nx_tls13_server.nx

nx_tls13_server.nx -- TLS 1.3 server-side handshake (sovereign loopback). Phase 0b sovereign-loopback brick per docs/NISHI_TLS13_GAP_AUDIT.md. Mirrors nx_tls13_client.nx so the substrate can be proven end-to-end without depending on any external TLS server (Cloudflare, openssl s_server, etc). The loopback test in nx_tls13_loopback_test.nx wires this module against nx_tls13_client.nx and verifies both sides reach CONNECTED with byte-identical handshake keys. Per user (2026-05-16): "i dont want anything but sovereign". External-server interop is a SEPARATE optional check, never the substrate's correctness proof. What it does today: - parse ClientHello: extract random / session_id / extensions offsets so caller can walk to find key_share + supported_groups - emit minimal ServerHello with TLS 1.3 supported_versions + X25519 key_share + chosen cipher (ChaCha20-Poly1305-SHA256) - server state machine: WAIT_CH -> WAIT_CF -> CONNECTED (caller drives WAIT_CH by calling parse + emit; this module's dispatcher handles WAIT_CF when the client_Finished arrives) - sealed verdict + validity gate What it doesn't do yet: - signature over CertificateVerify (currently the loopback test uses a placeholder; Gap I when wired will sign with ed25519 over the transcript) - HelloRetryRequest emission (the server here ALWAYS accepts the client's first key_share if X25519; if the client offered a group we don't support, today we just fail; queued: emit HRR with our preferred group) - ALPN negotiation (CH offers a list; server picks one; queued) - PSK acceptance / 0-RTT (Gap M) KAT verified: - end-to-end via nx_tls13_loopback_test.nx: client + server both using shipped substrate reach CONNECTED, derive identical handshake_secret + traffic secrets, verify each other's MACs