nx_brane.nx

nx_brane.nx -- capability-token cell membrane. Per [[feedback-naming-discipline-no-industry-competitor-overlap]]: "nx_brane" replaces the "container" semantic in cardinal naming. A brane is the cell's membrane -- the boundary that controls what crosses (capability tokens for IO, network egress, file system access, peer messages, etc). THE CORE SECURITY PRIMITIVE. Every IO operation a cell attempts goes through brane capability checks. No capability token = no crossing. This is what makes the substrate's per-cell isolation real (not just a convention). Per Captain Moroni doctrine: every IO is a potential attack vector. Default is DENY; capabilities are explicitly granted at cell instantiation. Granted capabilities can expire (auto-revoke). Composes: nx_cell -- each cell has its own brane nx_restriction -- IO-boundary gate composes brane checks with methyl + pamp + crispr verdicts nx_xenocell -- hostile foreign agent's brane has zero legit capabilities by construction nx_provenance_chain -- capability-check decisions are transforms V1 ships: - sealed enum NxCapKind (10 capability classes) - struct NxCapToken (kind + scope + expires_us + originator) - struct NxBrane with capability_tokens ring - grant + revoke + check + count_active verbs Gap list (V1 honest perf verdict): - capabilities are flat; no hierarchical scopes (V2 adds nesting) - no automatic refresh on near-expiry (caller polls) - cap_check is O(n) linear scan (V2 hash-index if N > ~32)