nx_connect_seal.nx

nx_connect_seal.nx -- CONNECT message sealing on the REAL, RFC-8439-verified ChaCha20-Poly1305 AEAD, built 2026-07-24 to retire the 78-line additive-cipher stand-in (nx_connect_e2ee_min) that the maturity gauge honestly graded STUB. "State of the art from the first byte up": this composes the sovereign AEAD whose KAT (nx_chacha20_poly1305_test) matches RFC 8439 2.8.2 byte-exact AND rejects a single-bit tamper. SECURITY DISCIPLINE (the parts a real messenger needs, that the stand-in never had): * AUTHENTICATED: every message carries a Poly1305 tag; open() REJECTS any tampered ciphertext/tag. * NONCE = per-message counter (4 zero bytes + 8-byte LE seq). Never reused for a key -> no keystream reuse. Nonce reuse is the cardinal AEAD failure; the counter makes it structural. * SEQUENCE-BOUND: the message counter is the AAD, so a replayed/reordered message fails to open under a different expected seq -> reorder/replay is detected, not just tampering. * CONTENT-BLIND BY CONSTRUCTION: the server stores only {seq, ciphertext, tag} and holds NO key, so it cannot read (no key) and cannot forge (AEAD auth). Key EXCHANGE (getting the conv key to both peers without the server) is a SEPARATE rung (X25519/MLS) -- not claimed here. PURE CORE (no main): key/nonce/buffers are caller-supplied. Consumers: nx_connect_seal_gate, and (once the AEAD chain is reachable from _hdl_build) the live serve. license_tier: ORIGINAL