nx_path_canonicalize.nx

nx_path_canonicalize.nx -- structural CWE-22 path-traversal prevention. Named by nx_bug_tape_intelligence.sh F1 rule as rank-5 next ship- order. Closes the path-traversal class STRUCTURALLY: caller provides a base directory + a user-supplied relative path; this primitive returns either NXP_OK with the canonical path, or one of five sealed-enum rejection verdicts. No "partial" path return, no silent fixup, no late escape. The CWE-22 attack shape: user submits `../../../etc/passwd` (or URL-encoded equivalent), web framework joins it with base + opens the resulting path, leaking outside the intended directory. Substrate's structural prevention: 1. Reject ANY `..` segment outright (no "join + normalize") 2. Reject leading `/` (caller's base is the only absolute path) 3. Reject NUL bytes (truncation attacks) 4. Reject backslash on POSIX targets (no Windows-path confusion) 5. Reject empty path (no implicit index) 6. Reject paths > caller's max_len (resource bound) Sealed-enum verdict: NXP_OK validated path written to out_buf NXP_TRAVERSAL contains `..` segment or leading `/` NXP_NUL contains NUL byte NXP_BACKSLASH contains backslash (POSIX target) NXP_EMPTY zero-length input NXP_TOO_LONG exceeds max_out NXP_BAD_ARG null pointers / negative sizes Per cardinal feedback-defensive-at-boundaries-trusting-internally: canonicalize ONCE at the user-input boundary; trust the canonical path internally. Per cardinal user-owns-every-bit: caller provides base + max_len + out_buf. Substrate never reads/writes filesystem; this is a pure validator + byte-copier. nx_capability_claims: needs: [sealed_enum, byte_ops]