code wiki / tls13
topic: tls13
108 modules sharing the tls13 name family (derived from the tree's prefix discipline).
The sovereign TLS 1.3 stack — the reason no third-party web server or OpenSSL exists anywhere in this tree. Handshake, record fragmentation (RFC 8446 16 KiB records), forward secrecy, and certificate validation against the Mozilla trust store (nx_x509_trust_store, nx_trust_store_load_from_certdata) are all first-byte-up NishiLang. Every public site, the management API, and every HTTPS-speaking organ in this wiki terminates TLS through this family.
narrated overview -- maintained by the narration lane, module links verified against this wiki.
| module | description | lines | funcs |
|---|---|---|---|
| nx_tls13.nx | TLS 1.3 (RFC 8446) record-layer constants + framing. | 215 | 6 |
| nx_tls13_aead1302_gate.nx | proves the 0x1302 (AES-256-GCM-SHA384) AEAD dispatch is REAL. | 63 | 2 |
| nx_tls13_aead_record_tcp_test.nx | send + recv ONE AEAD-protected | 150 | 8 |
| nx_tls13_alpn_test.nx | smoke for the ALPN (RFC 7301) extension | 68 | 1 |
| nx_tls13_app_send_fd.nx | chunked TLS 1.3 application-data send to an fd. | 83 | 2 |
| nx_tls13_app_send_fd_gate.nx | ENGINEER gate for the chunked TLS app-data | 133 | 4 |
| nx_tls13_auth.nx | TLS 1.3 auth-related handshake message parsers. | 274 | 6 |
| nx_tls13_auth_test.nx | KAT for EncryptedExtensions + Certificate | 238 | 1 |
| nx_tls13_cert_cache_gate.nx | proves the additive cert-validation CACHE in nx_tls13_client_validate_certificate: | 96 | 5 |
| nx_tls13_ch_adversarial_test.nx | Phase A2 of S-class hardening. | 145 | 3 |
| nx_tls13_ch_compat_test.nx | B2-HTTPBIN-CH gate row (browser arc). | 399 | 9 |
| nx_tls13_chrome_hello.nx | emit a ClientHello whose JA3 fingerprint MATCHES a real Chrome (~v120), so | 107 | 4 |
| nx_tls13_chrome_hello_gate.nx | SOVEREIGN referee: emit our Chrome-JA3 ClientHello, extract its JA3 fingerprint | 123 | 8 |
| nx_tls13_chrome_session.nx | R2f-A LIVE wiring: a TLS-1.3 client session that sends the Chrome-JA3 ClientHello | 131 | 2 |
| nx_tls13_client.nx | TLS 1.3 client state machine (Gap L sub-2). | 264 | 4 |
| nx_tls13_client_dispatch_with_validation.nx | TLS 1.3 client | 124 | 4 |
| nx_tls13_client_dispatch_with_validation_test.nx | KAT for the | 121 | 1 |
| nx_tls13_client_h2run.nx | TUTOR-BOOTSTRAP SCAFFOLD (Claude, authored under | 174 | 5 |
| nx_tls13_client_session.nx | TLS 1.3 client session state + | 273 | 4 |
| nx_tls13_client_session_derive_app.nx | step 3c.5 of the | 133 | 3 |
| nx_tls13_client_session_derive_app_test.nx | KAT for step 3c.5: | 90 | 1 |
| nx_tls13_client_session_emit_finished.nx | step 3c.4 of the | 158 | 3 |
| nx_tls13_client_session_emit_finished_test.nx | KAT for | 88 | 1 |
| nx_tls13_client_session_recv_hs.nx | step 3c.3 of the | 266 | 4 |
| nx_tls13_client_session_recv_hs_test.nx | KAT for step 3c.3: | 133 | 2 |
| nx_tls13_client_session_recv_sh.nx | step 3c.2 of the | 270 | 3 |
| nx_tls13_client_session_recv_sh_test.nx | KAT for step 3c.2: | 217 | 2 |
| nx_tls13_client_session_run.nx | step 3c.6b of the | 308 | 6 |
| nx_tls13_client_session_run_test.nx | KAT for the top-level | 74 | 1 |
| nx_tls13_client_session_test.nx | KAT for the TLS 1.3 client | 93 | 1 |
