nx_security_census.nx

nx_security_census.nx -- HONEST measure of the ecosystem's SECURITY coverage across the four surfaces a serious adversary actually works: OVER THE WIRE (transport/auth/crypto), IN THE NETWORK (host/lateral/ tenancy), ON THE DEVICE (firmware/boot/supply), and THE AGENTS (the surface unique to an AI-operated substrate). For each control: HAVE iff a real sovereign organ opens on disk (existence != correctness -> the per-organ gate is the ratchet); GAP = a ranked target the growth loop must BUILD = the roadmap. The headline number is the WEAKEST-LINK coverage_permil (critical controls, marked *, weigh 3x): a missing CRITICAL control -- e.g. PQ built-but-UNWIRED, or the host NOT isolated -- drags the grade, because a primitive that does not defend the LIVE path is not coverage. That number is written to the durable log and the ecosystem-maturity rollup live-derives the `security` domain grade from it (measured, never asserted). Sibling of nx_adversarial_census (adversarial-VERIFICATION coverage); this is attack-SURFACE coverage. license_tier: ORIGINAL