dp.nx

dp.nx -- differential privacy accounting + noise. EFFICIENCY_ROADMAP §6.3. Typed epsilon budgets; the compiler (phase B) tracks accumulated privacy loss across queries + refuses to compile a pipeline whose epsilon sum exceeds the declared bound. Phase A: runtime DP budget tracker + Laplace/Gaussian noise primitives. Callers manually account for their queries. (epsilon, delta)-DP: a mechanism M is (eps, delta)-DP if for all neighbouring datasets D, D' and all outputs S: Pr[M(D) in S] <= exp(eps) * Pr[M(D') in S] + delta Laplace mechanism: add Lap(sensitivity/epsilon) noise to a query result. Gives pure-eps DP (delta=0). Gaussian mechanism: add N(0, sigma^2) where sigma = sqrt(2 ln 1.25/delta) * sensitivity / epsilon. (eps, delta)-DP. Invariants: DP1 Every query charges the budget BEFORE returning a result. DP2 Over-budget queries return DP_ERR_BUDGET and do NOT leak any data. DP3 Noise is drawn from rand.nx (cryptographic entropy) -- not xoshiro -- so noise is non-adversarial. DP4 Sensitivity is caller-declared; wrong sensitivity invalidates the DP guarantee (out-of-band contract).