nx_http_loopback_gate.nx

nx_http_loopback_gate.nx -- gates the sovereign HTTP client with a LIVE loopback GET against :8080. WHAT CHANGED, AND WHY (2026-08-01). This gate used to assert that :8080/blocklist answers 200 with the blocklist body. It has been RED since the topology changed: :8080 is redirect.elf, a plain-HTTP -> HTTPS redirector, and it 301s EVERY path unconditionally. Proven by hand with a raw socket carrying no Accept headers at all -- same 301 -- so the failure was never about the request we build. The old expectation was not just stale, it was backwards: serving that page in cleartext on :8080 is the thing we do NOT want. So the gate now asserts the redirect is present AND correct -- 301 with a Location that is https:// and carries the requested path. That turns a broken liveness check into a real transport-security check: if someone ever makes :8080 serve content directly, this goes RED. It still gates what it always gated -- nx_http_client builds a request that a live server accepts and answers -- because T1 needs real bytes back. license_tier: ORIGINAL