nx_asset_signals.nx

nx_asset_signals.nx -- "WHAT WE NEED TO DO" pillar (R4 of the universal organization-tooling arc). Derives TASK SIGNALS from CATALOG STATE -- "what to do" is not a hand-maintained list, it is a set of PREDICATES evaluated over the inventory snapshot (org_research.tsv CONFIRMED: task-signals-derived, dam-lifecycle). A signal is a deterministic fact about a record that implies follow-up work (provenance missing, untagged, metadata gap, near-duplicate, stale, orphaned, un-transcoded). The derived signals are then EMITTED as work items into a DEDICATED, NAMESPACED workstream store so the live 1265-stream production board (prefix "knowledge/store/ws-") is NEVER disturbed (ADDITIVE law #13). ZERO NEW STORAGE / ZERO NEW IDENTITY / ZERO NEW CRYPTO -- pure COMPOSITION (Rule 15, DRY): * catalog enumeration + bytes -> nx_asset_catalog (cat_list / cat_get / cat_count) * record field access -> nx_asset_record (ar_decode / ar_get : tags, is_current, relations, type, width, height, encoding_format, lifecycle_stage) * cryptographic provenance check -> nx_asset_provenance(prov_verify : a record HAS a verifiable R2 credential iff prov_verify==1) * perceptual near-dup grouping -> nx_asset_autotag (at_neardup over per-record dHashes) * work-item write/list (NAMESPACED)-> nx_seg_store (ss_get / ss_begin / ss_add / ss_commit / ss_open / ss_hget) into a DEDICATED prefix WMS WIRING / PRODUCTION CUTOVER SEAM: The emitted work items use the EXACT record contract of nx_workstream_store (key "sig:<cid>:<code>", a TAB-separated value record, and a "ws:ids" enumeration index), written over the SAME substrate the WMS itself is built on (ss_*). We do NOT import nx_workstream_store directly: it lives in runtime/_hdl_build/ and the sovereign import resolver resolves transitive imports relative to the importing file's directory, so a runtime/ organ cannot reach a _hdl_build/ organ (verified: importing it -> "expand_imports failed"). Emitting straight onto ss_* with the dedicated prefix is therefore the clean isolation: the live board store (WS_PREFIX="knowledge/store/ws-") is a DIFFERENT store and is never opened, read, or written here. THE CUTOVER: when the signals organ is co-located with the WMS (move both under one dir, or expose nx_workstream_store from runtime/), as_emit's ss_* calls map 1:1 onto ws_put_p(AS_PREFIX(), key, val) and as_list onto ws_manifest_p(AS_PREFIX(), ...) -- same keys, same TAB record, same ws:ids index -- so the production daemon can adopt them unchanged. PURITY: as_scan is a pure/deterministic function of the catalog snapshot PLUS caller-supplied parallel auxiliary arrays (perceptual hashes + provenance credentials), because two of the seven predicates CANNOT be answered from the record bytes alone and we refuse to fabricate the answer (Rule 4 / honesty): * NEAR_DUP needs a PERCEPTUAL fingerprint -- the record stores none (a dHash is over the pixels, the decode step is the caller's, per nx_asset_autotag's documented boundary). phashes[i] is record i's dHash, or 0 to mean "no fingerprint available -> cannot be a near-dup". * MISSING_PROVENANCE needs the record's CREDENTIAL + the trusted platform pubkey -- a record alone is