nx_tls13_io.nx

nx_tls13_io.nx -- TLS 1.3 record I/O over TCP (Linux x86_64). Phase 0c of the Nishi TLS 1.3 stack per docs/NISHI_TLS13_GAP_AUDIT.md. Turns the in-memory record-layer primitives shipped in T4 (nx_tls13_record) into byte streams on real TCP sockets. Pure wire-format wrapper; doesn't touch handshake state or AEAD -- that's the caller's job using nx_tls13_client / nx_tls13_server. Architecture pinning: uses Linux x86_64 syscalls (sys_socket / sys_bind / sys_listen / sys_accept / sys_connect / sys_read / sys_write). Runs natively via the x86_64 smoke driver; doesn't run under qemu-RV64 because the socket-syscall wrappers aren't yet in the RV64 nx_syscalls.nx (queued separately as "RV64 socket parity"). TLSPlaintext wire format (RFC 8446 §5.1): struct { ContentType type; // 1 byte ProtocolVersion legacy; // 2 bytes, big-endian, 0x0303 uint16 length; // 2 bytes, big-endian opaque fragment[length]; // length bytes } TLSPlaintext; What it does today: - tls13_io_send_record(fd, type, payload, payload_len) Constructs the 5-byte header + payload, writes to fd in one buffer (single sys_write to minimize Nagle effects). - tls13_io_recv_record(fd, out_type, out_buf, out_cap, out_len) Reads 5-byte header, parses length, reads exactly length bytes of body (loops on partial recv). - tcp_listen_loopback(port): bind 127.0.0.1:port + listen - tcp_connect_loopback(port): connect to 127.0.0.1:port What it doesn't do yet: - TLSCiphertext encrypt/decrypt orchestration (caller wraps each app record via nx_tls13_record + seq counter; this file is plain wire-format only) - Handshake-driving wrapper (next turn: nx_tls13_https.nx will compose this + nx_tls13_handshake + nx_tls13_client to do