nx_provstmt_lib.nx

nx_provstmt_lib.nx -- CR3 of /compare/capregistry: BUILD PROVENANCE AS AN in-toto STATEMENT, pure core. THE FINDING THIS SERIALISES, measured 2026-08-29: every /api/build response already returns src_sha256, src_stable and closure_sha256, and /api/promote returns the live artifact sha256 after the rename. Those fields ARE SLSA build provenance -- what source produced this artifact, the digest of its whole transitive input closure, and the digest of what actually went live -- and every caller discards them at the end of the HTTP response. A CAPABILITY THAT IS COMPUTED, RETURNED, AND DISCARDED BY EVERY CALLER IS DARK IN THE MOST EXPENSIVE WAY: THE ESTATE PAYS FOR IT ON EVERY BUILD AND OWNS IT ON NONE. This rung is therefore a SERIALISATION, not a measurement: nothing new is measured, only bound to a subject and written down. WHY THIS IS NOT AN EXTENSION OF nx_coe_intoto, read before deciding: that exporter's predicate is entirely chain-of-evidence specific (frameHash, pillars, a Merkle inclusion proof) and its ed25519 publicKey is a hardcoded literal. Extending it would fork one predicate across two unrelated subjects. Only the ITE-6 Statement SHAPE is shared, and a JSON scaffold is not a ruler. PURE BY CONSTRUCTION: no filesystem, no syscalls beyond the caller's buffers. The organ owns the re-hash-and-refuse policy; this lib owns validation and serialisation, so the gate reaches every rule in-process and a mutation cannot hide behind a fork boundary.