nx_wiki_publish_gate.nx

nx_wiki_publish_gate.nx -- TEETH for A3, the guarded publish wrapper (nx_wiki_publish pub_publish_ex). Proves THE safety property: a guard-REJECTED page can NEVER reach the push path. HERMETIC -- every case is called with do_push_flag=0, so the gate NEVER touches the network/vault/SSH; it asserts the verdict AND that push_invoked==0 exactly where it must be. Cases (each asserts the EXACT machine-readable result, not merely "rejected"/"allowed"): (i) page missing freshness stamp -> status=PUB_REJECTED, code=PG_REJECT_NO_FRESHNESS, push_invoked=0 (ii) page with a dead /wiki link -> status=PUB_REJECTED, code=PG_REJECT_DEAD_LINK, push_invoked=0 (iii) well-formed page (do_push=0) -> status=PUB_ALLOW_NOPUSH, code=PG_ALLOW, push_invoked=0 (iii) proves the ALLOW path is REACHED -- verdict=ALLOW -- while push_invoked=0 confirms that with do_push_flag=0 nothing is pushed. (i)+(ii) prove push_invoked=0 on REJECT = the core safety property: a bad page is fail-closed BEFORE the push path. The ALLOW case PLANTS a real resolvable citation (ss_begin -> war_archive_page -> ss_commit) into a fresh per-run archive store and embeds [[cite:<that cid>]] -- so the guard's archive resolution is exercised end-to-end through the wrapper, not mocked. The page is written to a per-run /tmp file so pub_publish_ex reads it exactly as in production. Appends a PASS line to knowledge/status/wiki_publish_gate.log on all-pass. Exit 0 iff all pass (no fake-green). license_tier: ORIGINAL