Governance and Policy Enforcement

Nishi vs the field — every Nishi cell is measured against real organ source at emit time; each gap names the watch contract that will close it.

Nishi vs OPA and Kyverno and Checkov and Conftest

Layer 1 · Executive

Where we are. Measured 2026-08-19. Governance by construction is live: ratchet floors, governed pulses, RACI validation, attenuate-only capability tokens, a consent ledger, the spend wall and fail-closed minting. The matrix was scored 2026-07-10 and three of its absent rows have since been filled by organs that exist and are verified on the NAS: admission control at promote (nx_staging_guard sg_allows refuses a capability-losing artifact before it lands), compliance reporting (nx_compliance conformance registry and S-class gate) and an externalized authorization service (nx_authz_svc, the single-writer ReBAC decision endpoint) -- their rows are repointed here and flip by measurement. What remains absent is a policy language as data, policy tests, remediation, conf scanning, artifact signatures at promote and declared-vs-live drift.

Where we need to go. Integrity first (signed artifacts at promote, declared-vs-live drift), then policy as data with tests, then remediation and scanning -- keeping every guard a compiled organ of the substrate it governs and every refusal a row.

The unit. 1 u = one measured session-leg. Calibration from landed rungs: the mangagen panel compositor went from existing substrate to shipped and live-verified in ONE leg (2026-08-13); the citations rung went from 3 to 55 domains in one leg across seven seats (2026-08-18); a greenfield engine with a bite-proven gate has measured 2 to 4 legs. Estimates recalibrate as rungs land and PR7 actuals write back.

Cost to integrity first: 3 u. Through M0.

Cost to policy as data: 6.5 u. Through M1.

Cost to act: 9.5 u. Everything below.

10 of 18 capabilities measured|1 of them measured exceeds|8 open|coverage 555/1000|adoption 5 full / 5 partial

Layer 2 · Roadmap

Do this next — computed by the ranker, never chosen by a seat

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: the cheapest closures on this board, listed before any new work. Stamp: # asof=1787883521 domain=warden target_version=0.1 rungs=6 done=0 open=6 finish=0 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
#1	0.1	Artifact signature policy at promote (R4) rs_verify_artifact	933	v=14 m=1 c=15
#2	0.1	Declared-vs-live drift detection (R5) dd_declared_vs_live	600	v=9 m=1 c=15
#3	later	Policy tests (R1) pt_run	1500	v=15 m=1 c=10
#4	later	Policy as data (R0) pl_eval	720	v=18 m=1 c=25
#5	later	Conf misconfiguration scan (R3) is_scan	666	v=10 m=1 c=15
#6	later	Remediation (R2) rem_apply	466	v=7 m=1 c=15

Critical path — contract, done-rule, executor, cost

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Artifact signature policy at promote (R4)	rs_verify_artifact	Promote refuses an unsigned or forged artifact: the registry signer already proven on daemons.reg extends to a per-artifact signature checked beside expect_sha256; a forged byte is refused and a signed artifact passes (bite both ways)	Organ	1.5 u
Declared-vs-live drift detection (R5)	dd_declared_vs_live	Declared state (clockjobs desired plane, daemons.reg, organ_kind.conf, build_admit.conf) compared against live state (clocksched live plane, running daemons, served binaries via nx_artifactdrift) on the beat; every drift row names the declared value, the live value and the remedy	Organ	1.5 u
Policy as data (R0)	pl_eval	A declarative policy row format (subject, predicate, threshold, action) evaluated by one organ the conductor calls; the existing ratchets and walls are re-expressed as rows where they are data-shaped, and stay organs where they are not -- the split is printed	Organ	2.5 u
Policy tests (R1) after R0	pt_run	Policy rows tested against banked fixtures (allow and deny cases per row) through nx_gate_bite semantics; a policy with no deny fixture is refused as vacuous	Organ	1 u
Remediation (R2) after R0	rem_apply	A violation with a declared safe remedy is applied and logged (stage alias repoint, conf row restore) with the refusal-first default kept for anything destructive; every remediation is reversible	Organ	1.5 u
Conf misconfiguration scan (R3) after R0	is_scan	The estate's conf files scanned against policy rows for misconfiguration classes the record already names (bare prefixes, unsigned registries, duplicate rulers, literal thresholds); findings are a worklist with the file and line	Organ	1.5 u

Milestones

Milestone	Rungs	Cumulative
M0 · Integrity first	R4,R5	3 u
M1 · Policy as data	R0,R1	6.5 u
M2 · Act	R2,R3	9.5 u

