nx_extllm.nx

nx_extllm.nx -- THE EGRESS WARDEN: the front door every external-model call must pass. Rungs XL1 (terms ledger) + XL2 (egress classifier) of /compare/extllm -- the CODE half of two conf files authored 2026-08-24 whose reader never landed. MEASURED 2026-08-25 before building: xl_egress is ABSENT over 61,475 files (coverage_complete=1 corpus_complete=1), and NO source in the 23,235-file corpus even names extllm_terms.conf -- 13 fully-pinned provider rows sitting inert with zero readers. Every third-party LLM vendor host is likewise ABSENT-PROVEN, so there is no egress path in the estate today. That is the rare chance to put the guard in the path BEFORE the path exists. THE CUMULATIVE BOUND IS THE POINT: splitting work into parts defeats a SINGLE call and does nothing about aggregation ACROSS calls. Motro, Marks and Jajodia (ESORICS 1994) describe their controlled-disclosure system as foiling attempts to attack secrets by breaking queries into sequences of smaller requests. Splitting is the attack that literature answers, not the answer. The odometer is the mechanism. NOT differential privacy: a DP epsilon is quantified over the coin flips of a randomised mechanism (Dwork and Roth, Definition 2.4). A verbatim fragment has no coins, so epsilon is infinity here and every composition theorem is vacuous. This organ prints BYTES, which it can measure, never an epsilon. terms <provider> <tier> <use> -- may this provider serve this use class classify <path> <sha256> -- U or C for one path against the operator manifest spent <provider> <ledger> -- cumulative bytes this provider has EVER been shown selftest -- gv_verdict gate, in-memory fixtures, no shared state exit 0 ALLOW / 1 REFUSE / 3 UNKNOWN-REFUSED / 2 usage. license_tier: ORIGINAL. No hw writes (Rule 26).