wire-certify.yml

name: Wire Certification

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

jobs:
  certify-python:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install MCP dependency
        run: pip install 'mcp<2' numpy   # mcp 2.x renamed FastMCP -> MCPServer

      - name: Verify wire laws and regenerate golden vectors
        run: python3 python/MCP/verify_laws.py /tmp/golden_vectors.json

      - name: Diff the regenerated C mirror of the certificate
        run: diff /tmp/golden_vectors.gen.h codec/golden_vectors.gen.h

      - name: Diff regenerated golden vectors against committed
        run: |
          python3 -c "
          import json
          committed = json.loads(open('Documentation/golden_vectors.json').read())
          regenerated = json.loads(open('/tmp/golden_vectors.json').read())
          assert committed['anchors'] == regenerated['anchors'], 'anchors mismatch'
          assert len(committed['encode_basis']) == len(regenerated['encode_basis']), 'encode_basis length mismatch'
          assert len(committed['syndrome_basis']) == len(regenerated['syndrome_basis']), 'syndrome_basis length mismatch'
          for i, (c, r) in enumerate(zip(committed['encode_basis'], regenerated['encode_basis'])):
              assert c['frame'].lower() == r['frame'].lower(), f'encode_basis[{i}] mismatch: {c[\"frame\"]} != {r[\"frame\"]}'
          for i, (c, r) in enumerate(zip(committed['syndrome_basis'], regenerated['syndrome_basis'])):
              assert int(c['syndrome']) == int(r['syndrome']), f'syndrome_basis[{i}] mismatch: {c[\"syndrome\"]} != {r[\"syndrome\"]}'
          print('golden_vectors.json: committed and regenerated match')
          "

      - name: Run certify_sdk self-test
        run: python3 python/MCP/certify_sdk.py --selftest

      - name: Run MCP self-test
        run: python3 python/MCP/wirelab_mcp.py --selftest

      - name: Run DCF-Radio + dcf-rec unit tests (no ffmpeg needed)
        run: python3 -m unittest python/tests/test_radio.py python/tests/test_dcf_rec.py -v

      - name: SuperPack — self-test, regenerate vectors, diff the committed copies
        run: |
          python3 python/MCP/superpack.py
          python3 python/MCP/gen_superpack_vectors.py /tmp/superpack_vectors.json
          diff /tmp/superpack_vectors.json   Documentation/superpack_vectors.json
          diff /tmp/superpack_vectors.json   python/MCP/superpack_vectors.json
          diff /tmp/superpack_vectors.gen.h  codec/superpack_vectors.gen.h

      - name: FEC — regenerate Reed-Solomon vectors, diff the committed copies, test
        run: |
          python3 python/MCP/gen_fec_vectors.py /tmp/fec_vectors.json
          diff /tmp/fec_vectors.json   Documentation/fec_vectors.json
          diff /tmp/fec_vectors.json   python/MCP/fec_vectors.json
          diff /tmp/fec_vectors.gen.h  codec/fec_vectors.gen.h
          python3 -m unittest python/tests/test_fec.py -v

      - name: DCF-Pipe — regenerate control vectors, diff copies, verify transfer laws
        run: |
          python3 python/MCP/gen_pipe_vectors.py /tmp/pipe_vectors.json
          diff /tmp/pipe_vectors.json   Documentation/pipe_vectors.json
          diff /tmp/pipe_vectors.json   python/MCP/pipe_vectors.json
          diff /tmp/pipe_vectors.gen.h  codec/pipe_vectors.gen.h
          python3 python/dcf/pipe/laws.py
          # from python/ so the `dcf` package imports (the path form from the repo root
          # cannot import dcf.pipe -- test_pipe.py only puts python/MCP on sys.path)
          (cd python && python3 -m unittest tests.test_pipe -v)

      - name: HydraPack — regenerate vectors, diff the committed copies
        run: |
          python3 python/MCP/gen_hydrapack_vectors.py /tmp/hydrapack_vectors.json
          diff /tmp/hydrapack_vectors.json   Documentation/hydrapack_vectors.json
          diff /tmp/hydrapack_vectors.json   python/MCP/hydrapack_vectors.json
          diff /tmp/hydrapack_vectors.gen.h  codec/hydrapack_vectors.gen.h

      - name: Multi-Control — regenerate vectors, diff the committed copies
        run: |
          python3 python/MCP/gen_pipemulti_vectors.py /tmp/pipemulti_vectors.json
          diff /tmp/pipemulti_vectors.json   Documentation/pipemulti_vectors.json
          diff /tmp/pipemulti_vectors.json   python/MCP/pipemulti_vectors.json
          diff /tmp/pipemulti_vectors.gen.h  codec/pipemulti_vectors.gen.h

      - name: SDR/IQ + acoustic + egress + transport/bridge — loopback tests + smokes
        run: |
          python3 -m unittest python/tests/test_iq_loopback.py python/tests/test_acoustic.py \
                              python/tests/test_egress.py python/tests/test_transport.py \
                              python/tests/test_bridge.py -v
          python3 python/dcf/bridge.py --demo
          for mod in gfsk msk fsk4; do
            python3 python/modem/sdr.py tx --text "DCF!" --mod $mod --iq /tmp/d.cf32
            python3 python/modem/sdr.py rx --iq /tmp/d.cf32 --mod $mod | tee /tmp/rx.txt
            grep -q "44434621" /tmp/rx.txt && echo "dcf-sdr $mod cf32 round-trip: recovered \"DCF!\""
          done
          python3 python/modem/acoustic.py tx --text "DCF!" --profile handheld --wav /tmp/a.wav
          python3 python/modem/acoustic.py rx --profile handheld --wav /tmp/a.wav | tee /tmp/arx.txt
          grep -q "44434621" /tmp/arx.txt && echo "acoustic WAV round-trip: recovered \"DCF!\""
          python3 python/modem/uplink_demo.py >/dev/null && echo "uplink_demo: ok"

