nx_mcp_stdio.nx

MCP stdio to sovereign HTTPS. The server remains the authority for discovery and capability checks. Each request runs in a child so the current TLS allocator cannot accumulate across a long session. FAILURE SEMANTICS (lane conn, 2026-09-11). A per-request failure -- a child that exits non-zero, the SIGALRM deadline, a non-2xx HTTP status, an over-budget response, a response-id mismatch, or a TLS/transport failure -- produces a JSON-RPC 2.0 error response for THAT request id on the protocol fd, and the connector KEEPS SERVING every other request. Two mechanisms, one shape: * the request CHILD self-reports soft failures (it knows the http status / byte limit) by writing a correlated error to its own pipe and exiting 0, so the parent forwards it like any response; * the PARENT (mp_recover_pump) turns a child that died WITHOUT self-reporting -- a crash, or the SIGALRM deadline killing it -- into a correlated error from that slot's pending id and continues. An oversized OR malformed request line is consumed to its newline and answered with -32600 for its id when the id is readable from the retained prefix; otherwise a stderr diagnostic. Notifications (no id) never get a response. Only broken stdin/stdout, poll failure, or allocation failure ends the process. Protocol-fd isolation (stdout dup'd away to stderr for library chatter, the real protocol pipe held on a private fd) and response-id correlation are preserved. No magic numbers: every code/limit is named.