nx_doc_serve_gate.nx

nx_doc_serve_gate.nx -- GATE for LEGAL D3 (nx_doc_serve). Asserts the open-in-app-of-choice serve invariants, each w/ a negative control: T1 CONTENT-TYPE : every format maps to its exact MIME (browser opens the right app). T2 BYTE-EXACT : a body that itself contains CRLFCRLF + NUL round-trips bit-for-bit (Content-Length framed); flipping one body byte is detected. T3 DISPOSITION : DOCX defaults to download (open in Word), PDF inline; the attachment response carries the filename. T4 LENGTH+HARDENING : Content-Length is exact + X-Content-Type-Options:nosniff present (no MIME-sniff of a legal doc). T5 INJECTION-SAFE : a "name\r\nSet-Cookie: ..." filename cannot inject a header -- framing intact AND the CRLF is stripped. T6 SAFE-BY-DEFAULT : an unknown format is octet-stream + attachment (never inlined). T7 TENANT ISOLATION : the vault prefix discipline rejects '.'/'/' tenant ids. Evidence -> knowledge/status/doc_serve.log license_tier: ORIGINAL