nx_cwe_scan.nx

nx_cwe_scan.nx -- SOVEREIGN CISQ / ISO-IEC-5055 STRUCTURAL WEAKNESS SCANNER (eats seq250, the biggest GAP in the industry battery). ISO/IEC 5055 grades software by COUNTING CWE structural weaknesses across four of the ISO-25010 characteristics -- Reliability, Security, Performance Efficiency, Maintainability. Until this existed, our SQALE rating was an A partly BECAUSE NOBODY WAS LOOKING: undetected weakness cannot enter the remediation numerator. This is the detector that makes the letter mean something. The CWE->factor mapping and severity weights live in the NATIVE PLANE knowledge/store/cwerules- (never a .tsv, per the law this session just gave a tooth). Detection is structural and must be code; the STANDARD's taxonomy is data. Fails closed: no rules plane -> RED, no grade without the standard. ★HONEST ENVELOPE, STATED IN THE OUTPUT ITSELF: this is bounded TEXTUAL/heuristic analysis, NOT interprocedural dataflow. It reports CANDIDATE weaknesses -- false positives are possible and expected, and crucially ABSENCE OF FINDINGS IS NOT PROOF OF ABSENCE. A scanner that claimed otherwise would be exactly the navel-gazing the scorecard exists to prevent. Every cap (files, bytes/file, guard window) is DECLARED. nx_cwe_scan [dir] [maxfiles] default dir=buildroot/runtime/_hdl_build, maxfiles=1200 license_tier: ORIGINAL expect_exit: 0