nx_filehash_gate.nx

nx_filehash_gate.nx -- THE GATE FOR THE IDENTITY RULER. Every content pin in every /compare .refs register on this estate is a sha256 produced by nx_filehash, and every fetch-time provenance binding compares against one. On 2026-09-06 nx_catalog reported nx_filehash_gate ABSENT -- no source, no binary, nothing promoted -- so the ruler that decides whether two artifacts are the same bytes had no gate of its own. This is that gate. IT COMPOSES THE ORGAN'S OWN SELFTEST RATHER THAN RE-IMPLEMENTING IT (T8), because a second copy of the same five teeth would be the duplicate-ruler defect. What a GATE adds over a selftest is threefold and none of it is duplication: it forks the DEPLOYED ARTIFACT from outside rather than testing itself from within, it can be BITE-PROVEN by mutating the subject, and it is rostered so it runs on a beat instead of when a seat types it. THE INDEPENDENT VECTORS ARE THE POINT. T1 and T2 are published SHA-256 known answers this gate carries itself: "abc" and THE EMPTY INPUT. The empty case is the one an organ's own selftest most often omits and the one a length-driven bug survives, so it is here deliberately. If the organ and this gate ever disagree, the published vector wins -- that is what an external ruler is for. NEGATIVE CONTROLS, because a checker that returned success for everything would score 100 percent: T7 requires a MISSING file to yield NO digest at all, and T6 requires two DIFFERENT files to compare unequal. A gate whose every tooth asserts presence cannot tell a working ruler from one that prints a constant. Fixtures are assembled at RUNTIME under /tmp/nx_filehash_gate/ so this gate never shares scratch with a production beat, and T0 asserts the fixtures actually reached their intended bytes BEFORE any outcome is read off them. license_tier: ORIGINAL No hw writes (Rule 26).