nx_acme_directory_live_real_ca_test.nx

nx_acme_directory_live_real_ca_test.nx -- L11 step 2d. Live HTTPS GET against Let's Encrypt PRODUCTION /directory using the already-shipped modular pipeline (url_for_fetch -> url_connect -> tls13_client_session_run -> https_get_complete -> response_parse + dechunk) and the real Mozilla trust store. Production rather than staging: LE STAGING certs chain to the "(STAGING) Pretend Pear X1" root which is NOT in Mozilla's public trust store -- by design. Hitting production /directory is safe (GET, no order placed, no rate-limit consumption) AND validates the real ISRG Root X1 chain that Mozilla anchors. What this proves: - DNS resolves acme-v02.api.letsencrypt.org - TCP connects to LE production - TLS 1.3 handshake completes - LE's cert chain validates against our shipped Mozilla store (ISRG Root X1 is one of the 167 anchors loaded earlier) - HTTP/1.1 GET succeeds, response parses, body dechunks - JSON body contains the expected ACME endpoint keys What this does NOT prove: - any POST against LE (that's step 2e -- needs JOSE-signed body via nx_https_post_complete shipped in step 2c) - staging cert chain support (separate task: add the staging trust anchor or implement a staging trust mode) expect_exit: 0 license_tier: ORIGINAL