Developer Guardrails and the Agentic Control Plane

Nishi MEASURED 2026-08-14 by nx_capsearch's own corpus count (considered=1028); every one is ocap-gated and callable by an AI seat with an attenuated token. Peer columns reflect published MCP-server availability as of 2026-08 [mcp-spec], not tool counts, which are not comparable across products

GitHubActions MCP server (2025+)GitLabCI MCP serverJenkins plugins, no MCPSonarQube limitedSemgrep limitedSnyk limitedDatadog MCP serverOpenTelemetry n/a specBackstage pluginsLaunchDarkly SDK/APIKubernetes kubectl-ai era

Nishi MEASURED 2026-08-07 by nx_gatesubj + nx_biteall over the whole tree. Published deliberately: 2,287 gate sources nothing invokes is the estate's largest honest gap, and 0 invocation gaps means every gate anything runs is deployed and byte-identical to source

GitHubActions n/a (workflow files)GitLabCI n/aJenkins n/aSonarQube rulesetsSemgrep rulesetsSnyk rulesetsDatadog monitorsOpenTelemetry n/aBackstage n/aLaunchDarkly flagsKubernetes admission ctl

Nishi MEASURED 2026-08-14 via nx_cron_watch: each beat's evidence log carries a heartbeat and a max-age; a missed beat becomes STALE rather than silently absent. Peers schedule work but rarely ship the freshness assertion itself

GitHubActions schedulesGitLabCI schedulesJenkins timersSonarQube n/aSemgrep n/aSnyk n/aDatadog monitorsOpenTelemetry n/aBackstage n/aLaunchDarkly n/aKubernetes CronJob

Nishi never-brick promote: health-checked, .prev-banked, auto-rollback, verified live this session (DEPLOYED-GREEN after a daemon self-deploy). LaunchDarkly's flag flip is the fastest human-facing undo in the field and is graded Best for that reason

GitHubActions manual/actionGitLabCI manualJenkins manualSonarQube n/aSemgrep n/aSnyk n/aDatadog n/aOpenTelemetry n/aBackstage n/aLaunchDarkly instant flag flipKubernetes rolling undo

Every compiler promotion passes nx_cc_equiv_gate (10 differential rows + a self-host fixpoint) and a 49-cell gauntlet before the canary door; hosted CI is the industrial bar for breadth and parallelism

NO BRANCHES to protect: the substrate is content-addressed and promotion is gated at the artifact, not the ref [gh-branch-protection]. Honest No -- and the sovereign git host is DOWN and unsupervised (filed), so this is a real gap, not a design flourish

Nothing implements a freeze window. LaunchDarkly-class kill switches are the bar. Filed, not designed away

/api/deploy runs a pre-deploy gate and reports DEPLOY-SAFE with a blocker count before promoting; the promote door separately refuses on a digest mismatch, a capability-loss diff, or a backwards artifact

expect_sha256 is REQUIRED on promote: it refuses unless the staged bytes are exactly the ones the caller verified, which is the only check that catches a same-size substitution. Sigstore-class signing is the nearest peer practice [sigstore-docs]

No canonical formatter exists -- gofmt is the bar and this is a filed rung, not a stance

nx_cwe_scan + nx_secret_scan_gate + nx_srclint exist and the secret gate is currently RED and uninvoked (filed); Semgrep/Snyk are the bar for rule breadth and CVE currency

The deepest teeth here and no peer's equivalent: the compiler refuses float-into-integer stores at all six store sites, out-of-range constant shifts, discarded pure expressions, non-exhaustive matches, wrong call arity and both directions of pointer/integer confusion -- each with a 5W plus H message naming the fix. A linter suggests; this refuses. EVIDENCE (this cell carried none until 2026-08-14): nx_langdiag_gate runs the whole language-diagnostic probe corpus, 11 rows GREEN, with in-tree witnesses per refusal (nx_probe_ub_shift.nx for the constant over-shift); each refusal stamps a greppable capability slug at the point of friction -- capability=shift-count-range is emitted from nx_parse.nx:3853 and asserted by the gate, so the claim is checkable at a line number rather than described

nx_langdiag_gate asserts each refusal names ITS OWN rule or capability slug, bite-proven by planting a slug the rule never prints (exit code matched, reason did not). Most suites assert only that something failed -- blind by construction, and this estate had that hole until 2026-08-14

Zero third-party packages by doctrine, so nothing scans them; source carries license_tier headers and nx_licgate exists. Graded No because the CHECK is absent, not because the risk is

nx_gate_bite plants known-bad mutants and demands RED; a gate that has only ever passed is unverified. Essentially absent from mainstream CI practice

No SBOM is produced. Zero third-party packages makes the inventory trivial to state and that is exactly why nothing states it -- an unstated inventory is not an attested one. Syft/Snyk-class output is the bar [spdx-spec]

Nothing scans a shipped artifact for known CVEs. nx_nvd_ingest pulls the feed but no organ joins it to what we run

No OPA/rego-class policy engine; guardrails are hand-written organs, so a new policy is a build rather than a rule. Kubernetes admission control is the bar [k8s-admission] and the 2026 MCP literature specifically names AI-updated global policy as the pattern to reach for

Nothing defines an SLO or an error budget, so nothing can burn one [sre-slo]; resource envelopes are asserted per change but not tracked against a target

