nx_nxe_loader.nx

nx_nxe_loader.nx -- GATE: the NATIVE NXE LOADER that VERIFIES then EXECUTES (composes nx_nxe_lib, rule-15 DRY). Closes the EXEC-FORMAT census gap ("emit organs AS .nxe + a native NXE loader/boot" -- organs were ELF-only, the NXE format was write+header-check only). This loader actually RUNS the code section: mmap RWX -> copy the verified code -> cast the entry to a function pointer -> CALL it on this machine (proven by nx_nxe_exec_probe). THE EXCEED vs ELF/Mach-O/PE (grounded osb_elf/osb_loader): verify-BEFORE-execute BY CONSTRUCTION. An ELF loader maps+jumps to whatever bytes are present; NXE refuses to even map-exec a binary that fails ANY of: (1) INTEGRITY -- a FIPS-180-4 SHA-256 of the code section, baked in the header; a tampered byte -> refused. (2) CAPABILITY -- the binary must DECLARE the EXEC capability to be executed (least-privilege manifest). (3) NEVER-BRICK (cardinal 26 in the format) -- a HW_WRITE binary without a never-brick proof -> refused. Only after all three pass does a single byte execute. Payload = a REAL function f(x)=x*x+1 in x86_64 machine code. T1 write+load+EXECUTE (f(7)=50, f(12)=145). T2 tamper->SHA-256 fail->REFUSED(-2), never executes. T3 no-EXEC-cap->REFUSED(-4). T4 HW_WRITE w/o never-brick->REFUSED(-3); with proof->runs. T5 disk .nxe round-trips+runs. expect_exit: 0 Sovereign: nx_cc->nxasm via nx_syscalls + canonical nx_sha256. NEVER-BRICK: RAM + a file, 0 firmware.