nx_sup_kernel_witness.nx

nx_sup_kernel_witness.nx -- SECOND-METHOD-CLASS WITNESS for the SUPERVISOR domain (2026-08-03). WHY: nx_sota_status holds 40 domains at MECH-OK -- 'executed evidence GREEN; awaiting a 2nd independent method class' -- and supervisor is the lowest-coverage of them (347). The recipe is proven twice (videocodec/ffmpeg-psnr, coding/library-refetch): find an EXTERNAL artifact that can DISAGREE with us, run both, sign the row. Here the external authority is the LINUX KERNEL'S OWN BOOK-KEEPING -- the /proc process table and the /proc/net/tcp{,6} LISTEN socket table -- an accounting we did not write and cannot wish into agreement. THE CLAIM UNDER TEST: mgmt_snap.json, the snapshot the supervisor itself writes each poll ('SVC <name> <port> UP <procs> ...'). For every service the supervisor claims UP: axis 1 (process table): at least one live pid whose cmdline names the service binary axis 2 (socket table): when port>0, a LISTEN socket on exactly that port PRESENCE, not process-count equality, is asserted DELIBERATELY: sites.elf preforks workers, so the snapshot's procs=1 and the kernel's 5 pids are DIFFERENT UNITS -- comparing counts would manufacture a false disagreement (do the arithmetic in the unit the criterion is written in). DISCRIMINATION IS PROVEN IN-RUN, never assumed: a fabricated service name and a fabricated port are checked the same way and MUST come back absent; if either 'confirms', the run is INVALID -- a witness that cannot refuse cannot confirm. exit 0 = GREEN (every UP claim kernel-confirmed on both axes, negative controls refused) 1 = RED (the kernel DISAGREES with a supervisor claim -- a REAL finding, report it) 2 = snapshot unreadable/empty (cannot witness a claim nobody made) 3 = NEGCTL-INVALID (the instrument cannot refuse -> no verdict, never a pass) license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0