nx_opennet_posture_gate.nx

nx_opennet_posture_gate.nx -- liar-killed GATE for the open-net posture ruler (S15/O2). Proves the security invariant DISCRIMINATES: unauth-deny surfaces PASS only on 401/403, a DENY surface that serves 200 is caught as a LEAK (not a silent pass -- the load-bearing negative control), public surfaces PASS only on 200, redirects on 301/302, an unreachable/parse-fail is UNREACH (never a fabricated PASS), the HTTP-status parser handles real response lines + rejects non-HTTP, and the sovereign-edge header check detects our stamp + rejects its absence. Exit 0 only on all-PASS. license_tier: ORIGINAL expect_exit: 0