nx_pkg_gate.nx

nx_pkg_gate.nx -- THE GATE FOR THE CONTENT-ADDRESSED PACKAGE LANE (LR3 of /compare/lang). Subject: the DEPLOYED nx_pkg binary (fork-style end-to-end; argv[1] overrides the subject path so a mutation bite can aim at a staged mutant without touching live). Every fixture is assembled AT RUNTIME in /tmp/nx_pkg_gate/ -- nothing is checked in, so a source scanner can never find this gate's own bad inputs, and setup is idempotent so a rerun cannot inherit a prior run's artifacts. WHAT IT PROVES, AND WHY EACH TOOTH EXISTS: A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST. So every refusal tooth here is paired with a POSITIVE CONTROL that MUST be allowed, and every refusal asserts WHICH RULE FIRED -- both the rule name on stdout and the distinct exit code. A suite that only asks `was it refused?` is blind by construction, and this estate has already shipped that exact defect once (four SSRF deny tests green while the guard refused every url). ZERO INSTALL-TIME EXECUTION is proven MECHANICALLY, never asserted. The module fixture carries a real would-be install hook, and the gate first RUNS that hook itself to prove it genuinely produces an observable marker (the anti-vacuity control -- otherwise `the marker is absent` proves only that the marker was never producible). The marker is then cleared, the same module resolved through the subject, and the marker asserted ABSENT while the resolve itself SUCCEEDED. NOT ROSTER-ADMITTED BY DEFAULT: it forks the subject ~25 times. Run via nx_job_run or /api/gate_run. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0