nx_ws_client.nx

nx_ws_client.nx -- THE CLIENT HALF OF RFC 6455, SO THE ESTATE CAN DRIVE A BROWSER WITHOUT PYTHON. WHY THIS EXISTS (operator standing order 2026-09-03: "i dont want py or js or sh or anything else in the build lanes i want us nishilang soverign"). The estate drives headless Chromium over the DevTools Protocol through nishi-ops/ac_cdp.py -- a Python file whose own header concedes the WebSocket layer is "the ~40 lines below". That is the last non-sovereign link in the render-measurement lane, and this file is the first half of removing it. IT IS A SIBLING, NOT A SECOND RULER. nx_websocket.nx already implements the framing, the opcodes, the payload-length variants and the accept-key derivation over nx_sha1 and nx_base64. Every constant and the accept-key function are COMPOSED from it; nothing here re-implements a byte of that. What is added is only the mirror image, because RFC 6455 is asymmetric by design: nx_ws_build_frame builds UNMASKED (server -> client) <- incumbent nx_ws_build_frame_masked builds MASKED (client -> server) <- here, RFC 6455 s5.3 nx_ws_parse_frame_inplace requires MASKED (server reading) <- incumbent nx_ws_parse_frame_server requires UNMASKED (client reading) <- here, the mirror rule It lives beside the server lib rather than inside it because nx_websocket.nx is load-bearing for the video /signal lane, and the client half has no business widening a rule the server depends on. THE MASK KEY IS AN ARGUMENT, NOT AN INTERNAL. RFC 6455 wants the key unpredictable, but a lib that reaches for entropy is a lib no gate can test deterministically. The caller supplies four bytes; the gate supplies a fixed key and proves the round trip exactly. Where the key comes from is the caller's contract, and the header of any production caller must say so. PROVEN 9/9 GREEN 2026-09-03, and the tooth that carries it needs no fixture of mine: a frame built here is handed to the INCUMBENT server parser untouched and comes back byte-for-byte (39 bytes in, opcode 1, 33 payload), including the extended-length path at 300 bytes. The incumbent's own refusal of an unmasked frame is re-checked in the same run and is unchanged. SCOPE, STATED SO NOBODY READS THIS AS MORE THAN IT IS: this is the WebSocket CODEC half. A full sovereign replacement for ac_cdp.py additionally needs a plain TCP connect, an HTTP GET of /json/list to discover the page target, the upgrade request itself, and the CDP request/response loop. Those are named rungs, not done work. license_tier: ORIGINAL No hw writes (Rule 26). LIB (no main).