nx_aid_federation.nx

nx_aid_federation.nx -- LIB: CROSS-ORG charity federation (R-AID-R1). Catches a double-dipper claiming across DIFFERENT food banks WITHOUT any org sharing PII. Mechanism: each org locally computes a SALTED TOKEN = hash(federation_salt || recipient_stable_id) and submits ONLY the token (never the name/PII). The same person yields the same token at every org, so a token appearing at >=2 orgs in the period = a cross-org double-claim. HONEST SCOPE (load-bearing): this proves the ARCHITECTURE -- (A) no PII crosses an org boundary (af_submit takes a TOKEN, by signature; the stored record holds only digits + a day), (B) same person -> same token -> overlap detected, (C) FAIL-OPEN preserved (there is NO auto-deny here -- detection only RAISES a review flag; a human decides, mirroring nx_aid). The token DIGEST is a deliberately-swappable primitive: this uses a polynomial hash for the demo; PRODUCTION MUST swap in a cryptographic hash (sha256) + a coordinator-held high-entropy salt (ideally a real private-set-intersection protocol). Tokens are linkable BY DESIGN (that is how overlap is found) -- harden the primitive + salt management before real deployment. Sovereign seg-store (knowledge/store/aidfed-*, NO TSV), integer-only. license_tier: ORIGINAL