nx_h2_test_leaf.nx

nx_h2_test_leaf.nx -- TUTOR-BOOTSTRAP SCAFFOLD (Claude, B1 rung(6) R4-H2-009), NOT credited as team self-authoring (EoE back-fill owed). SHARED self-signed Ed25519 X.509 LEAF (SAN=localhost) minter + PEM exporter for the h2 INTEROP TEST harnesses. Rule 15 (DRY through shared libraries): the identical self-signed-leaf + PEM-export + civil-date code was COPY-PASTED into _h2_serve_loopback_gate.nx (hsl_*), _h2_serve_curl_daemon.nx (hcd_*) AND _h2_multistream_curl_daemon.nx (mcd_*) -- 3 copies = the rule-15 "extract" trigger. This organ is that extraction; new harnesses COMPOSE it instead of a 4th copy. (The 3 existing copies stay BYTE-UNTOUCHED for now -- migrating them is an additive follow-on so the proven daemons are not disturbed this rung.) CONTRACT: h2tl_make_cert(out_cert_der: *u8, out_cert_len: *i64, out_priv: *u8) -> i64 mint an Ed25519 keypair + self-signed leaf (CN/SAN=localhost, notBefore now-1d, notAfter now+365d). out_cert_der must be >=8192 bytes, out_priv 32. Returns 0 ok; -1 keygen, -2 pubkey, -3 inputs, -4 build. h2tl_write_pem(cert_der: *u8, der_len: i64, path_z: *u8) -> i64 write the DER as a PEM file an external curl can trust via --cacert (BEGIN/END CERTIFICATE armor + base64 re-wrapped at 64 cols, composing the canonical nx_base64 b64_encode -- nx_pem.nx only DECODES). Returns 0 ok, <0 on open/write failure. COMPOSES (each imported once): nx_csprng (csprng_fill), nx_ed25519_signature (ed25519_pub_from_priv), hub/nx_x509_build + nx_x509 + nx_x509_trust_store (self-signed leaf builder), nx_base64 (b64_encode), nx_syscalls (mmap/file I/O + nx_str_cpy + sys_now_realtime_sec). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/ietf/rfc_5280 + rfc_4648 + rfc_8032 lineage_id: nishi_h2_test_leaf_b1r6