nx_nishios_net_wire.nx

nx_nishios_net_wire.nx -- BROWSER-ON-ALL-OS arc, rung N3-WIRE: NishiOS on the REAL INTERNET. N3 (nx_nishios_net) proved the NIC driver path -- descriptor programming + doorbell by EXECUTED x86 store -- against a hermetic loopback peer. This rung replaces the loopback with the WIRE BRIDGE: the NIC device backend terminates on the LIVE sovereign network stack (own DNS -> TCP -> TLS 1.3 -> HTTP via nx_https_get + the Mozilla trust store), the standard user-net/slirp architecture (guest NIC TX -> host network stack). The kernel driver (executed x86) rings the doorbell; the device parses the request URL out of the TX buffer, fetches it over the REAL internet, and delivers the raw wire bytes into the RX buffer; the browser parses HTTP (status/content-length/chunked -- the same idiom as nx_browser load_page) and renders the REAL page into the NishiOS desktop. Target = example.com (the stack's proven smallest live host; body carries "Example Domain"). KAT: T1 booted off the persisted image; T2 LONG mode + banner; T3 doorbell fired exactly once by the executed x86; T4 device delivered (RX_STATUS==1) AND the driver read it back (scratch==1); T5 the wire returned real bytes (nx_https_get rc>0); T6 browser-side HTTP parse says 200; T7 the body contains "Example Domain" = content from the REAL internet; T8 the browser laid it out; T9 rendered into the desktop (h1 bar); T10 BMP exported at the exact expected size. NEG/liar-kill: T11 no doorbell -> no delivery; T12 THE WIRE LIAR-KILL -- the SAME bridge pointed at a guaranteed-nonexistent RFC-2606 .invalid host FAILS (wire rc<=0, RX_STATUS==2) and the executed driver observes the error (scratch==2): a fabricated/hardcoded response could not distinguish the two hosts, so a pass here proves the bytes really come from the network; T13 a 0-sector-load image never reaches long mode. HONEST SEAM (stated): the boot chain + the doorbell store execute as real x86; the device backend is host-side NishiLang (exactly like slirp is host-side C for QEMU user networking). A guest-side TCP/IP stack driven instruction-by-instruction is the far deeper rung. LIVE-NETWORK CAVEAT: T5-T9 depend on real connectivity to example.com; on an offline host the gate goes honestly RED (no fake green). NEVER-BRICK (Rule 26): writes FILE artifacts only; models INT 13h *reads*; network is client-side egress via the proven sovereign stack; no /dev writes, no firmware. expect_exit: 0 license_tier: ORIGINAL