nx_tls_cert_cache.nx

nx_tls_cert_cache.nx -- PERSIST the (already gate-proven) TLS cert-validation cache ACROSS PROCESSES. F799 certloop cure, wiring half: nx_tls13_client_validate_certificate already supports ctx.cached_cert (byte-identical presented Certificate message -> skip the ~3x450ms ECDSA chain walk; the handshake's CertificateVerify possession proof ALWAYS still runs, so a MITM replaying cached bytes cannot finish) and ctx.cert_out capture. What was missing: every tools/call fork-exec is a FRESH process, so the in-process cache never survived -- each nx_https_get paid the full certloop. This lib persists the validated Certificate message per host: knowledge/tlscache/<host>.cert = "NXTCC1\n" [pad to 8] + epoch(8B LE) + len(8B LE) + cert bytes SAFETY CONTRACT (mirrors the validator's own doc): - per-host files; the caller passes the SAME host it will SNI-validate against. - tcc_save ONLY after a session whose handshake completed (full validation ran OK on those bytes, or the identical bytes were previously fully validated within TTL). - freshness TTL (TCC_TTL_S = 7 days): a cache older than TTL is IGNORED -> full validation re-runs, bounding the expired-but-unchanged-cert window far below any real cert lifetime. Rotation (new bytes) is a natural miss -> full validation. - fail-open everywhere: missing dir/file, bad magic, oversize, hostile hostname chars -> no cache, classic full validation (byte-for-byte unchanged behavior). Envelope: cert message <= TCC_CERT_CAP (16 KiB); hostname <= 200 chars of [A-Za-z0-9.-] else uncached. license_tier: ORIGINAL expect_exit: 0 (lib; compile smoke main)