nx_sov_guard.nx

nx_sov_guard.nx -- SOVEREIGNTY / NO-NEW-TSV guard (hardware-rung-up). Enumerates a data dir with its OWN getdents64 (no find/ls/grep = no non-nishi tooling) and flags every *.tsv file NOT in the allowlist (knowledge/registry/tsv_allow.list -- grandfathered legacy/other-ws stores, owner-noted). Enforces "stop the creation of new tsv": a NEW non-allowlisted .tsv -> VIOLATION -> RED. As a workstream migrates its tsv -> sovereign seg-store, it removes that line. The sovereign seg-store (knowledge/store/<ns>-*) is the preferred store; this guard is the ratchet that keeps it the default. usage: nx_sov_guard [dir=knowledge/status] [allowlist=knowledge/registry/tsv_allow.list] exit 0 GREEN (no new tsv) / 1 RED (a new unallowlisted tsv) / 2 ERROR (dir unopenable) license_tier: ORIGINAL