nx_browser_gate.nx

nx_browser_gate.nx -- THE BROWSER GATE: one command re-proves the Nishi browser claim set, evidence-driven + durable. Data-driven row table (add a row = add a table entry). Each row names a runtime/<module>.nx; the gate compiles it with the NATIVE browser-lane compiler (_offc/nx_compile_x86_native.elf), assembles + links, runs the ELF, and judges via the RAW wait4 status (the sovereign exit-judging law -- never $? through a shell). Rows (the browser claim set, 2026-06-10): arg7-tailcall compiler regression gate: >6-arg tail-call drop (the defect that zeroed every TLS Derive-Secret) tls-kdf RFC 8448 Derive-Secret KATs tls-schedule TLS 1.3 key-schedule KATs jpeg-ascii deterministic synthetic-JPEG decode + raster page-demo live HTTP fetch + html_to_text (example.com:80) own-site-live LIVE sovereign HTTPS fetch of nishifamily.com (TLS 1.3 + real Mozilla CA chain validation) render-own paints the FETCHED page's text -> framebuffer (consumes own-site-live's /tmp/nishi_own.html) recv-hs-probe B1 rung: full encrypted-handshake walk vs example.com (per-record/per-message markers, cert-pipeline verdict + chain sig-alg census); exit 0 = handshake to WAIT_CLIENT_FIN p256-keyshare B4 rung: P-256 ECDH (RFC 5903 KAT both directions, boundary rejects) + dual key_share wire format (x25519 + secp256r1 in one CH) derefcast compiler regression gate: `*p as T` precedence (pre-fix: cast bound inside the deref -> byte- load of the pointer cell -> SIGSEGV; fixed in parse_unary 2026-06-10) p256-loopback B4 server side: OUR server completes a P-256-only client (no HRR), both roles derive byte-identical traffic secrets, off-curve share rejected (the nishifamily P-256 gap, healed + loopback-proven) ch-compat B2 rung, two live legs: httpbin.org census (TLS-1.2-only signature classified -- the CH was never the defect; auto-escalates to a full handshake if they enable 1.3) + github.com P-256-only CH walked to verified server