nx_tokgate.nx

nx_tokgate.nx -- TOKEN PRE-FLIGHT (engineshift ES17): the cheaper read is named BEFORE the expensive one lands. Operator 2026-09-02: "design the llm capabilities around minimizing unnecessary token usage autonomously without my need for engagement as part of our standard ways of working without making the design and coding and other stuff worse." MEASURED the same day by nx_seat_meter_beat residue over 40 days of this seat's transcripts: reasoning 56 permil, authored 245 permil, MECHANICAL 668 permil -- two thirds of every token is tool output re-read into context. The lever is the read, not the thinking. So this rides PreToolUse on Read and on the estate's nx_fs read. It sizes the subject and, when a whole-file read would land more than the floor, names the digest that answers the same question in fewer bytes. It NEVER blocks and emits nothing under the floor: (law) A PRE-FLIGHT THAT CAN REFUSE WILL BE DISABLED; ONE THAT ONLY INFORMS SURVIVES -- and one that fires on every small read becomes noise that gets switched off. (ASCII only in this file: a non-ASCII byte in the source arrived on the NAS twin 2 bytes longer through the JSON argv lane, so the two trees could not be proven identical by hash.) The floor is DATA (hooks/tokgate.conf, floor_bytes|N); when the conf is unreadable the bootstrap floor is used and the message SAYS floor_src=bootstrap, so a silent default can never masquerade as a measurement. NO POWERSHELL IN THE PATH: this organ parses the hook JSON itself. Sibling of nx_memnew / nx_organnew. nx_tokgate [conf-path] [shellverb-conf-path] stdin = the PreToolUse payload; stdout = {"systemMessage":...} or nothing ES22 / sovereignty SV3 (2026-09-05) -- THE SHELL INTERLOCK, tg_shell_interlock. Operator, verbatim: "stop using its own tools when it loads and to use these and nishi estate only and if there is a gap to build into the nishi estate from the first byte, no more ps1 and python and shell". The same organ now also rides PreToolUse on Bash and PowerShell: it reads the command and, from DATA (hooks/shellverb.conf: tree | allow | verb rows), names the estate verb that does the same work -- one row per DISTINCT verb, each stat'd against the declared source trees so the advisory can never name a verb the tree cannot show (source=present / ABSENT / unverified) -- or prints GAP when no row matches, never a guess. The sanctioned launcher (wsl -e _offc/<organ>.elf) is allow-listed by needle and draws nothing. Advisory only: the interlock exists because the law was prose in two channels, and the estate has measured what happens to an invariant that depends on a seat remembering (nx_memnew: the same doctrine written 4x with the organ one call away). license_tier: ORIGINAL. No writes. No hw writes (Rule 26).