| nx_tls13_client_test.nx | in-memory end-to-end handshake dispatch. | 231 | 1 |
| nx_tls13_client_validate_certificate.nx | the FORMAL bridge | 166 | 4 |
| nx_tls13_client_validate_certificate_test.nx | KAT for the | 85 | 2 |
| nx_tls13_client_verify_cv.nx | CLOSE THE TLS 1.3 CLIENT AUTH BYPASS. | 182 | 8 |
| nx_tls13_clientauth_ecdsa.nx | TLS 1.3 server-side CLIENT authentication, ECDSA-P256 path (RFC 8446 §4.4.3). | 143 | 7 |
| nx_tls13_ed25519_test_daemon.nx | V-HOST-2+1-4b runtime roundtrip daemon. | 128 | 1 |
| nx_tls13_emit_certificate_request.nx | TLS 1.3 CertificateRequest (RFC 8446 §4.3.2) emit + parse. | 193 | 7 |
| nx_tls13_ext.nx | TLS 1.3 extension emitters + ServerHello parsers. | 485 | 14 |
| nx_tls13_ext_test.nx | byte-exact KAT for TLS 1.3 extension | 167 | 1 |
| nx_tls13_finished.nx | TLS 1.3 Finished MAC (RFC 8446 §4.4.4). | 116 | 3 |
| nx_tls13_finished_test.nx | internal KAT for Finished MAC. | 109 | 1 |
| nx_tls13_full_tcp_test.nx | full TLS 1.3 handshake over real TCP | 479 | 29 |
| nx_tls13_handshake.nx | TLS 1.3 handshake orchestrator (Gap L sub-1). | 212 | 3 |
| nx_tls13_handshake_io.nx | full TLS 1.3 handshake over real TCP. | 202 | 5 |
| nx_tls13_handshake_tcp_test.nx | full TLS 1.3 client+server | 366 | 4 |
| nx_tls13_handshake_test.nx | RFC 8448 §3 end-to-end orchestrator KAT. | 157 | 1 |
| nx_tls13_hello.nx | TLS 1.3 ClientHello + ServerHello (RFC 8446 | 503 | 7 |
| nx_tls13_hello_test.nx | structural + iterator KAT for the | 204 | 1 |
| nx_tls13_hrr.nx | HelloRetryRequest detection (RFC 8446 §4.1.4). | 108 | 2 |
| nx_tls13_hrr_test.nx | KAT for HelloRetryRequest detection. | 75 | 1 |
| nx_tls13_io.nx | TLS 1.3 record I/O over TCP (Linux x86_64). | 190 | 5 |
| nx_tls13_kdf.nx | TLS 1.3 HKDF-Expand-Label + Derive-Secret | 172 | 4 |
| nx_tls13_kdf_test.nx | RFC 8446 §7.1 + RFC 8448 §3 KAT for the | 119 | 1 |
| nx_tls13_loopback_test.nx | SOVEREIGN end-to-end handshake proof. | 319 | 1 |
| nx_tls13_mtls_finished.nx | R7: the mTLS-aware client Finished handler (the dual-snapshot key schedule). | 196 | 9 |
| nx_tls13_mtls_loopback_test.nx | SOVEREIGN end-to-end MUTUAL-AUTH proof: the capstone of the no-cookie carrier. | 166 | 7 |
| nx_tls13_mtls_recv_cert.nx | R7: receive the client's Certificate record, EMPTY-cert aware. | 137 | 7 |
| nx_tls13_p256_loopback_test.nx | server side of rung | 127 | 2 |
| nx_tls13_read_record_from_fd.nx | read ONE TLS record from a | 128 | 4 |
| nx_tls13_read_record_from_fd_loopback_test.nx | REAL happy- | 125 | 4 |
| nx_tls13_read_record_from_fd_test.nx | KAT for the TLS record | 49 | 1 |
| nx_tls13_record.nx | TLS 1.3 record-layer protection (RFC 8446 §5.2). | 380 | 9 |
| nx_tls13_record_test.nx | internal-consistency KAT for the | 192 | 1 |
| nx_tls13_recv_hs_diff_test.nx | B1 differential: identical setup to | 137 | 2 |
| nx_tls13_recv_hs_probe_test.nx | B1 instrument (pm_plan arc=BROWSER | 272 | 3 |
| nx_tls13_schedule.nx | TLS 1.3 key schedule cascade (RFC 8446 §7.1). | 236 | 8 |
| nx_tls13_schedule_test.nx | RFC 8448 §3 cascade KAT for TLS 1.3 | 147 | 1 |
| nx_tls13_server.nx | TLS 1.3 server-side handshake (sovereign loopback). | 268 | 5 |
| nx_tls13_server_clientauth.nx | TLS 1.3 server-side CLIENT authentication: verify a presented | 174 | 7 |