Layer 3 · Engineering

How this is scored. Every Nishi mark is measured: the generator reads the real organ source on disk and requires the implementing symbol to exist (no self-grading). A watching tag names the organ and symbol contracted to close a gap — the mark flips itself on the next compare beat when that workstream ships, and the comparewatch- plane row flips with it. The flip is necessary, not sufficient: it proves the symbol exists, never that the capability is good. The bar is the rung's pre-declared done-rule, proven by its gate — a symbol shipped without the behaviour behind it is a defect, and the flip is exactly what makes that defect visible instead of quiet. Competitor marks record documented capability presence — presence, not depth or scale. Adoption is measured too: every measured row carries where its organ stands on the estate's ladder (source → built → promoted → registered → invoked; libraries by importer reach minus validation importers; gates by the execution surfaces that run them). A row is fully adopted only at the top of its ladder; anything short is tagged partial with the exact remedy, so a build nobody promoted can no longer read as shipped. Census stamps: importers asof 1787849099, gate census asof 1787855507 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ leads / measured exceed● present◐ partial○ absent · click any capability for its evidence

Capability	Nishi	OPA	Kyverno	Checkov	Conftest
Multi-axis ratchet floors (cleaned debt cannot return) Measured: `spr_check_all` exists in `runtime/_hdl_build/nx_sprawl_ratchet.nx`, verified at emit. Debt, collisions, scratch each ratchet DOWN and LOCK in seg_store; any rise is RED; no policy engine carries a one-way floor primitive Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. adoption LIB-GATE-ONLY importers=1	●	○	○	○	○
Governed pulse firing (warden-owned, never ad-hoc) Measured: `cr_conductor_fire` exists in `runtime/_hdl_build/nx_conductor_registry.nx`, verified at emit. Ratchet and training gates run ONLY through the conductor registry; Kyverno background scans are the partial peer Adoption: `LIB-WIRED importers=5 nonval=4` — fully adopted (top of its ladder).	●	○	◐	○	○
Separation-of-duties validation (exactly one Accountable) Measured: `rc_has` exists in `runtime/_hdl_build/nx_raci.nx`, verified at emit. The RACI validator REFUSES a matrix without exactly-1-A and at-least-1-R per activity -- org-structure policy the config-policy field does not touch Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder).	●	○	○	○	○
Capability tokens, attenuate-only, fail-closed verify Measured: `capt_verify` exists in `runtime/nx_cap_token.nx`, verified at emit. Least-authority PROVEN live 2026-07-08: the read cap is DENIED nx_mgmt (reason 4); delegation can only SUBSET [saltzer75] [capmyths03]; OPA authz policies are the partial peer Adoption: `LIB-WIRED importers=11 nonval=5` — fully adopted (top of its ladder).	●	◐	○	○	○
Append-only consent ledger for delegations Open — no implementing organ is measured for this axis yet. Every scoped cap issue recorded to cap_consent.log, readable via API -- explicit, auditable, revocable [capmyths03]	○	○	○	○	○
Spend-wall gating on money-touching actions Measured: `confirm-spend` exists in `runtime/nx_golive.nx`, verified at emit. Dry-run first, STOP, explicit confirm-spend, once-only guard (gates 6/6 + 8/8, live-proven to the money 2026-07-09); the field gates configs, not purchases Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. adoption SOURCE-ONLY	●	○	○	○	○
Fail-closed key minting (refuses forgeable placeholder) Measured: `cm_mint` exists in `runtime/nx_cap_mint.nx`, verified at emit. The minter EXITS rather than mint against a baked placeholder secret; wrong-key tokens deny -32001 Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption PROMOTED-UNREGISTERED	●	○	○	○	○
