README: the 5003 EM gate is closed (rev 38), live provisioning runs

README.md

@@ -12,7 +12,7 @@ Validated:
 - The registration chain ran live against Apple (2026-10-02→04, spec rev 26): Albert activation, the packed APNs courier, the full GSA sign-in (SRP, trusted-device 2FA, PET delivery, postdata), then IDS authenticate and register — both green, `mailto:` handle active. The earlier 409 refusals turned out to be Apple's validation-stamp replay guard (one mint = one device record), documented in the spec.
 - Two live unauthenticated probes against Apple succeeded: both bag endpoints return plists this stack parses, and certificate pinning validates Apple's real TLS chains. A drift check ships with the repo (`:engine:runProbe`).
 - The courier's auth model is settled: the packed path needs no client certificate; the legacy path answers the handshake with a TLS 1.3 post-handshake `certificate_required` alert.
-- The ADI anisette chain is reimplemented natively, no emulation or helper binary: the white-box OTP ciphers, the GSA provisioning exchange, the full spim/cpim/ptm wire framing, and the validation-stamp ("NAC") mint — pear white-box cipher, blob assembly, and the 16-byte OTS signature (`NacSign`) — are transcribed clean-room from analysis of a compiled ADI implementation, verified byte-exact against oracle vectors and live captures (three genuine provisioning runs plus validation-stamp captures under an instrumented debugger). Every byte group of the exchange and of the 517-byte stamp is identified and reproduced; the full stamp computes byte-exact in Kotlin from its inputs (the earlier python reference model is retired to dev capture notes; the Kotlin port is pinned by synthetic-vector tests against it). 213 tests green, spec rev 35. A minimal public facade (`NacMint`) exposes the mint for consumers. All five wire-input mappings from the validation exchange (§1.1 C56) are now pinned and implemented: the step-2 request blob (C56-a, `NacRequestBlob` — closed by direct in-process replay of the reference client's validation context, byte-exact on two independent runs) and the hardware-identity serialization (C56-c, `HardwareConfiguration.toBin` — the closed `to_bin` grammar, keyed off the C58 Mac-Hardware-Info export identity and round-trip-verified byte-exact against a live 250-B capture). Every §1.1 mint input mapping is established; a first live step-1/step-2 smoke against Apple's real endpoints accepted the step-1 cert fetch but the step-2 POST currently returns Apple's `5003 EM` error — the blob construction re-verified correct against the capture, so the residue is outside the blob bytes (see spec rev 36). 217 tests green. No anisette server, no Unicorn, no Mac relay.
+- The ADI anisette chain is reimplemented natively, no emulation or helper binary: the white-box OTP ciphers, the GSA provisioning exchange, the full spim/cpim/ptm wire framing, and the validation-stamp ("NAC") mint — pear white-box cipher, blob assembly, and the 16-byte OTS signature (`NacSign`) — are transcribed clean-room from analysis of a compiled ADI implementation, verified byte-exact against oracle vectors and live captures (three genuine provisioning runs plus validation-stamp captures under an instrumented debugger). Every byte group of the exchange and of the 517-byte stamp is identified and reproduced; the full stamp computes byte-exact in Kotlin from its inputs (the earlier python reference model is retired to dev capture notes; the Kotlin port is pinned by synthetic-vector tests against it). 213 tests green, spec rev 35. A minimal public facade (`NacMint`) exposes the mint for consumers. All five wire-input mappings from the validation exchange (§1.1 C56) are now pinned and implemented: the step-2 request blob (C56-a, `NacRequestBlob` — closed by direct in-process replay of the reference client's validation context, byte-exact on two independent runs) and the hardware-identity serialization (C56-c, `HardwareConfiguration.toBin` — the closed `to_bin` grammar, keyed off the C58 Mac-Hardware-Info export identity and round-trip-verified byte-exact against a live 250-B capture). Every §1.1 mint input mapping is established. The step-2 `5003 EM` error that a first live smoke hit is closed (spec rev 38): Apple's validation endpoint fingerprints the TLS handshake and only accepts rustls-shaped clients — the blob and framing were verified correct by posting fresh, never-seen blobs minted by the reference client itself, which the endpoint accepted over rustls while rejecting the identical bytes over OpenSSL, BoringSSL and the JVM stacks. A small rust transport (reqwest + rustls, ~2 exported functions) carries the two validation calls from the consumer app; everything else stays pure Kotlin. The live ADI provisioning exchange also runs from this codebase after two wire fixes (the start/finish body keys are case-sensitive, and the GSA lookup 404s without a well-formed `X-Mme-Client-Info`). 217 tests green. No anisette server, no Unicorn, no Mac relay.
 
 Not validated yet: