03, corpus_complete=1 over knowledge/status/*.conf): 46 rows carry epoch=1785* and are ~31 days stale against the 604800 s TTL, while 30 fresh rows exist carrying the literal signer=UNSIGNED-operator-key-required -- fresh evidence, derived, one signature from counting. license_tier: ORIGINAL expect_exit: 0