nx_toolsafety_lib.nx

nx_toolsafety_lib.nx -- THE ONE MCP SAFETY-FLAG DERIVER (2026-08-25). Write reach, destructive reach, network reach and exec reach for an organ, derived from its TRANSITIVE import closure, with line comments AND string literals stripped, and syscall DEFINITIONS skipped. WHY A LIB, AND WHY NOW. Two derivers already shipped and DISAGREED BY CONSTRUCTION. nx_schema_backfill (sb_derive_flags) scans ONE FILE, so an organ that writes through an imported helper reaches the write syscall in the LIB and is published readOnly=1 -- wrong in the UNSAFE direction. nx_toolflags folds ONE level of the import closure and strips comments, and its own header set the condition for this extraction in advance: two consumers is not yet a lib, but if a third appears, extract it and delete the copy. The third consumer arrived (the drift control), so this is that extraction. WHEN TWO ORGANS MUST AGREE, MAKE DISAGREEMENT IMPOSSIBLE BY CONSTRUCTION: THERE IS ONLY ONE OF IT. THREE CHANGES FROM THE INCUMBENTS, EACH FOR A REASON THAT WAS MEASURED, NOT PREFERRED: 1. TRANSITIVE closure, not one level. A helper that reaches a writer through a helper of its own is two hops away and one hop cannot see it. The depth LADDER is published per subject, so the contribution of the extra depth is evidence rather than a claim about what it bought. 2. STRING LITERALS ARE STRIPPED TOO. The incumbent declared this a rare limitation erring conservative. It stops being rare the moment the deriver is a LIB that every consumer imports: a marker table written as literals would put write, destructive and network markers into the closure of every organ that composed it. That is why the table is a CONF and this source names no marker at all -- but stripping literals is what makes the property hold for any OTHER scanner too, including the ones already shipped. 3. sys_read_file, so there is no source-size cap left to be inconclusive about. Both incumbents cap at 256 KiB and honestly refuse past it; the primitive that closes that hole already exists, sizes its buffer from the file and cannot short-read. FAIL-CLOSED EVERYWHERE. Unreadable subject, unreadable marker table, an empty marker class, or a walk that hits its budget all return INCONCLUSIVE. None of them may return "nothing matched", because nothing-matched is byte-identical to "this organ is read-only", which is the permissive direction and the entire defect this ruler exists to stop. license_tier: ORIGINAL No hw writes (Rule 26).