nx_pq_hybrid.nx

nx_pq_hybrid.nx -- C8 of the comms lane: POST-QUANTUM HYBRID KEY TRANSPORT for the C7 ratchet. Contract symbol pqh_kex == the /compare/comms C8 watch. REFEREE: nx_pq_hybrid_gate. DONE-RULE (comms.plan): hybrid classical+KEM ratcheting in the C7 tree (Signal SPQR / triple-ratchet class): the gate proves a classical-only decryption fails AND a KEM-only decryption fails -- both families must break. WHAT IT DOES: C7 distributes each epoch's commit_secret to the remaining members over X25519-only ECDH. C8 replaces that transport with the X25519MLKEM768 HYBRID KEM (TLS 1.3 named group 0x11EC, draft-ietf-tls-ecdhe-mlkem): the wrap key is derived from a 64-byte secret that is ml_kem_768_shared(32) || x25519_shared(32), so recovering it needs BOTH the elliptic-curve secret AND the lattice KEM secret. An adversary who breaks X25519 (a future quantum computer solving ECDH) still cannot read the commit secret without also breaking ML-KEM-768 -- and vice versa. Because the commit secret drives every subsequent epoch, this defeats harvest-now-decrypt-later on the whole forward chain, which is exactly the property Signal's SPQR triple ratchet added in Oct-2025. PURE COMPOSITION, no new crypto: it forks NOTHING and imports the sovereign hybrid KEM (nx_x25519mlkem768, itself x25519 + ml_kem_768) plus sha256 (HMAC/HKDF) and chacha20 (RFC 8439). No WebRTC, no OpenSSL, no liboqs -- the ML-KEM here is the estate's own FIPS 203 implementation. THE PROOF, mechanical: unwrap takes a `corrupt` argument that damages ONE half of the recovered 64-byte hybrid secret before deriving the wrap key -- corrupt=pq models an attacker who has the classical half but not the lattice half (broke ECDH, not ML-KEM), corrupt=classical the reverse. Either damaged half fails the HMAC and decrypts NOTHING; only corrupt=none succeeds. That is the two-independent-families claim made falsifiable. DEBT NAMED, not hidden: mg_hmac/mg_derive/hex/file helpers here are the same shapes as nx_mls_group. Extracting them to a shared nx_kdf_lib that BOTH C7 and C8 import is the correct DRY move and is filed (comms.plan debt kdf-lib-extract); shipping C8 independent now lands the verified exceed without re-opening the just-gated C7 binary in the same breath. license_tier: ORIGINAL No hw writes (Rule 26).