nx_routeguard.nx

nx_routeguard.nx -- THIN ORGAN: run the deploy-contract check between two binaries. nx_routeguard <live-artifact> <candidate-artifact> Answers ONE question: does the candidate still serve every /api/ route the live one does? exit 0 GREEN (superset -- safe on this axis) | exit 3 RED (routes vanished) | exit 2 REFUSED. USE IT BEFORE EVERY mgmt DEPLOY. The 2026-07-30 regression (5th occurrence) happened because a 528323-byte artifact was promoted over a 575195-byte one and nothing compared their surfaces -- the deploy reported success while /api/gate_run and /api/proc_kill silently vanished, and the sovereign process-kill verb was gone exactly when a runaway process needed killing. REFUSES RATHER THAN BLESSES: if the LIVE image yields zero routes, this exits 2, because "0 missing" computed from an empty expectation reads as SAFE while guaranteeing nothing. A guard that cannot see its subject must say so, not pass it. license_tier: ORIGINAL Read-only -- it never promotes, deletes or writes. (Rule 26) expect_exit: 0