Policy language (Rego-class, general-purpose) Open — watching `runtime/nx_policy_lang.nx` : `pl_eval`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. OPA Rego is the bar [opa-docs]; our policies are ORGANS (compiled, gated) not declarative rules -- powerful but not authorable as data yet watching pl_eval	○	◉	◐	◐	●
Admission control (gate changes before they land) Measured: `sg_allows` exists in `runtime/_hdl_build/nx_staging_guard.nx`, verified at emit. Kyverno admission webhooks [kyverno-docs] [k8s-admission] are the bar; REPOINTED 2026-08-19: nx_staging_guard sg_allows refuses a capability-losing or shrunken artifact at PROMOTE, before it lands (plus nx_build_admit at build) -- admission-style, measured present; policy breadth is still Kyverno's Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder).	●	●	◉	○	○
IaC misconfiguration scanning Open — watching `runtime/nx_iac_scan.nx` : `is_scan`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Checkov is the bar [checkov-docs]; our conf files are swept by the janitor as debt, not scanned for misconfiguration watching is_scan	○	●	●	◉	◐
Policy testing framework Open — watching `runtime/nx_policy_test.nx` : `pt_run`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Conftest exists to TEST configs against policy [conftest-docs]; our gates test organs, not policies watching pt_run	○	●	◐	◐	◉
Auto-remediation / mutation of violations Open — watching `runtime/nx_remediate.nx` : `rem_apply`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Kyverno mutate rules are the bar [kyverno-docs]; our ratchets REFUSE but never fix watching rem_apply	○	○	◉	◐	○
Compliance reporting / attestation Measured: `comp_gate` exists in `runtime/_hdl_build/nx_compliance.nx`, verified at emit. Checkov compliance frameworks are the bar [checkov-docs]; REPOINTED 2026-08-19: nx_compliance holds a standards registry per workstream with measured conformance and an S-class gate (comp_gate) -- present; attestation reports against external frameworks remain Checkov's depth Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. adoption BUILT-UNPROMOTED	●	◐	◐	◉	○
Externalized decision API (central authz query) Measured: `az_handle` exists in `runtime/nx_authz_svc.nx`, verified at emit. OPA decision API is its core [opa-docs]; REPOINTED 2026-08-19: nx_authz_svc is the single-writer ReBAC decision service every surface CHECKs through over loopback (az_handle) -- present; Rego-class general policy queries remain OPA's Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder).	●	◉	○	○	◐
Supply-chain artifact policy (signature verify) Open — watching `runtime/_hdl_build/nx_reg_sign.nx` : `rs_verify_artifact`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Kyverno verifyImages [kyverno-docs] is the bar [sigstore-docs]; ties to the janitor census SBOM gap (mom 1864) watching rs_verify_artifact	○	◐	◉	◐	○
Config drift detection vs declared state Open — watching `runtime/nx_drift_detect.nx` : `dd_declared_vs_live`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Our ratchets catch METRIC drift (debt, collisions); declared-config drift has no organ watching dd_declared_vs_live	○	○	◐	◐	○
Governance embedded IN the substrate (guards are compiled organs of the governed system) Measured exceed: `spr_one` in `runtime/_hdl_build/nx_sprawl_ratchet.nx`, verified at emit. Zero policy-engine dependency: every gate, ratchet, allowlist and wall is a NishiLang organ in the same toolchain it governs; the field bolts a separate engine beside the system Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. adoption LIB-GATE-ONLY importers=1	◉	◐	◐	◐	◐
Structural money-safety (dry-run, stop, confirm-spend, once-only) Open — no implementing organ is measured for this axis yet. A purchase pipeline that CANNOT double-spend or surprise-spend by construction, proven live to the money (INSUFFICIENT_FUNDS 0-charge dry-run); no policy engine in the field gates real spend	○	○	○	○	○

