nx_battery_safety.nx

nx_battery_safety.nx -- BMS substrate (Captain Moroni Phase M2). Per [[feedback-captain-moroni-doctrine]]: "HARD CEILING on commanded charge/discharge rates. Substrate REFUSES to compile code that bypasses thermal limits. Refuses microcode that disables BMC overcurrent protection. ANY commanded thermal-runaway condition triggers compile-time refusal + substrate alert." THE HEZBOLLAH-PAGER PRIMITIVE. September 2024 attack used compromised firmware to command battery into thermal runaway as an explosive trigger. Per Captain Moroni: substrate refuses code patterns that could weaponize a battery. Not policy — STRUCTURAL refusal. Safety envelope (operator can NEVER bypass without twin-key): - max_charge_rate_q10: ceiling on commanded charge mA - max_discharge_rate_q10: ceiling on commanded discharge mA - max_cell_temp_milli_C: hard ceiling on commanded thermal target - min_cell_voltage_mv: floor (under-voltage protection) - max_cell_voltage_mv: ceiling (over-voltage protection) Any nx_battery_command that violates these is REFUSED at this layer. The caller would normally pass through nx_intent_check_operation first (NX_OPK_COMMAND_BATTERY requires Defensive intent); even with Defensive intent, the safety ceilings hold. Composes: nx_intent -- caller must declare Defensive intent nx_evict_journal -- every refused command logged loudly nx_vitals -- physical instrumentation can spot real-world drift from declared safety envelope V1 ships: - struct NxBatterySafetyEnvelope (per-cell-pack safety limits) - 5 sealed command kinds (CHARGE/DISCHARGE/REST/CALIBRATE/THERMAL_TARGET) - validate_command predicate -- substrate refuses unsafe asks - thermal_runaway_pattern detector (3+ rising-thermal commands in N seconds = explicit refusal + alert)