nx_tls13_sig_algs_audit.nx

nx_tls13_sig_algs_audit.nx -- V-HOST-2+1-3 Path B: ClientHello signature_algorithms extension parser. Per RFC 8446 §4.2.3: client offers a list of signature_scheme values indicating which sig algs it can verify. This module parses that list defensively + tells the caller which of the substrate's supported sig algs (ecdsa_secp256r1_sha256, ed25519) the client supports. COMPOSES (per "avoid duplicate primitives"): nx_syscalls (no allocation; caller-supplied buffer reads) COMPOSED BY: future TLS server handshake validation (V-HOST-2+1-4 smoke uses this for handshake-failure prediction) future client-capability probes sovereign nx_pages_https_daemon vhost-pick logic V+1 V-HOST-2+1-3 SCOPE: - Parse extension type 0x000D (signature_algorithms) from ClientHello extension block - Walk the sig-alg list; flag whether ecdsa_secp256r1_sha256 (0x0403) OR ed25519 (0x0807) appear - Return verdict + boolean flags V-HOST-2+1-3 NON-SCOPE: - Block the handshake (substrate-friendly: substrate-caller decides) - Parse other sig schemes (rsa_pkcs1_*, ecdsa_secp384r1_*, etc.) - PSK / cert_authorities extensions Status: V-HOST-2+1-3 Path B. 2026-05-27.