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The Nishi warden governs by CONSTRUCTION rather than by rule file: ratchet floors make cleaned debt structurally unable to return, capability tokens are attenuate-only with fail-closed verification (least-authority proven live -- a read cap is DENIED admin reason 4), the RACI validator enforces exactly-one-Accountable separation of duties, money-touching actions sit behind a dry-run-first spend wall, and every one of these guards is a compiled organ in the same substrate it governs. What it lacks is the field's generality: no policy LANGUAGE (our policies are organs, not Rego), no admission control, no IaC scanning, no policy testing framework, no auto-remediation, no compliance reporting, no externalized decision API. The climb: a data-driven policy spec the conductor can evaluate (policies as data per doctrine), violation reports on the compare plane, then admission-style gates on the deploy path.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/warden.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain warden, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[opa-docs] Open Policy Agent documentation: OPA, a general-purpose policy engine, and Rego, its high-level declarative policy language, with the REST decision API. publisher · read in our library knowledge/fetched/cmp_warden_opa-docs.html · pin h95216e57979fbe650e1719d6387c93928d9185d96230c6f1ee3eee097c5bda33 · accessed 2026-08-18 · vendor-docGrounds: The OPA column: "Policy language (Rego-class, general-purpose)" (OPA 2 = the bar; ours are ORGANS not declarative rules) and "Externalized decision API (central authz query)" (OPA 2; ours is per-daemon in-process) -- the vendor's own statement of both capabilities.
[kyverno-docs] Kyverno documentation: Introduction -- a Kubernetes-native policy engine running as an admission controller to validate, mutate, generate and clean up resources and to verify container images. publisher · read in our library knowledge/fetched/cmp_warden_kyverno-docs.html · pin he3626588e8bff553049da4f7fac8cae88d9d09190765bdab349e50250a4d04e3 · accessed 2026-08-18 · vendor-docGrounds: The Kyverno column: "Admission control (gate changes before they land)" (2), "Auto-remediation / mutation of violations" (mutate rules, 2) and "Supply-chain artifact policy (signature verify)" (verifyImages, 2); ours health-gates AFTER staging and ratchets REFUSE but never fix.
[checkov-docs] Checkov documentation: What is Checkov? -- static analysis of infrastructure-as-code files for misconfigurations that lead to security or compliance problems, with compliance-framework mappings. publisher · read in our library knowledge/fetched/cmp_warden_checkov-docs.html · pin hb6d36bf974f6d5abdcc75973828ce541ba5176cb7178e798d990fe67c10dbadd · accessed 2026-08-18 · vendor-docGrounds: The Checkov column: "IaC misconfiguration scanning" (Checkov 2 = the bar; our conf files are swept as debt, not scanned) and "Compliance reporting / attestation" (compliance frameworks, 2).
[conftest-docs] Conftest documentation: a utility to write tests against structured configuration data (Kubernetes, Terraform, Dockerfiles and more) using OPA Rego policies. publisher · read in our library knowledge/fetched/cmp_warden_conftest-docs.html · pin hf5ea9f23083b8215e71ec6420f751daa3185158f54b93a89447c95823cdd2521 · accessed 2026-08-18 · vendor-docGrounds: The Conftest column and the "Policy testing framework" row (Conftest exists to TEST configs against policy, graded 2 for Conftest); our gates test organs, not policies.
[k8s-admission] Kubernetes documentation: Admission Controllers Reference -- validating and mutating admission that intercepts API requests before persistence. publisher · read in our library knowledge/fetched/cmp_devguardrails_k8s-admission.html · pin h901cf891e255ac593d5865bcd24d95ba29279c79f6bb56290c28b8a75183e6fe · accessed 2026-08-18 · vendor-docGrounds: The "Admission control (gate changes before they land)" row: the mechanism Kyverno's admission webhooks plug into, i.e. what gating BEFORE persistence means against our after-staging health gate. Mirror shared with devguardrails.refs.
[saltzer75] Saltzer, Schroeder. The Protection of Information in Computer Systems. Proceedings of the IEEE 63(9), 1975 (author-hosted HTML; section I, Basic Principles, carries the design principles including least privilege and the ticket-oriented / capability model). publisher · read in our library knowledge/fetched/cmp_warden_saltzer75-basic.html · pin h6bc487bbfb454e3bade962e769a6e7d87dff0d81c5d2b35b9ffaadc9beb3a61e · accessed 2026-08-18 · published-paperGrounds: The "Capability tokens, attenuate-only, fail-closed verify" row: least privilege and fail-safe defaults are this paper's design principles, and its capability (ticket) as an unforgeable proof of authorization is what X-Nishi-Cap tokens are; the read cap DENIED admin reason 4 is least-privilege proven live.
[capmyths03] Miller, Yee, Shapiro. Capability Myths Demolished. Johns Hopkins University SRL technical report SRL2003-02, 2003 (mirror: Agoric papers). publisher · read in our library knowledge/fetched/cmp_devguardrails_capmyths03.pdf · pin hb6a3e04e60d7ef08d32900143f8e93acbdcb62e2b63160b604591d7a021f7f42 · accessed 2026-08-18 · published-paperGrounds: The same capability-token row and "Append-only consent ledger for delegations": the object-capability properties (delegation can only subset, revocation, no confused deputy) that attenuate-only delegation and the consent log implement; the field's OPA authz policies are the partial peer because they are ACL-shaped. Mirror shared with devguardrails.refs.
[sigstore-docs] Sigstore documentation: keyless signing with cosign, Fulcio certificate authority and the Rekor transparency log for software artifacts. publisher · read in our library knowledge/fetched/cmp_devguardrails_sigstore-docs.html · pin h008286126a95de87c85a13073dbc269d3c0c62afdbdc244c98eec9d7f2460728 · accessed 2026-08-18 · vendor-docGrounds: The "Supply-chain artifact policy (signature verify)" row (Nishi _ABSENT_): Kyverno verifyImages verifies exactly these Sigstore signatures, so this is the artifact-signing substrate the row's bar assumes. Mirror shared with devguardrails.refs.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/warden.matrix · every Nishi cell verified against organ source at emit time · watch cells re-measured on every compare beat · zero JS, zero trackers