nx_compare_gw.nx

nx_compare_gw.nx -- the /compare GATEWAY DAEMON (loopback HTTP): the compare surface behind the same OPAQUE login wall and the same HR access structure as /studio and /hub (operator 2026-08-27: "i can see them as the owner but then others see different levels of /compare so i can provide a client a /compare"). It sits behind sites_daemon's fail-closed `gated` reverse-proxy for /compare, mirroring the /hub -> hub_gw topology exactly, and changes NOTHING about how nx_compare_regen emits the pages -- it gates at SERVE time from knowledge/compare/access.conf, so the single-emission publish pipeline is untouched and a board's visibility is one conf row, live with no restart. THE CHAIN, all sovereign and all already proven elsewhere: olg_whoami (nx_hr_access -> hac_session_level) validates the no-cookie X-Nishi-Session token against the nishi_site_admin realm and resolves the viewer's HR LEVEL (deny-by-default: an invalid/expired token, or a valid token for someone not enrolled in HR, resolves to 0 = public) ; then cg_required(access.conf, domain) gives the board's required level ; then cg_decide serves, 404s or 403s. FAIL-CLOSED and NO-LEAK by construction: a board a viewer may not see is absent from their index bytes AND answers 404, the SAME answer a board that does not exist gives -- an anonymous visitor can never tell a gated board from a missing one, while the owner serves it. HARDENING baked in from the studio/hub post-mortems: binds 127.0.0.1 ONLY (the edge reaches it through the proxy), and sets FD_CLOEXEC on the listener so a forked child can never hold the port (the outage that survives every restart). All buffers are allocated ONCE before the accept loop and reused, and every per-request read is bounded into a reused buffer -> a flat virtual footprint. This daemon never forks. license_tier: ORIGINAL No hw writes (Rule 26).