nx_log_category.nx

nx_log_category.nx -- sealed-enum log-field classification with structural people-data refusal. User directive 2026-05-17: "yes we want logs for systems not people and s class". The sealed enum makes the system/people distinction LOAD-BEARING: every log call declares its category; the emitter refuses to transmit PEOPLE_* categories without an explicit caller-supplied override token. This is structural prevention, not policy hope. Sealed-enum NxLogCategory (8 states): SYSTEM categories (default-allowed): SYSTEM_STATE daemon uptime, state transitions, version SYSTEM_PERF latency p50/p95, throughput, queue depths SYSTEM_ERROR errno, crash dumps, aggregate error counts SYSTEM_CONFIG config loaded, env var set, capability flag SYSTEM_SECURITY auth failure AGGREGATE COUNT (not per-user) PEOPLE categories (refused by default; require override): PEOPLE_PII IP, UA, cookie, fingerprint, email, name PEOPLE_BEHAVIOR per-user click path, dwell time, navigation PEOPLE_LOCATION geo-IP, coarse city, precise GPS Per cardinal feedback-privacy-by-default-no-tracking: - SYSTEM categories serve operations: capacity planning, alert thresholds, crash diagnosis, performance regressions - PEOPLE categories enable surveillance: subpoena targets, advertising profiles, behavioral manipulation Substrate's structural enforcement: Default emit accepts ONLY SYSTEM categories. PEOPLE category emit requires an explicit override token whose value carries a citation (legal requirement / regulated industry carve-out / user-explicit-consent flow). The grader scans for override tokens + ensures each has a justification annotation. nx_capability_claims: needs: [sealed_enum, byte_ops]