nx_tls13_mtls_loopback_test.nx

nx_tls13_mtls_loopback_test.nx -- SOVEREIGN end-to-end MUTUAL-AUTH proof: the capstone of the no-cookie carrier. nx_tls13_loopback_test proves a server-auth-only handshake reaches CONNECTED with both sides agreeing on keys. The R3 client-auth gate proves the CertificateVerify CRYPTO -- but over an ARBITRARY transcript hash. NEITHER proves the load-bearing mTLS property: that a REAL client signature, over the REAL mutually-agreed handshake transcript (INCLUDING the server's CertificateRequest), is verified by the server END-TO-END. This gate closes that last gap. One main() drives BOTH halves of an mTLS 1.3 handshake message-by-message, maintaining two INDEPENDENT transcripts (client + server) exactly as the wire would, then proves: T1 both transcripts AGREE through the client's Certificate (the snapshot the client signs over), T2 the client's REAL Ed25519 CertificateVerify over that snapshot VERIFIES on the server + recovers identity, T3 a downgrade-MITM that STRIPS the CertificateRequest diverges the transcript -> verify FAILS, T4 a single flipped transcript byte -> verify FAILS (bound to THIS handshake), T5 another identity's cert cannot ride the signature (no impersonation), T6 a tampered signature -> verify FAILS. Real R2 CertificateRequest bytes + real R4 minted client cert + real Ed25519 signature + real R3 server verify, bound over a real (sha256) transcript both sides compute independently. No socket, no browser, no external anything -- the codebase's canonical loopback hand-builds its flight the same way. This is the in-process proof that the run loop's mutual-auth LOGIC is correct; the live browser then only tests INTEROP (does Chrome present the cert), not correctness -- the one thing no Nishi component can stand in for. expect_exit: 0 license_tier: ORIGINAL