nx_access_wall.nx

nx_access_wall.nx -- the unified POLICY DECISION POINT (NIST SP 800-207 PDP) for the access-provisioning wall. ZERO-TRUST: a request is ALLOWED only if EVERY layer permits; DENY-BY-DEFAULT + FAIL-CLOSED otherwise. It does NOT reinvent any security primitive -- it COMPOSES the existing security workstreams: L1 network tier -> nx_nettier (nt_meets): is the peer's tier >= the area's required minimum? L2/L5 identity policy -> nx_vault_acl (acl_eval): deny-by-default, explicit-deny-wins, longest-prefix grant L3 device -> a provisioned-device flag (mTLS client cert, nx_device_cert -- R4) L4 abuse -> a rate-ok flag (nx_rate_limit) The enforcement point (a daemon, e.g. nx_sites_daemon_v2 / nx_cms_admin) gathers the signals (peer_ip->tier, session->role->policy, cert->device_ok, nx_rate_limit->rate_ok) and calls aw_decide once. The specific deny CODE is returned so nx_access_audit (L6) can log WHY. license_tier: ORIGINAL