nx_pamp_meta.nx

nx_pamp_meta.nx -- FALSE-pattern detection (deepest layer). Per [[feedback-unified-immune-architecture-three-tier]] item 2.3: "DEEPEST LAYER recognizing FALSE patterns themselves; deception requires maintenance + maintenance leaves traces; statistical- ensemble across byte+structural+behavioral+temporal+side-channel; disguise can hide in one channel not all." nx_pamp catches KNOWN attack patterns (NOP sled, homoglyph, etc). nx_pamp_meta catches DECEPTION ITSELF -- the subtle inconsistencies that arise when something is pretending to be what it's not. A sophisticated mimic can fool one channel (byte pattern); few can fool ALL channels (byte + timing + structure + entropy + relational). THE STRATEGIC INSIGHT (per user 2026-05-19 mimicry directive, applied INVERSELY here): if WE can fool vendor scanners through mimicry, then ANY adversary trying to fool US faces the same problem -- their disguise has to be consistent across multiple orthogonal channels, and maintenance of multi-channel consistency is exponentially harder than single-channel. V1 channels measured: 1. BYTE_DISTRIBUTION -- chi-squared deviation from expected distribution for declared content type 2. STRUCTURAL_SHAPE -- field count + nesting depth + size ratios 3. TIMING_VARIANCE -- inter-arrival timing of bytes in stream (real systems have hardware-jitter signature; emulated ones don't) 4. ENTROPY_PROFILE -- entropy at start vs middle vs end (legitimate content has a profile; packed/encrypted has different profile) Cross-channel consistency check: each channel returns a per-channel "looks legit" Q10 confidence; the META verdict is HIGH-DECEPTION when channels DISAGREE strongly (one says legit, another says fake) even if each individual channel passes its own threshold. Composes: nx_pamp -- shipped V1; meta layer LAYERS ATOP pamp (pamp is single-channel; meta is multi-channel)