nx_hotp_extvec_gate.nx

nx_hotp_extvec_gate.nx -- HOTP vs RFC 4226 Appendix D, all TEN published values. ★WHY THIS GATE EXISTS: I claimed all session that HOTP/TOTP two-factor codes were BROKEN (they rode the defective sha1.nx core) and that repointing hmac_sha1.nx REPAIRED them. The first half was proven; the second half was INFERRED. I had shown HMAC-SHA-1 now matches RFC 2202 -- I had never once computed an actual HOTP code and compared it to a published one. ★★★★★"THE PRIMITIVE UNDERNEATH IT IS NOW CORRECT" IS NOT THE SAME CLAIM AS "THIS PRODUCES CORRECT OUTPUT." HOTP adds dynamic truncation and modular reduction ON TOP of HMAC; a correct HMAC does not prove a correct truncation, and the truncation is where HOTP implementations actually go wrong. EVERYTHING IS READ FROM THE PINNED DOCUMENT, INCLUDING THE SECRET. RFC 4226 Appendix D states it as Secret = 0x3132333435363738393031323334353637383930 and typing those 20 bytes from memory would put the agent back in the byte path for the one input the whole test depends on. ★THE KEY IS AN ANSWER TOO. ⚠ANCHOR HAZARD, HIT AND FIXED: Appendix D has TWO tables -- Table 1: "Count Hexadecimal HMAC-SHA-1(secret, count)" (raw HMAC values) Table 2: "Count Hexadecimal Decimal HOTP" (truncated + HOTP) Anchoring on "Count Hexadecimal" matches TABLE 1 FIRST and would grade HOTP codes against 20-byte HMAC strings. The anchor below is the full Table-2 header. ★AN ANCHOR THAT IS A PREFIX OF AN EARLIER HEADING FINDS THE EARLIER ONE -- the same class as matching a table of contents instead of the body. Document pinned to a CORROBORATED digest (sovereign fetch and .NET WebClient independently agree -- knowledge/extvec/CORROBORATION.tsv). license_tier: ORIGINAL expect_exit: 0