nx_drone_doctrine.nx

nx_drone_doctrine.nx -- sealed defensive-only purposes (Phase M3). Per [[feedback-captain-moroni-doctrine]] Phase M3: "Sealed type with ONLY defensive variants. NO Lethal / Targeting / Strike variants — substrate refuses to instantiate them. The substrate REFUSES to compile drone code outside the sealed defensive set. An attacker cannot use NishiLang to BUILD a killer drone — the type system rejects the program." THE STRUCTURAL REFUSAL OF LETHAL AUTONOMY. The cardinal's hardest and most important primitive. By making the offensive variants UNREPRESENTABLE at the type level, an attacker forking NishiLang to build a killer drone has to extend the type system itself -- which announces the offensive intent and is detectable by every downstream user of the fork. Defensive purposes shipped V1 (the ONLY admissible drone uses): - DEFENSIVE_FAMILY -- perimeter alert around family - DEFENSIVE_PROPERTY -- perimeter alert around land/buildings - SEARCH_LOST -- find missing persons - SEARCH_HAZARD -- identify environmental hazards - INSPECTION_INFRASTRUCTURE -- power lines / agriculture / building - INSPECTION_AGRICULTURE -- crop health, irrigation, herd - INSPECTION_BUILDING_INTEGRITY -- roof, structural EXPLICITLY ABSENT (and refused at the type system): Lethal, Targeting, Strike, Surveillance-of-non-consenting-person, Attack, CrowdControl, Reconnaissance-of-private-property-without-consent. Per Captain Moroni: every drone instantiation requires a NxDronePurpose that is one of the sealed defensive values; runtime further requires Defensive intent + twin-key authorization if purpose involves real-world flight (vs simulator). Composes: nx_intent -- caller must declare Defensive nx_brane -- CAP_DRONE_ACTUATE must be granted + scope-narrowed per purpose nx_evict_journal -- every instantiation logged with purpose + ops