Gates write durable verdict logs and a dead-man switch flags a stale beat, but no alert reaches a human -- a RED at 3am waits for a seat to read it

Absent. Resource counters are sampled per beat; there is no CPU/heap profile attributable to a code path

Absent by posture as much as by gap -- the surfaces ship zero third-party script and no telemetry beacon, so field performance is inferred from synthetic checks only

nx_page_verify is browser-grade (TLS handshake, asset fetch, PNG deep-decode, a11y-lite) and runs on the publish beat; Datadog Synthetics is the bar for geographic breadth

Health-checked restart plus a supervisor guard and hostctl sentinel on a 1-minute beat; Kubernetes liveness probes are the bar [k8s-probes]

Deploy waits on a health check and rolls back, but there is no separate readiness signal that holds traffic; Kubernetes is the bar [k8s-probes]

The language-probe corpus runs as a NishiLang gate that asserts exit code AND the required diagnostic substring, with acceptance rows as the discrimination control and an UNRESOLVED third state when the subject is missing. It replaced hand-written shell scripts on 2026-08-14

CORRECTED 2026-08-14: this row previously claimed a per-minute beat. MEASURED against the live clocksched- plane: nx_procchurn 300s and nx_resgov 600s were on the clock, nx_resmon had NO ROW AT ALL, and no cadence was verified for nx_ctxtop. A COMPARE ROW IS A CLAIM, NOT A MEASUREMENT. Now declared: resmonbeat 300s (matching procchurn, its closest analogue -- both are /proc censuses) and memvelbeat 240s. Its leak axis is now VELOCITY-based (nx_memvel's sustained-grower count over N windows) rather than the VmSize==VmPeak SNAPSHOT, which cannot express growth at all, flagged the arena-once leak-FREE design as a leak, and therefore held this organ RED PERMANENTLY at 17 suspects against a red threshold of 6 while the true sustained count was 0. Stale or absent velocity data degrades the axis to UNOBSERVABLE, which casts no vote in either direction. resmon.log is append-only and unbounded, so it is now watched by nx_sizeguard at the sibling's proven budget (1 MiB / 20000 lines) -- fail loud before a reader truncates, never rotate, because nx_jrnlguard correctly treats a shrinking journal as a clobber. Measured attribution proved NAS churn was DSM, not the estate. Datadog is the bar

Every gate writes its own timestamped verdict log because a RED that lands in a vacuum is not a measurement; the actlog journal mines tool/verb frequency

No trace context propagation exists. OpenTelemetry is the standard [otel-spec] and this is a genuine absence

The loop no peer ships: capability-limit refusals stamp greppable capability slugs at the moment of friction, /api/build appends them to a durable demand journal, and the mine re-ranks the build order from real usage. Refusal to roadmap with no human in the circuit. EVIDENCE (this cell carried none until 2026-08-14): the journal is knowledge/status/lang_demand.jrnl -- epoch, slug, target; append-only, bounded at 8 rows per build, and it can never fail a build. LIVE-BITTEN 2026-08-13: a single refused build wrote its 3 rows the moment it failed, which is the whole loop demonstrated end to end rather than asserted

Absent: risky daemons are tested on a spare port by hand. Filed

Config-driven switches exist (opt-in debug emission, an opt-out crash guard, conf-gated lanes) but there is no flag service with targeting or instant kill; LaunchDarkly is the bar

nx_catalog answers is-it-there-and-is-it-WIRED across the full chain -- source, built, staged, promoted, registered, authorised, invoked -- with a weakest-link verdict. Backstage is the field bar for humans; this one is machine-readable and it is how the unregistered addr2line binary was found

The entire build-gate-promote-deploy loop is driven by an AI seat over MCP [mcp-spec] in this very session; peers expose an MCP server over a product, not a whole sovereign ops plane

X-Nishi-Cap ocap tokens [capmyths03]: attenuate-only, scoped per tool, expiring, revocable by nonce, every delegation audited to a consent log, and fixed-arg pinning so a hostile argv cannot escalate a pinned tool. The MCP ecosystem's own 2026 literature names secrets brokering and agent authorisation as its top unsolved risk. EVIDENCE (this cell carried none until 2026-08-14): least-authority was PROVEN live 2026-07-08 -- a read-scoped cap presented to nx_mgmt is denied with reason 4 while the same cap serves its own tools, and fixed-arg pinning was demonstrated by handing nx_status a hostile [selfswap] argv which it ignored in favour of the pinned sub. Every delegation is appended to cap_consent.log, and revocation is by nonce against cap_revoked.list

One upsert call updates the hub from the sovereign registry; 48 domain spokes re-measure and republish on a 6-hourly beat, and an orphan census reconciles docroot directories against the roster with parts that must sum. EVIDENCE (this cell carried none until 2026-08-14): the census MEASURED census dirs=71 matrix=50 radar=7 hand=14 ORPHANS=0 parts-sum OK on the 2026-08-14 beat -- a printed partition that reconciles, which is the difference between claiming no sprawl and showing that the parts add up to the population

Watch contracts named for a not-yet-existing symbol are measured every emit, so a page flips from OPEN to LANDED the moment the organ ships -- proven twice with real ships, zero hand edits, and the contracts are stored as sovereign plane rows that double as the PM intake queue

A swarm family exists (admit, coord, place, job, heal, shardserve) and seat coordination runs over a workstream plane with leases and checkin/checkout; Kubernetes scheduling is the bar for maturity