Read signing golden fixtures from spec checkout

.github/workflows/ci.yml

@@ -20,6 +20,14 @@ jobs:
           ref: main
           path: intentproof-spec
 
+      - name: Ensure spec sdk-signing golden checkout
+        run: |
+          if [[ -d intentproof-spec/golden/sdk-signing ]]; then
+            exit 0
+          fi
+          git -C intentproof-spec fetch origin phase3-ecosystem-conformance
+          git -C intentproof-spec checkout FETCH_HEAD
+
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
@@ -32,3 +40,8 @@ jobs:
         env:
           INTENTPROOF_SPEC_DIR: intentproof-spec
         run: npm run test:coverage
+
+      - name: Verify sdk-signing fixtures synced with spec
+        env:
+          INTENTPROOF_SPEC_DIR: intentproof-spec
+        run: bash ./scripts/check-sdk-signing-fixtures-sync.sh

scripts/check-sdk-signing-fixtures-sync.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Fail when mirrored SDK signing fixtures drift from intentproof-spec.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+LOCAL="${ROOT}/tests/fixtures"
+CANONICAL="${INTENTPROOF_SPEC_DIR:?INTENTPROOF_SPEC_DIR must point at intentproof-spec}/golden/sdk-signing"
+
+if [[ ! -d "$CANONICAL" ]]; then
+  echo "canonical sdk-signing fixtures not found at ${CANONICAL}" >&2
+  exit 1
+fi
+
+shopt -s nullglob
+files=("${CANONICAL}"/signing_*)
+if [[ ${#files[@]} -eq 0 ]]; then
+  echo "no signing fixtures under ${CANONICAL}" >&2
+  exit 1
+fi
+
+fail=0
+for canonical in "${files[@]}"; do
+  base="$(basename "$canonical")"
+  local_path="${LOCAL}/${base}"
+  if [[ ! -f "$local_path" ]]; then
+    continue
+  fi
+  if ! cmp -s "$canonical" "$local_path"; then
+    echo "sdk-signing fixture drift: ${base} differs from spec golden/sdk-signing" >&2
+    fail=1
+  fi
+done
+
+if [[ "$fail" -ne 0 ]]; then
+  exit 1
+fi
+
+echo "PASS: sdk-signing fixture mirrors match spec golden."

tests/signing_golden.test.ts

@@ -11,7 +11,13 @@ import {
 } from '../src/signing';
 import { getPublicKeyAsync } from '@noble/ed25519';
 
-const fixtureDir = path.join(__dirname, 'fixtures');
+const fixtureDir = (() => {
+  const specDir = process.env.INTENTPROOF_SPEC_DIR?.trim();
+  if (specDir) {
+    return path.join(specDir, 'golden', 'sdk-signing');
+  }
+  return path.join(__dirname, 'fixtures');
+})();
 
 describe('shared signing golden fixtures', () => {
   it('matches Python cross-SDK canonical bytes, hash, and signature', async () => {