nx_redirect_resolve.nx

nx_redirect_resolve.nx -- redirect-Location policy for the sovereign nish browser (X-HTTP-RELLOC-001). Composes the proven RFC3986 §5.2 resolver (nx_url_resolve) with an https-only safety gate, so the redirect follower accepts RELATIVE Locations (/path, //host/path, ../x, ?q, #f) in addition to absolute https:// ones -- while preserving nish's invariant that it never follows a redirect off https (no http: downgrade, no cross-scheme jump). This is the WIRING the live fetcher was missing; the resolution math already existed and is KAT-proven in nx_url_resolve. Policy (single source of truth = the resolver + one prefix check): 1. Resolve `loc` against the absolute base URL via nx_url_resolve. - absolute ref with a scheme -> used verbatim (resolver Case 2) - scheme-relative //host/path -> inherits base scheme - path-absolute /p, relative p, ?q, #f -> merged against base 2. Require the resolved target to start with "https://". Absolute http:// / ftp: / mailto: targets fail this and are NOT followed (return 0) -- exactly nish's prior https-only behaviour, now applied to the RESOLVED target so relative refs (which inherit https from the base) pass and downgrades still don't. Returns 1 (followable; out = NUL-terminated absolute https target, *out_len_p = its length) or 0 (do not follow: empty/overflow/non-https). expect_exit: 0 license_tier: ORIGINAL genealogy_id: international-research-sources/ietf/rfc_3986 lineage_id: nishi_redirect_resolve_q10