nx_office_daemon.nx

nx_office_daemon.nx -- the DEPLOYABLE Nishi Office daemon (ops shell around the gated pure core nx_office_serve). Binds 0.0.0.0:<port> (LAN-reachable on the NAS); files live under CWD "<root>/". Route /office -> this port on the sovereign edge. R-AUTHZ: resolves the OPAQUE session (X-Nishi-Session header, the `sess` form field on a zero-JS POST, or the `s` query parameter the docportal's no-JS links carry) -> handle, and passes it to of_handle_auth so OWNED docs are ReBAC-gated while unowned docs stay PUBLIC in open mode. FAIL-SAFE: if the auth ctx can't init in OPEN mode, serve PUBLIC-only (owned docs lock, public work); in CLOSED mode it refuses to start (never public). 2026-08-19 (LP3, /compare/legalpractice): ONE binary, N instances. Every instance parameter is argv with today's nishifamily values as defaults, so the deployed daemons.reg row (`./nx_office_daemon.elf`) keeps working unchanged: nx_office_daemon [port] [keysfile] [storefile] [realm] [root] [base] [uididx] [mode] [authzprefix] mode = open (default) unowned documents are public -- nishifamily.com/office mode = closed EVERY request needs a valid session of this realm -- the firm instance on a client domain; the open-mode namespace is NEVER exposed there (a 401 names the login surface instead) The uid->handle index may be the login daemon's TAB index OR a docportal "<storefile>.uidmap" ("MAP <hex> <handle>"). When a session is present the HTML response is rewritten so every same-app link carries ?s=<token> (no cookies, C1). FORK-PER-REQUEST (2026-08-19, the docportal's proven shape): of_handle_auth mmaps its per-request scratch (me, fullpath, qs, Origin/Host, the page and capture buffers) and returns from dozens of sites without unmapping -- the exact per-request leak class that took nx_opaque_login to 177 GB. A child that handles one connection and then sys_exit(0) reclaims EVERY page BY CONSTRUCTION; the parent only accepts, forks and reaps (non-blocking wait4 + backpressure at a ceiling DERIVED from the host's core count, never guessed). Functionally safe: sessions are file-validated, every office write is a file write under <root>/ (versions, sign logs, authz tuples), and the parent's request/response buffers are never mutated (the child works on its COW copy). Build with --build-only; run deliberately. license_tier: ORIGINAL