nx_mgmt_deploy_candidate_t185.nx

nx_mgmt_api.nx -- THE IO / TRANSPORT ring of the sovereign ecosystem control-plane API (the primary adapter). THIN by design (clean three-tier / hexagonal -- see knowledge/library/arch_*): it owns ONLY transport -- the socket loop, HTTP request parse, routing, JSON serialization, and auth gating. ALL business rules live in the LOGIC core (nx_mgmt_core, mc_*); ALL outside-world access lives in the DATA adapters (nx_mgmt_data, md_*). Dependency direction: api -> {core, data}, data -> core-free, core -> nothing (dependency inversion). The router is a PURE FUNCTION ma_handle(ctx, req, req_n, snapfile, out) -> out_n (bytes in, bytes out, NO socket); the gate drives it IN-PROCESS (no curl/shell). Reuses nx_status_daemon's HTTP-parse + Modern-Auth helpers. TRUE MONITORING (no false +/-): /api/health + /api/services read a live SNAPSHOT (md_read_file) and surface dueling-supervisors / duplicate-instances / crash-loops via the core rules; missing snapshot -> UNKNOWN, never OK. Health/services + all write actions are AUTH-gated; write actions are confirm-gated + fail-closed. Routes (auth = X-Nishi-Session Ed25519 session header, canonical Modern Auth, NO cookies): GET /api -> 200 route index (public) POST /api/login -> 200 {"token":...} | 401 GET /api/health -> (auth) 200 {overall,degraded,reasons[...]} | 401 GET /api/services -> (auth) 200 {services:[...]} | 401 POST /api/upload?target=&seq=&final=[&sha256=] -> (auth) chunked artifact publish; append raw body chunk -> <target>.upload, on final rename -> <target>.new (staged for /api/deploy; NEVER promotes) | 400 | 401 POST /api/deploy -> (auth) allowlist+validate->promote->http-health->auto-rollback | 400 | 401 POST /api/rollback -> (auth, confirm=yes) | 400 | 401 POST /api/reconcile -> (auth, confirm=yes) single-supervisor | 400 | 401 POST /api/restart -> (auth, confirm=yes, service=) surgical kick | 400 | 401 POST /api/migrate|update -> (auth) 501 reserved (R3b: URL->.site ingest) | 401 (any other) -> 404 Snapshot line format (the monitor writes; md_* reads): "SUP <n>" / "SVC <name> <port> <state> <procs> <rwin> <rtot>" argv: [1]=port [2]=keysfile [3]=storefile [4]=realm [5]=snapfile [6]=budget. license_tier: ORIGINAL