| nx_tls13_server_full_handshake_test.nx | end-to-end integration | 225 | 2 |
| nx_tls13_server_recv_client_cert.nx | R7 rung 7b: the server receives the client's Certificate record. | 171 | 5 |
| nx_tls13_server_recv_client_cv.nx | R7 rung 7c: receive + verify the client's CertificateVerify. | 212 | 9 |
| nx_tls13_server_session.nx | TLS 1.3 SERVER session state + state | 271 | 3 |
| nx_tls13_server_session_app_data.nx | application-data layer for | 150 | 2 |
| nx_tls13_server_session_app_data_test.nx | round-trip the app | 203 | 2 |
| nx_tls13_server_session_derive_hs.nx | 4th stone of the TLS 1.3 | 144 | 1 |
| nx_tls13_server_session_derive_hs_test.nx | verify the server's | 88 | 1 |
| nx_tls13_server_session_derive_traffic.nx | 5th TLS server stone. | 113 | 1 |
| nx_tls13_server_session_derive_traffic_test.nx | verify traffic | 109 | 3 |
| nx_tls13_server_session_emit_certificate.nx | stone 6.5 (final | 278 | 2 |
| nx_tls13_server_session_emit_certificate_test.nx | Smoke for emit_certificate: wraps caller-supplied DER bytes as | 117 | 1 |
| nx_tls13_server_session_emit_certreq.nx | R7 rung 7a: emit CertificateRequest as a real encrypted server | 147 | 4 |
| nx_tls13_server_session_emit_cv.nx | stone 7.5 of TLS server arc. | 347 | 4 |
| nx_tls13_server_session_emit_cv_test.nx | verify CertificateVerify | 113 | 1 |
| nx_tls13_server_session_emit_ee.nx | 6th TLS server stone. | 109 | 1 |
| nx_tls13_server_session_emit_ee_alpn.nx | TUTOR-BOOTSTRAP SCAFFOLD (Claude, | 138 | 1 |
| nx_tls13_server_session_emit_ee_test.nx | verify emit_ee | 92 | 1 |
| nx_tls13_server_session_emit_hrr.nx | server-side HelloRetryRequest | 161 | 3 |
| nx_tls13_server_session_emit_sf.nx | 7th TLS server stone. | 161 | 1 |
| nx_tls13_server_session_emit_sf_test.nx | verify server Finished | 93 | 1 |
| nx_tls13_server_session_emit_sh.nx | server-side ServerHello | 263 | 6 |
| nx_tls13_server_session_emit_sh_test.nx | verify server emits a | 130 | 1 |
| nx_tls13_server_session_recv_cf.nx | 8th (final) TLS server stone. | 223 | 2 |
| nx_tls13_server_session_recv_cf_test.nx | close the loopback-class | 188 | 2 |
| nx_tls13_server_session_recv_ch.nx | server-side ClientHello | 295 | 5 |
| nx_tls13_server_session_recv_ch_test.nx | verify the server-side | 96 | 1 |
| nx_tls13_server_session_run.nx | top-level TLS 1.3 server-side | 353 | 6 |
| nx_tls13_server_session_run_h2.nx | TUTOR-BOOTSTRAP SCAFFOLD (Claude, authored | 295 | 5 |
| nx_tls13_server_session_run_mtls.nx | R7: the live-terminator mTLS handshake run loop (Ed25519 server | 207 | 5 |
| nx_tls13_server_session_test.nx | verify server session skeleton | 102 | 1 |
| nx_tls13_sh_probe_test.nx | ServerHello DIAGNOSTIC PROBE. | 252 | 4 |
| nx_tls13_sig_algs_audit.nx | V-HOST-2+1-3 Path B: ClientHello | 193 | 3 |
| nx_tls13_transcript.nx | TLS 1.3 transcript hash (RFC 8446 §4.4.1). | 218 | 6 |
| nx_tls13_transcript384_gate.nx | proves the dual-hash transcript (R9, 2026-08-05). | 95 | 2 |
| nx_tls13_transcript_snapkat_tamper_test.nx | NEGATIVE CONTROL for the | 85 | 6 |
| nx_tls13_transcript_snapkat_test.nx | DURABLE anti-regression KAT for | 97 | 3 |
| nx_tls13_transcript_test.nx | KAT + internal consistency for the | 152 | 1 |
| tls13.nx | TLS 1.3 (RFC 8446) record-layer constants + framing. | 188 | 7 |