nx_provcheck.nx

nx_provcheck.nx -- ASK THE ARTIFACT WHAT IT WAS BUILT FROM, THEN ASK THE TREE (2026-08-07). This is the question the treecanon manifest exists to approximate, answered from facts instead: "is the deployed binary built from the sources that are in the tree right now?" The manifest answers a DIFFERENT question and answers it backwards. It is generated from the LAPTOP mirror, pushed to the NAS, and used to judge the NAS tree -- while edits land on the NAS through nx_fs_write and builds compile FROM the NAS. So it compares truth against a stale copy of a mirror and reports truth as a fork. Measured 2026-08-07: four different hashes for one header inside ten minutes, builds blocked by my own newer edit, and a manifest push that lost a file-lock race and simply did not land. Every one of those is the architecture, not a bug in the guards. ★★★★★★A MANIFEST IS A CLAIM ABOUT A TREE AT A PAST INSTANT; A CLOSURE HASH IS A FACT ABOUT THE BINARY IN YOUR HAND. `<target>.provenance` records the closure the build actually read; this recomputes the closure from the tree as it stands and compares. No push, no watermark, no census, nothing that can go stale between the write and the read, and no second tree required to have an opinion. VERDICTS -- each its own bucket because each has a different remedy: CURRENT recorded closure == tree closure. The artifact IS its sources. DRIFTED they differ. Something in the import closure changed since the build. UNRECORDED the sidecar has no closure_sha256 (built before this existed, or by the async path). *NOT A FAILURE AND NOT A PASS* -- it is "I could not look", and it must never be reported as either. A guard that turns absence into a verdict is the one that gets switched off after it lies once. NOSIDECAR no .provenance at all. nx_provcheck <target> [root] root default "." (run from the buildroot's parent) exit 0 CURRENT | 1 DRIFTED | 2 UNRECORDED/NOSIDECAR | 3 usage license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0