nx_media_fetch.nx

nx_media_fetch.nx -- bring source bytes into a MediaPool. Bottom-most ingestion primitive: takes a source descriptor (path / stdin / fd) and emits *u8 + len bytes ready for the sniffer and per-medium parsers. Three transports today (substrate-native; no external deps): - filesystem path : sys_open / sys_read / sys_close - stdin : sys_read(0, ...) - prefetched bytes : caller already has the buffer; we just register provenance + push into pool URL transport is OWNED BY nishi-browser (Phase 0a DNS / 0b TLS / 0c HTTPS already shipping per the active investigation memory). nx_media_fetch.nx accepts the bytes nishi-browser hands back. See: docs/NISHI_MEDIA_INGESTION_ROADMAP.md nx_safety_envelope: intended_use: "Fetch bytes from a source descriptor and register them in a MediaPool with provenance + sniff verdict." sil_target: SIL2 asil_target: QM dal_target: DAL C iec_62304_class: NONE evidence: [no_floating_point, bounded_read_loop_with_progress_check, provenance_origin_recorded, sniff_verdict_attached_to_pool_entry] hazard_register: [bug-tape-fetch-truncated-silently, bug-tape-fetch-empty-treated-as-success, bug-tape-symlink-traversal-attack] residual_risk: "Filesystem fetcher follows symlinks by default; caller validates path before passing for trust-sensitive ingestions." verdict: NOT_YET_EVALUATED