nx_toolreg_reap.nx

nx_toolreg_reap.nx -- REMOVE named scaffold rows from tool_allowlist.conf. The counterpart the registry never had: nx_toolreg_reconcile only ever ADDS (rows=830 registered=0 already=815), /api has a tools/register route and NO unregister, and nx_fs_write refuses the allowlist by construction -- correctly, since a tool that can EDIT the capability allowlist can GRANT ITSELF ANYTHING. So scaffold registrations accumulated forever with no sanctioned way to clear them (debt 1785976684). WHY THIS IS SAFE TO EXIST AT ALL, and why it is a separate organ rather than a verb on the registrar: this organ can ONLY REMOVE, never add and never rewrite a target. Removal is strictly DE-privileging -- the worst case is a tool stops being callable, which is a recoverable annoyance, whereas an organ that could add or repoint a row would be a privilege-granting oracle. Single responsibility is the security property here, not a style preference. FAIL-CLOSED PREDICATE: a row is reapable ONLY if its elf path ends in ".new" -- the staged-artifact shape that scaffold aliases have. A row pointing at a promoted ".elf" is REFUSED and reported, so a fat-fingered name can never unregister a live tool. Names are EXPLICIT: there is no wildcard sweep, because rows like nx_meshmerge_staged and nx_ccingest_r7 also point at .new and other seats depend on them. nx_toolreg_reap <name> [<name>...] | nx_toolreg_reap --list (show reapable rows, change nothing) ---- THE SUPERSEDED LANE (2026-08-15) --------------------------------------------------------------- nx_toolreg_reap --superseded <name> <superseded-by> WHY IT WAS ADDED: a rename can leave a PROMOTED duplicate registered (measured: nx_promotestale and nx_servedrift, both superseded by nx_artifactdrift, three registry rows for one capability). The add lane exists (/api/tools/register, nx_toolreg_reconcile), the scaffold-reap lane exists, and there was NO sovereign path to unregister a promoted duplicate -- so duplicates could only accumulate. WHY IT DOES NOT WEAKEN THE DEFAULT: the bare-name lane still refuses every promoted row, unchanged. This lane is opt-in, takes exactly ONE name, has no wildcard, and REFUSES unless the caller also names a DIFFERENT row that is present AND promoted -- so the capability is proven to still have a home. The original property survives: a fat-fingered single name can never unregister a live tool, because one name is no longer enough. And removal stays strictly de-privileging, which is this organ's whole security argument. ⚠THE CEILING, STATED WITH THE REMEDY: this proves a promoted alternative EXISTS, never that it is semantically equivalent. That last step is the caller's judgement and the organ says so rather than implying it checked. ★★★★★A GUARD THAT CANNOT VERIFY THE CLAIM IT GATES MUST NAME WHAT IT DID VERIFY, OR THE NEXT READER CREDITS IT WITH THE STRONGER CHECK. license_tier: ORIGINAL expect_exit: 0