nx_image_access.nx

nx_image_access.nx -- ACCESS POLICY for the search-by-image realm: OPERATOR-ONLY, deny-by-default. Operator directive (2026-06-18): "put the search by image for only my access, not internet or others." Search-by-image runs reverse-image queries over the OWNER-only gallery (cam recordings + NSFW), so the realm INHERITS the gallery's strictest level: OWNER. DENY-BY-DEFAULT + FAIL-CLOSED (NIST SP 800-207, same posture as nx_access_wall): any viewer below OWNER -- anonymous internet (0), family (1), or a negative/garbage level -- is DENIED and gets ZERO results. This is the search-by-image analog of nx_galx_authz (which defines the gallery's policy). OWNER==3 MIRRORS nx_galx_authz GALX_OWNER (its owner-only level for cam recordings + NSFW); that module lives in runtime/_hdl_build/ which is off this compile's import path, so the value is PINNED here and asserted ==3 by nx_image_access_gate (single vocabulary, gate-checked). The enforcement point (the future search ENDPOINT/daemon) derives viewer_level from the OPAQUE-authenticated session exactly as the gallery daemon does (nx_opaque_login -> nx_sa_validate_handle -> level), then calls nx_imgsearch_access BEFORE running any query. Internal CLI callers are trusted (Cardinal 12: validate at the boundary). license_tier: ORIGINAL