nx_tls13_client_validate_certificate.nx

nx_tls13_client_validate_certificate.nx -- the FORMAL bridge between the TLS 1.3 client state machine's WAIT_CERT state and the X.509 cert pipeline shipped earlier today. Phase 0b §L sub-3 of the TLS client arc, AND Arc A step 3 of the nx_https_client wiring roadmap. The existing nx_tls13_client dispatcher (commit pre-dating this session) has an explicit STUB at line 154-157 of nx_tls13_client.nx: // STUB: cert validation deferred to Gap I. We currently // accept ANY presented certificate, which means this client // is NOT safe to use against an untrusted network until // Gap I lands. We BUILT Gap I today: nx_https_cert_pipeline_verify_with_store (commit f294961e) does full RFC 5280 path validation against a TrustStore. This primitive is the SHIM that lets the TLS dispatcher close that stub. API: struct TlsValidationContext { store: *TrustStore, sni_host: *u8, sni_host_len: i64, now_epoch: i64, } nx_tls13_client_validate_certificate( cert_msg_bytes, cert_msg_len, val_ctx ) -> verdict nx_tls13_client_cv_verdict_is_valid(v) -> 0|1 Sealed verdict enum: NX_TLS13_CLIENT_CV_OK chain valid + SAN matches SNI NX_TLS13_CLIENT_CV_CERT_MSG_BAD Cert message format error NX_TLS13_CLIENT_CV_NOT_YET_VALID leaf cert not yet valid NX_TLS13_CLIENT_CV_EXPIRED leaf cert expired NX_TLS13_CLIENT_CV_HOSTNAME_FAIL no SAN entry matches SNI