nx_provstmt.nx

nx_provstmt.nx -- CR3 of /compare/capregistry: ATTEST THE PROMOTED ARTIFACT, NOT THE EVIDENCE FRAME. nx_provstmt <target> <artifact_sha256> <src_sha256> <closure_sha256> [out.json] WHERE THE ARGUMENTS COME FROM, because they are the whole point: /api/build's response carries src_sha256 and closure_sha256, and /api/promote's response carries the live artifact sha256 after the rename. The estate computes real SLSA build provenance on every build and every caller discards it at the end of the HTTP response. This organ is the missing last step: bind those already-computed digests to the artifact they describe and write the in-toto ITE-6 Statement down. THE POLICY THAT MAKES IT SAFE TO RUN LATE: the organ RE-HASHES THE LIVE ARTIFACT ITSELF and refuses when the computed digest differs from the receipt's. Without that check, a stale receipt -- from before a sibling's re-promote, or from a build that never went live -- would mint a Statement binding provenance to bytes that are NOT being served: a false attestation with a valid shape, which is worse than none. The in-toto spec matches subjects PURELY BY DIGEST, so the digest being right is the entire contract. EXITS: 0 statement written, receipt printed | 1 ATTEST-REFUSED, live artifact hash differs from the receipt (both digests printed; NOTHING written) | 2 usage / malformed digest (names WHICH argument) | 3 UNPROVEN, live artifact unreadable -- an absent artifact must abstain, never attest.