nx_gate_baseline_harness.nx

nx_gate_baseline_harness.nx -- retrofit a REGRESSION BASELINE onto ANY gate with ZERO gate-source edits. The sensor-gap risk map ([[project-nishi-sensor-gap-census-2026-07-14]]) measured 87% of ~3675 gates with NO regression baseline = they can silently backslide. Hand-editing thousands of gates would be a patch cascade (rule 3) -- so this harness wraps the RUNNER instead: it forks the sovereign build lane on a gate, captures the gate's output + exit code, and banks/guards a per-gate baseline ledger. Wrapping a gate = running one command; the gate's source is never touched. usage: nx_gate_baseline_harness <gate-name> [--rebase] first run -> CAPTURE: bank {rc, int-vector of output} to knowledge/status/gatebase_<gate>.tsv later runs -> GUARD: rc must MATCH the banked rc (universal invariant, judged); numeric drift is SURFACED per position (informational, NOT judged -- auto-judging unknown numbers directionally would make a LYING sensor; per-gate directional specs are the v2 data-row hook). --rebase -> re-bank current state as the new baseline (explicit operator action; refused on rc!=0). LIAR-KILLERS on the harness itself: * signal-aware exit decode (128+sig, the proven sbr_run idiom) -- a SEGFAULTED gate can never read as GREEN. * a red run is REFUSED as a baseline -- a broken state can never become "the standard". * an absent/unreadable output = RED (evidence-grounding: no evidence, no verdict). * ledger writes are atomic (tmp + renameat); only /tmp/gatebase_*.out + knowledge/status/gatebase_*.tsv are ever written -- no gate source is touched (never-brick by construction). Sovereign nx_cc->nxasm; forks _offc/nx_sov_build_run.elf (no gcc, no sh). Run with CWD=nxc2 root. license_tier: ORIGINAL