nx_spore_germ_gate.nx

nx_spore_germ_gate.nx -- V-SPORE-1 PROOF (X-SEED-002): germinate ONE ecosystem piece from its content-addressed manifest entry and prove it by BEHAVIOR (KAT exit code). A tampered piece is rejected on the INTEGRITY gate and is NEVER built or run. Per NISHI_SPORE_SEED_PORTABILITY_CHARTER germination loop (1:1 PROOF, KAT-as-oracle): 1. PACK -- manifest entry = FNV-1a(canonical piece bytes) + kat_expect exit code. 2. INTEGRITY -- received bytes FNV-1a == manifest hash, else REJECT (never run). 3. MATERIALIZE-- write the VERIFIED bytes to runtime/_germ_scratch_<piece>.nx so the piece's imports resolve via the normal runtime/ tree exactly as the canonical organ's do. Fully isolated-dir germination needs explicit import closures (charter [F2]) = the named follow-on V-SPORE-1b. 4. REBUILD -- the SOVEREIGN toolchain rebuilds the materialized bytes via _offc/nx_sov_build_run.elf (nx_cc_sovereign + nxasm, empty-.s guard). 5. BEHAVIOR -- fork/exec the rebuilt ELF; exit code == manifest kat_expect = 1:1 proof. ADMIT iff INTEGRITY-clean AND rebuild rc==0 AND kat_exit==kat_expect. Controls: POSITIVE = intact nx_exit42 piece -> ADMITTED (kat_exit 42). NEGATIVE = same piece, one byte flipped -> INTEGRITY mismatch -> REJECTED, build+run NEVER reached (admitted count must remain exactly 1). RUN FROM the nxc2 cwd (relative _offc/ runtime/ knowledge/ paths). Build: _offc/nx_sov_build_run.elf nx_spore_germ_gate -> /tmp/nx_spore_germ_gate.sov.elf Verdict line is appended to knowledge/status/spore_germ.log. genealogy_id: nishi_spore_seed_portability_charter_2026-05-28 (X-SEED-002 / V-SPORE-1) lineage_id: spore_germ_proof_v1