nx_http_resolve_redirect.nx

nx_http_resolve_redirect.nx -- client-side 3xx redirect Location follow. Given a raw HTTP response (status line + headers block, possibly trailing body) and the URL we fetched it from, this primitive: 1. detects whether the status is a follow-worthy 3xx (301/302/303/307/308 per RFC 7231 §6.4) 2. extracts the Location header value case-insensitively 3. resolves Location against the base URL (RFC 3986 §5.2) so both absolute Location and relative Location work 4. writes the resolved absolute URL to a caller-supplied buffer Composes: - nx_http_header_find (RFC 7230 §3.2.4 case-insensitive) - nx_url_resolve (RFC 3986 §5.2) Out of scope (the orchestrator that loops nx_https_get + this primitive is `nx_https_get_following` in a follow-up arc): - looping with hop limit - cookie + auth header carry-forward across hops - method preservation (301 vs 307 vs 308 semantics) -- caller decides via the returned `permanent` + `method_preserving` verdict bits nx_safety_envelope: intended_use: "HTTP redirect follow for the bits-up browser." sil_target: SIL1 evidence: [rfc7231_section_6_4_canonical_basis, composes_url_resolver, scheme_allowlist_caller_responsibility] hazard_register: [bug-tape-open-redirect-to-evil-site, bug-tape-redirect-to-javascript-url, bug-tape-redirect-loop-uncapped] residual_risk: "Caller MUST cap redirect count + audit scheme of resolved URL (substrate emits the resolved URL verbatim)." verdict: NOT_YET_EVALUATED