nx_sov_import_lint.nx

nx_sovereignty_audit.nx -- MECHANICAL "no python/sh/java/qemu on the program path" checker. Given a list of .nx source files, it reads each and flags two kinds of sovereignty leaks: (1) any import whose target is NOT a .nx module (a non-sovereign dependency) (2) any exec-target STRING LITERAL naming a third-party interpreter/tool -- "/bin/sh, "/bin/bash, "python, "qemu, "perl, "node, "ruby, "javac, ".jar, "/usr/bin/env (anchored on the opening quote so prose / comments mentioning incumbents do NOT false-positive; only actual string literals are caught) Exit 0 iff EVERY file is sovereign; 1 if any is flagged. This turns "we don't ship non-sovereign deps" from a promise into a repeatable gate (the gate's neg-control proves it actually detects a real leak = liar-kill). nx_sovereignty_audit <file1.nx> [file2.nx ...] license_tier: ORIGINAL