initial split of client and clientshell, tls.py per completion_plan.md