From 6c3dd102bafb7f14a8a3da7495961f6dd7646c6c Mon Sep 17 00:00:00 2001
From: Jodson Graves <info@ntari.org>
Date: Thu, 9 Jul 2026 19:04:12 -0400
Subject: [PATCH] ci: Go build/vet/test + Python conformance gate

Two jobs on every PR and push to main:

- test: gofmt cleanliness, go vet, go build, full go test (includes the
  vectors golden test, so any canon or field-order drift fails CI).
- conformance: run testdata/reproduce_spec.py (stdlib-only Python,
  written from SPEC.md alone) against testdata/vectors.json. An
  independent implementation must reproduce every canonical byte
  sequence and verify every signature, or the build fails. This is the
  forkability guarantee executed as a check, not a promise.

Least-privilege permissions (contents: read) per the CodeQL guidance
already applied to SoHoLINK's workflow.

Signed-off-by: Jodson Graves <info@ntari.org>
---
 .github/workflows/ci.yml | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..89e34dc
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,40 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Go build, vet, test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: gofmt (no files may need formatting)
+        run: test -z "$(gofmt -l .)"
+      - run: go vet ./...
+      - run: go build ./...
+      - run: go test ./...
+
+  conformance:
+    name: Foreign-implementation conformance
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      # reproduce_spec.py is a stdlib-only Python reimplementation of the SPEC §3
+      # canonical encoding (hand-rolled ed25519 included). It rebuilds every
+      # canonical_bytes_hex in testdata/vectors.json from field values alone and
+      # verifies all signatures; it exits non-zero on any mismatch. This gate is
+      # what keeps the golden vectors honest for non-Go implementers.
+      - name: Reproduce golden vectors from SPEC (Python, no Go)
+        run: python testdata/reproduce_spec.py