nx_tls13_server_session_run.nx

nx_tls13_server_session_run.nx -- top-level TLS 1.3 server-side handshake orchestrator. The server-side analogue to nx_tls13_client_session_run. Composes the 10 shipped stones over a connected TCP fd to drive a session from INIT to CONNECTED. Pipeline (client → server arrows + arrowed-out server emits): <-- client ClientHello (TLSPlaintext record) [stone 2] recv_ch INIT -> CH_RECEIVED [stone 3] emit_sh + wrap as TLSPlaintext CH_RECEIVED -> SH_SENT --> server ServerHello (TLSPlaintext) [stone 4] derive_hs_secrets SH_SENT -> EE_SENT [stone 5] derive_traffic (no state change) [stone 6] emit_ee (already TLSCiphertext) EE_SENT -> CERT_SENT --> ChangeCipherSpec compatibility record (skipped per RFC 8446 §D.4) --> EncryptedExtensions [stone 6.5] emit_certificate (state stays CERT_SENT) --> Certificate [stone 7.5] emit_cv CERT_SENT -> CV_SENT --> CertificateVerify [stone 7] emit_sf CV_SENT -> SF_SENT --> ServerFinished <-- client Finished (TLSCiphertext) [stone 8] recv_cf SF_SENT -> CONNECTED [derive_app] (already inside recv_cf per stone 8) Public API: nx_tls13_server_session_run(fd, cert_der, cert_der_len, ecdsa_priv_be) -> *Tls13ServerSession (positive cast to i64) on CONNECTED -> negative -(NX_TLS13_SRUN_*) verdict on failure After this returns OK, the caller uses nx_tls13_server_session_app_send / _app_recv to exchange encrypted application_data records. Per Cardinals 9 (single-responsibility: just drive the handshake; app data is a separate layer), 22 (composition only). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/ietf/rfc_8446 lineage_id: nishi_tls13_server_session_run_q1