nx_inventory_gate.nx

nx_inventory_gate.nx -- proves nx_inventory_serve's teeth IN-PROCESS. No socket, no curl, no shell. WHY THIS EXISTS: the first version of this daemon was tested by a shell script driving curl -- the break-glass shape rule 29 forbids -- and that suite was BLIND TWICE OVER: 1. it printed only "Refused." without the REASON, so four SSRF negative tests went green while the url decoder was completely broken. ***A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST.*** Only a POSITIVE control (an input that MUST be allowed) could see it. 2. once auth landed, every route 401s before reaching the guard, so the SSRF checks could not run over HTTP AT ALL. A test that the product's own security improvement disables is not a test. The daemon's router is a PURE FUNCTION for exactly this reason: request bytes in, response bytes out. So this gate calls iv_url_ok / iv_urldec / iv_handle directly and asserts WHICH RULE FIRED. Fixtures live under /tmp; production surfaces are never read or written. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0