nx_legal_portal.nx

nx_legal_portal.nx -- LEGAL RUNG D6: the Client Workspace portal request handler. module: nishi-core.legal.portal capability: LEGAL_PORTAL The composition spine that ties the gated doc-signing logic cores into ONE bytes-in/bytes-out HTTP request handler (the proven nx_status_daemon sd_handle pattern): a thin socket loop can wrap it later, but the logic + the gate need no socket and touch nothing live. It routes a tenant's requests over: D1 nx_doc_vault -- a doc is served only if THIS tenant's vault owns it. D2 nx_doc_envelope -- envelope list + status (signed N of M). D3 nx_doc_serve -- open-in-app-of-choice document bytes. D4 nx_doc_annotate -- the "what's still needed" checklist readiness. D0 nx_legal_compliance-- the regime is SURFACED to the client: a REQUIRES_WET instrument is told "e-sign not legally valid" rather than silently offered for signing (never-void in UX). nx_authz -- /portal (client level 1) vs /staff (lawyer level 2), deny-by-default; an unlisted resource is 404. Tenant isolation: one NxPortalCtx = one tenant's private stores, so a request can never reach another tenant's envelopes/docs. READ spine only -- the stateful POST mutations (sign/annotate) ARE the already- gated logic cores (D2/D4); this organ is the routing + authz + serving layer over them. Wiring it behind a live daemon (nx_andelinwest_daemon :8453) is a separate, operator-gated deploy step. Composes: nx_doc_envelope, nx_doc_serve, nx_doc_annotate, nx_doc_vault, nx_legal_compliance. The /portal-vs-/staff level check is the same longest-prefix deny-by-default rule as nx_authz, inlined here over two disjoint prefixes to keep the compile unit lean. license_tier: ORIGINAL lineage_id: nishi_legal_portal_d6