nx_connect_idage.nx

nx_connect_idage.nx -- R3 of CONNECT: the SAFETY SPINE -- privacy-preserving age assurance + re-registration-resistant identity. This closes the gap that R1/R2's minor<->romance walls currently TRUST self-declared age. The honest exceed axes: PRIVACY-PRESERVING (vs Tinder/Bumble ID-hoarding) and RE-REG-RESISTANT (vs Tandem's defeated photo-verify, banned users re-register). PROTOCOL (what this rung proves, by construction): 1. A trusted issuer attests only an AGE BAND (adult/minor) -- never sends us DOB/name/ID. 2. We VERIFY the attestation, then derive a SERVICE-SCOPED pseudonym from the issuer's subject ref + our secret service salt, and STORE ONLY {age_band, scoped_pseudonym}. Raw PII never reaches us; the issuer's subject ref is never stored (only the one-way scoped pseudonym). 3. UNLINKABILITY: the same person at a DIFFERENT service gets a DIFFERENT, uncorrelatable pseudonym (service-scoping). STABILITY within our service enables re-reg resistance. 4. RE-REG RESISTANCE: bans are keyed by the scoped pseudonym (bound to verified identity), so a banned user cannot evade by changing email/device -- only by defrauding the issuer. HONESTY (no overclaim): the issuer attestation is checked here with a SYMMETRIC keyed-hash MAC as a STAND-IN for the production ASYMMETRIC issuer signature (ecosystem ed25519 verify w/ issuer public key), and pseudonyms use a modular multiplicative hash as a STAND-IN for a CRYPTOGRAPHIC hash (ecosystem SHA-256/BLAKE) for true preimage/collision resistance. Both are NAMED FOLLOW-ONS. This rung proves the PRIVACY ARCHITECTURE (minimization, service-scoped unlinkability, identity- bound banning) -- NOT cryptographic strength -> census cells flip to PRESENT, never PARITY/EXCEEDS. 8 checks incl. 3 negative controls. 100% sovereign. license_tier: ORIGINAL expect_exit: 0