nx_doc_serve.nx

nx_doc_serve.nx -- LEGAL RUNG D3: open-the-document-in-the-app-of-choice. module: nishi-core.legal.doc_serve capability: LEGAL_DOC_SERVE Serves a stored document's ORIGINAL bytes so a client can open it in the app of their choice -- inline in the browser (PDF/HTML/text) or downloaded to open in a desktop app (Word/etc). A pure bytes-in/bytes-out HTTP response builder (the proven nx_status_daemon handler pattern): a thin socket loop can wrap it, but the logic + the gate need no socket. The s-class properties (each tested with a negative control in the gate): BYTE-EXACT INTEGRITY -- the served body is bit-identical to the stored bytes. For a legal instrument a single altered byte is a DIFFERENT document, so the body is Content- Length framed (never transcoded, never delimiter- scanned); a body that itself contains CRLFCRLF / NUL round-trips exactly. HEADER-INJECTION SAFE -- the attachment filename is sanitized (control chars stripped) so a malicious "name\r\nSet-Cookie: ..." cannot inject a response header. SAFE-BY-DEFAULT TYPE -- unknown formats are downloaded as octet-stream (never inlined), and X-Content-Type-Options: nosniff stops the browser MIME-sniffing a legal document. PER-TENANT -- the serve layer reads only from the tenant's vault prefix (nx_vault_valid_tid -- no cross-tenant). Composes: nx_doc_vault (D1 tenant-id discipline). license_tier: ORIGINAL lineage_id: nishi_doc_serve_d3