code wiki / _hdl_build / nx_connect_youth_lib.nx
`nx_connect_youth_lib.nx` source

1// nx_connect_youth_lib.nx -- the YOUTH-SAFETY VISIBLE-CONTEXT WALL ("two-deep"), extracted as a shared
2// library so the verifying gate (nx_connect_lds_youth) and the LIVE app (nx_connect_serve /events) bind
3// ONE implementation. Before this split the live RSVP path re-stated the rule as an inline `adults >= 2`
4// check -- correct by luck, but a second copy that could drift from the verified one. No main, no
5// syscalls, no allocation.
6//
7// THE INVARIANT (encodes the Church's own "two-deep leadership / never one adult alone with a youth"
8// norm as a HARD information-flow rule rather than a policy page; consumes a verified age BAND, never a
9// self-declared age):
10//   * peer<->peer (adult<->adult or minor<->minor): allowed.
11//   * a linked GUARDIAN and their own youth: allowed -- parents are never blocked.
12//   * a non-guardian ADULT <-> a MINOR: allowed ONLY inside a VISIBLE GROUP carrying >=2 adults.
13//     A private 1:1, or a group with a single adult, is DENIED BY CONSTRUCTION.
14// Meetup, Tandem, Match and Facebook all permit the adult->minor private DM this denies.
15//
16// Also: no advertising is ever shown to a minor (COPPA + child dignity; the vertical is free either way).
17// license_tier: ORIGINAL
18
19const YW_BAND_MINOR: i64 = 0
20const YW_BAND_ADULT: i64 = 1
21const YW_CTX_DM:     i64 = 0    // private 1:1
22const YW_CTX_GROUP:  i64 = 1    // visible group room
23const YW_TWO_DEEP:   i64 = 2    // adults required before adult<->minor contact may exist
24
25// is exactly one side a minor and the other an adult?
26func yw_is_mixed(ab: i64, bb: i64) -> i64 {
27    if ab == YW_BAND_MINOR { if bb == YW_BAND_ADULT { return 1 } }
28    if ab == YW_BAND_ADULT { if bb == YW_BAND_MINOR { return 1 } }
29    return 0
30}
31
32// THE WALL: may a channel exist between these two? guardian=1 iff the adult is that youth's linked
33// guardian; ctx is YW_CTX_DM or YW_CTX_GROUP; adults_present is the visible adult count.
34func yw_may_channel(a_band: i64, b_band: i64, guardian: i64, ctx: i64, adults_present: i64) -> i64 {
35    if yw_is_mixed(a_band, b_band) == 0 { return 1 }                          // peer<->peer: always allowed
36    if guardian == 1 { return 1 }                                             // guardian + own youth: allowed
37    if ctx == YW_CTX_GROUP { if adults_present >= YW_TWO_DEEP { return 1 } }  // visible AND two-deep: allowed
38    return 0                                                                  // otherwise: DENIED
39}
40
41// NEG-CONTROL twin: the incumbent default -- any user may DM any user, which leaks exactly the
42// adult->minor 1:1 the wall above denies. Kept in the library so the gate measures the real alternative.
43func yw_may_incumbent(a_band: i64, b_band: i64, guardian: i64, ctx: i64, adults_present: i64) -> i64 { return 1 }
44
45// no ads to minors; adults may see brought-to-you-by local-business ads only.
46func yw_ad_allowed(band: i64) -> i64 { if band == YW_BAND_MINOR { return 0 } return 1 }
nx_connect_youth_lib.nx source

`nx_connect_youth_lib.nx` source
