nx_h2_client_over_tls.nx

nx_h2_client_over_tls.nx -- TUTOR-BOOTSTRAP SCAFFOLD (Claude, authored under the R4-H2 HTTP/2-transport-ladder workflow, capstone NBC-FETCH-001), NOT credited as team self-authoring. THE HTTP/2 CLIENT REQUEST/RESPONSE DRIVER carried over the sovereign TLS 1.3 application-data channel. Given a CONNECTED *Tls13ClientSession whose ALPN negotiated "h2" (via nx_tls13_client_session_run_h2), it performs ONE HTTP/2 GET: send (one TLS app-data record): preface + empty SETTINGS + HEADERS(stream 1, END_STREAM|END_HEADERS) wrapping an HPACK GET block (= h2_build_client_open) + a SETTINGS-ACK once the peer SETTINGS arrives. recv (loop TLS records -> decrypt -> append to an h2 frame buffer): walk frames, HPACK-decode the response HEADERS block's :status, and reassemble DATA payloads into the body until END_STREAM. The h2 frame bytes ARE the allowed internet-boundary (RFC 9113/7541 dictate the octets); the implementation is pure NishiLang -- no nghttp2, no openssl. FOUNDED ON (composes, does NOT reinvent -- anti-orphan law; imported EXACTLY ONCE each, RC6 double-import avoided): - nx_h2_conformance.nx (R4-H2-006, GREEN): h2_build_client_open + the frame builders/reader + HPACK encoders/decoders + flow windows, all pulled transitively through its single import (it splices h2_flow -> h2_frame -> hpack -> str -> syscalls, plus h2_stream and tls13_ext). - nx_tls13_record.nx: AEAD app-data encrypt/decrypt (nx_tls13_record_*_v2). - nx_tls13_read_record_from_fd.nx: one inbound TLS record (partial-read framer). - nx_tls13_client_session.nx: the *Tls13ClientSession struct (app keys/iv/seq). nx_tls13_record / read_record / client_session all transitively import nx_tls13.nx and nx_syscalls.nx -- included once by the linker guards. BACK-FILL: the team RE-AUTHORS this from the DATA spec (knowledge/specs/2026-06-13-http2-transport-ladder.md) via the emitter-of-emitters (X-AUT-006c/e/f); this hand scaffold is the sanctioned one-time bootstrap only (meter-integrity, mirror nx_h2_conformance.nx:1-4). GATE (main): synthesizes a server h2 response with OUR frame builders (peer SETTINGS + SETTINGS-ACK + HEADERS :status 200 = HPACK 0x88 + DATA "hello h2" END_STREAM), feeds it through h2_extract_status_and_body, and asserts the recovered :status == 200 and the exact reassembled body, byte-for-byte. PLUS a TAMPER case on a SEPARATE buffer: a HEADERS block carrying :status 404 must recover 404 (not silently coerced to 200), and a body-less END_STREAM HEADERS