nx_secret_scan_gate.nx

nx_secret_scan_gate.nx -- re-runnable GATE for nx_secret_scan + the self-manage closure. (Engineer verb: VERIFY. Team-built, hardware up -- replaces a bash gate, per operator law: no sh/py; capabilities are built INTO the team.) KATs (fixture work uses an ALT issues log in /tmp so the production signal stream the sentinel watches is never polluted by plants): K1 clean tree -> scan(alt) exit 0 K2 planted PW-literal fixture -> scan(alt) exit 1 K3 alt issues log NAMES the planted file with the PLAINTEXT-SECRET marker K4 fixture removed -> scan(alt2) exit 0 again (returns-to-green, tree left clean) K5 planted EMPTY literal (PW="" shred idiom) -> exit 0 (intelligence: hygiene != leak) Then the SELF-MANAGE closure: P1 production scan (real issues log). GREEN posture required for gate green. P2 if prod is green and the issues-log count grew past the last SENTINEL-RESOLVE mark, append "SENTINEL-RESOLVE key=PLAINTEXT-SECRET at=<count>" (idempotent: only when count > mark) -- the Engineer's verify IS the resolve evidence. P3 re-run the security sentinel to refresh posture (its verdict is its own; reported). Exit 0 = 4/4 KATs + prod GREEN. license_tier: ORIGINAL