commit a302d5084992ea61689d89ebdc7f8bc4ddc218da
Author: ruby <ruby@destinytablet.cloud>
Date:   Fri Oct 9 09:14:41 2026 +0200

    Add the README for the C++ Nexus client.

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..6b4f375
--- /dev/null
+++ b/README.md
@@ -0,0 +1,42 @@
+[![C++20](https://img.shields.io/badge/C%2B%2B-20-00599C?logo=c%2B%2B&logoColor=white)](https://en.cppreference.com/w/cpp/20)
+[![CMake](https://img.shields.io/badge/CMake-3.20+-064F8C?logo=cmake&logoColor=white)](https://cmake.org/)
+[![gRPC](https://img.shields.io/badge/gRPC-grpc--cpp-244C5A?logo=grpc)](https://grpc.io/docs/languages/cpp/)
+[![protobuf](https://img.shields.io/badge/protobuf-protocol%20buffers-4285F4?logo=protobuf&logoColor=white)](https://protobuf.dev/)
+
+# mishima-nexus-client-cpp
+
+C++ client for a remote [Mishima Nexus](https://brokkr.robotico.dev/mishima/mishima-nexus) server. It speaks gRPC `mishima.nexus.v1` (`proto/mishima/nexus/v1` in `mishima-nexus`). It does not embed the engines and it does not link `Mishima.Nexus.Node.*`.
+
+- Brokkr: `https://brokkr.robotico.dev/mishima/mishima-nexus-client-cpp`
+
+Stubs are generated with `grpc-cpp` and protobuf and are not edited by hand. The hand-written layer parses the connection URI, loads TLS material, attaches auth metadata, and maps `NexusStatus` to the caller's error type.
+
+## Connection URIs
+
+| Scheme | Plane | Default database (empty path) |
+|---|---|---|
+| `nexus+graph://` | Graph | `pathways` |
+| `nexus+time://` | Time | `telemetry` |
+| `nexus+document://` | Document | `catalog` |
+| `nexus+relational://` | Relational | `ledger` |
+| `nexus+vector://` | Vector | path segment |
+| `nexus+sql://` | — | rejected — not this client's wire |
+
+The URI **host:port** is the gRPC endpoint. The port is always explicit. The URI **path** (for example `/pathways`) is the logical database name, sent as the `x-nexus-database` gRPC metadata header on every call. One client is bound to a single scheme and logical database. Open a second client for another plane or database.
+
+## TLS / mTLS / bearer auth
+
+| Variable | Purpose |
+|---|---|
+| `NEXUS_TLS_CA_FILE` | CA certificate PEM (trust root) |
+| `NEXUS_TLS_CLIENT_CERT_FILE` | Client (machine credential) certificate |
+| `NEXUS_TLS_CLIENT_KEY_FILE` | Client private key PEM |
+| `NEXUS_TLS_MODE` | `https` (default) or `insecure` |
+| `NEXUS_WIRE_BEARER` | Bearer token attached as `Authorization` |
+| `NEXUS_WIRE_DEFAULT_BEARER` | Fallback bearer token |
+
+A backend uses a machine credential (mTLS, optional service JWT). When no TLS material is present and HTTPS is unset, the client dials plaintext h2c for loopback development only.
+
+## Errors
+
+Wire failures surface as stable `NXS_*` codes: `NXS_URI_INVALID`, `NXS_URI_UNSUPPORTED_SCHEME`, `NXS_CONNECT_FAILED`, `NXS_TLS_REJECTED`, `NXS_ALREADY_EXISTS`, `NXS_NOT_FOUND`, `NXS_INVALID_ARGUMENT`, `NXS_DISPOSED`, `NXS_UNAVAILABLE`, `NXS_WIRE_FAILED`.