# Cross-SDK Tests

This directory holds shared fixtures plus a Go-side spec-example validator. **The actual cross-SDK signature verification lives in each SDK's own test suite**, where it consumes the shared vectors below.

That split is why `.github/workflows/cross-sdk-tests.yml` only runs `spec_examples_test.go` here — it is not a missing test, it is a deliberate division of work.

## Shared test vectors

- `go_vectors.json` — Generated by the Go SDK using the shared keypair from `sdk/py/tests/fixtures/ts_vectors.json`
- `py_vectors.json` — Generated by the Python SDK using the same shared keypair
- `sdk/py/tests/fixtures/ts_vectors.json` — Generated by the TypeScript SDK (canonical source)
- `v020_vectors.json` — Pinned v0.2.0 / v0.2.1 vectors: terminal chain, response-hash redaction, and legacy flat-map `parameters_disclosure` (ADR-0012 Phase A). Frozen — never regenerate against newer canonicalizer changes.
- `v030_vectors.json` — Pinned v0.3.0 vectors: HPKE envelope `parameters_disclosure` (ADR-0012 amendment), plus daemon-attested `peer_credential` and `emitter_metadata` (ADR-0010). Envelope bytes are sourced from `spec/test-vectors/disclosure-envelope/vectors.json` vector-1.
- `malformed_vectors.json` — Shared corpus of receipts and chains every SDK MUST reject (tampering, swapped multibase prefix, broken chain link, etc.)

All four vector files use the same Ed25519 keypair so any SDK can verify receipts signed by any other.

## Spec-example shape validation

`spec_examples_test.go` validates that the example receipts in `spec/examples/` have the correct structure, required fields, and consistent chain properties. It does **not** verify cross-SDK signatures — that happens inside each SDK.

## Running

```sh
# Generate Go vectors (only needed after changing the unsigned receipt or keys)
go run ./cmd/generate-vectors

# Generate the malformed corpus
go run ./cmd/generate-malformed-vectors

# Generate Python vectors
cd ../sdk/py && uv run python scripts/generate_vectors.py

# Run shape validation + JSON schema validation for spec examples (this directory)
go test -tags=integration -v

# Cross-SDK signature verification — one per SDK, each consuming the shared vectors:
# Go:     cd sdk/go && go test -tags=integration -v -run CrossLanguage
# Python: cd sdk/py && uv run pytest tests/test_cross_language_go.py -v
# TS:     cd sdk/ts && pnpm test -- cross-language
```
