nx_security_sentinel.nx

nx_security_sentinel.nx -- the team's SECURITY SENTINEL role unit. ONE VERB: WATCH. (RACI clean partition: Engineer VERIFIES, Doctor HEALS, Auditor GRADES maturity, security_status OBSERVES posture -- nobody WATCHED the signal stream. This does.) What it does, every run: 1. Reads the durable issues log (knowledge/status/issues_durable.log). 2. Walks a DATA-DRIVEN WATCH TABLE (pattern, threshold, key) -- counts occurrences. 3. For each row at/over threshold, checks its own log for a SENTINEL-RESOLVE line: "SENTINEL-RESOLVE key=<KEY> at=<N>" -- resolved iff N >= current count (signal grew past the resolve mark => RE-ESCALATES; stale resolves don't mask). 4. Unresolved escalations are appended ONCE (idempotent: skip if the exact PM-ESCALATION key line already exists) to knowledge/status/pm_plan_durable.log. 5. Emits one SENTINEL line per row + one SENTINEL-VERDICT line to knowledge/status/security_sentinel.log. Exit 0 = no active escalation, 1 = ATTENTION. Adding coverage = adding a table row (build intelligence, never strip). Resolving = appending "SENTINEL-RESOLVE key=<KEY> at=<count>" to the sentinel log after the named defect's regression gate is green (Engineer's verify, not ours). license_tier: ORIGINAL