Suppose we have the description of a group $\mathbb{G}$, a group of unknown order: the size of the group is unknown. For instance, an RSA group ($\mathbb{Z}^{*}_N,$ where $N=pq$ for unknown primes $p$ and $q$) or a class group. The prover wants to convince the verifier that for $h=g^x$ and that the exponent is non-negative ($x\geq0$) for a random, public $g\in_R\mathbb{G}$.
More formally, this is the language I want an efficient (non-interactive) zero-knowledge proof system for: $$\mathcal{R}=\{((h,g,\mathbb{G}),x)\vert g^x=h \land 0\leq x\}. $$
Maybe, it is easy to devise a sigma-protocol for this language? Or some cut-and-choose-like proof system? Ideally, verifier efficiency would be independent of the size of $x$. Do you know any proof system in the literature that satisfies these requirements?
Note: in this context, it makes sense to talk about the sign of a discrete logarithm of an element because you don't know the order of the group $\mathbb{G}$ and you also don't know the order of any elements $g,h\in\mathbb{G}$. Put differently, this is a non-trivial statement, in the sense that $\mathcal{R}\notin BPP$ (bounded-error probabilistic polynomial time), because if the prover was able to provide two different "signs" of the same group element, i.e., $h=g^x=g^{-y}$, then $g^{x+y}=\mathbb{1}\leftrightarrow \vert\mathbb{G}\vert=k(x+y)$, for some $k\in\mathbb{Z}$, which is presumably hard to do in a group of unknown order. Usually, one also assumes that even an integer multiple of the unknown group order is hard to compute.
Note 2: logarithmic range proofs would be suboptimal to apply here because, in principle, $x$ can be an arbitrarily large integer.
