From 0edc4774ee59f80bdee6d75a433dfa455f5de61c Mon Sep 17 00:00:00 2001
From: Nathan Gillett <nathan@intentproof.io>
Date: Sat, 30 May 2026 18:11:28 -0500
Subject: [PATCH] Restore spec conformance gate for pinned SPEC_REF

Run policy compiler and reference-policy tests against the
spec checkout CI already uses at SPEC_REF.
---
 .github/workflows/ci.yml          |  5 +++++
 scripts/check-spec-conformance.sh | 16 ++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100755 scripts/check-spec-conformance.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d98a226..96d6593 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,6 +43,11 @@ jobs:
           INTENTPROOF_SPEC_DIR: ${{ github.workspace }}/intentproof-spec
         run: go test -count=1 ./...
 
+      - name: Spec conformance (policy compiler vs pinned spec)
+        env:
+          INTENTPROOF_SPEC_DIR: ${{ github.workspace }}/intentproof-spec
+        run: bash scripts/check-spec-conformance.sh
+
       - name: Verify counterparty golden bundle stdout
         env:
           INTENTPROOF_SPEC_DIR: ${{ github.workspace }}/intentproof-spec
diff --git a/scripts/check-spec-conformance.sh b/scripts/check-spec-conformance.sh
new file mode 100755
index 0000000..f168a6a
--- /dev/null
+++ b/scripts/check-spec-conformance.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Run Go policy/compiler tests against the pinned intentproof-spec checkout.
+set -euo pipefail
+
+SPEC_DIR="${1:-${INTENTPROOF_SPEC_DIR:-../intentproof-spec}}"
+
+if [[ ! -f "$SPEC_DIR/schema/policy.v1.schema.json" ]]; then
+  echo "spec schema not found at: $SPEC_DIR/schema/policy.v1.schema.json" >&2
+  exit 2
+fi
+
+SPEC_DIR_ABS="$(cd "$SPEC_DIR" && pwd)"
+
+INTENTPROOF_SPEC_DIR="$SPEC_DIR_ABS" \
+INTENTPROOF_DETERMINISTIC_TIME=1 \
+  go test ./pkg/policy -run 'TestPolicyCompilerMatchesSpecSchema|TestReferencePolicyFixturesMatchVerifier' -count=1