      - name: Modulation — self-test, regenerate vectors, diff the committed copies
        run: |
          python3 python/MCP/modulationlab_core.py
          python3 python/MCP/gen_modulation_vectors.py /tmp/modulation_vectors.json
          diff /tmp/modulation_vectors.json   Documentation/modulation_vectors.json
          diff /tmp/modulation_vectors.json   python/MCP/modulation_vectors.json
          diff /tmp/modulation_vectors.gen.h  codec/modulation_vectors.gen.h

      - name: Mesh — self-test, regenerate vectors, diff the committed copies
        run: |
          python3 python/MCP/meshlab_core.py
          python3 python/MCP/gen_mesh_vectors.py /tmp/mesh_vectors.json
          diff /tmp/mesh_vectors.json   Documentation/mesh_vectors.json
          diff /tmp/mesh_vectors.json   python/MCP/mesh_vectors.json
          diff /tmp/mesh_vectors.gen.h  codec/mesh_vectors.gen.h

      # Every certificate is committed twice (Documentation/ + python/MCP/). The adapter
      # jobs diff the regenerated file against both, but golden/audio/pm_param were only
      # ever compared against Documentation/. This makes the python/MCP/ copy of EVERY
      # family byte-identical to Documentation/ (and requires both copies to exist).
      - name: Vector copies — python/MCP/*_vectors.json byte-identical to Documentation/ (all families)
        run: |
          fail=0; n=0
          for req in golden audio pm_param; do
            [ -f "Documentation/${req}_vectors.json" ] || { echo "MISSING required family: Documentation/${req}_vectors.json"; fail=1; }
          done
          for doc in Documentation/*_vectors.json; do
            mcp="python/MCP/$(basename "$doc")"
            if [ ! -f "$mcp" ]; then echo "MISSING copy: $mcp"; fail=1; continue; fi
            if cmp -s "$doc" "$mcp"; then n=$((n+1)); echo "ok  $(basename "$doc")"
            else echo "DRIFT: $doc != $mcp"; diff "$doc" "$mcp" | head -20 || true; fail=1; fi
          done
          for mcp in python/MCP/*_vectors.json; do
            [ -f "Documentation/$(basename "$mcp")" ] || { echo "MISSING copy: Documentation/$(basename "$mcp")"; fail=1; }
          done
          echo "$n vector families: python/MCP/ == Documentation/"
          exit $fail

  certify-c:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build C certification test
        run: |
          mkdir -p build && cd build
          gcc -std=c11 -Wall -Wextra -I../codec -o wire_certify ../C_SDK/tests/test_wire_certify.c -lm

      - name: Run C wire certification
        run: build/wire_certify

      - name: Build and run C SuperPack certification
        run: |
          gcc -std=c11 -Wall -Wextra -I codec -o /tmp/test_superpack_certify C_SDK/tests/test_superpack_certify.c -lm
          /tmp/test_superpack_certify

      - name: Build and run C FEC (Reed-Solomon) certification
        run: |
          gcc -std=c11 -Wall -Wextra -I codec -o /tmp/test_fec_certify C_SDK/tests/test_fec_certify.c
          /tmp/test_fec_certify

      - name: Build and run C DCF-Pipe control certification
        run: |
          gcc -std=c11 -Wall -Wextra -I codec -o /tmp/test_pipe_certify C_SDK/tests/test_pipe_certify.c
          /tmp/test_pipe_certify

      - name: Build and run C HydraPack serialization certification
        run: |
          gcc -std=c11 -Wall -Wextra -I codec -o /tmp/test_hydrapack_certify C_SDK/tests/test_hydrapack_certify.c
          /tmp/test_hydrapack_certify

      - name: Build and run C Multi-Control certification
        run: |
          gcc -std=c11 -Wall -Wextra -I codec -o /tmp/test_pipemulti_certify C_SDK/tests/test_pipemulti_certify.c
          /tmp/test_pipemulti_certify

      - name: Build and run C modulation + mesh certification + node/modem (cmake)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec -o /tmp/test_modulation_certify C_SDK/tests/test_modulation_certify.c
          /tmp/test_modulation_certify
          gcc -std=c11 -Wall -Wextra -I codec -o /tmp/test_mesh_certify C_SDK/tests/test_mesh_certify.c
          /tmp/test_mesh_certify
          cmake -S C_SDK -B /tmp/cbuild -DDCF_BUILD_NODE=ON -DDCF_BUILD_TESTS=ON -DDCF_BUILD_EXAMPLES=OFF
          cmake --build /tmp/cbuild --target dcfnode test_proto_certify test_modulation_certify test_mesh_certify test_modem_loopback test_modem_fec
          ctest --test-dir /tmp/cbuild -R "proto_certify|modulation_certify|mesh_certify|modem_loopback|modem_fec" --output-on-failure

  # The 4-module spine's unit suite + the pinned regression suite (C4/H2/C6
  # class + the StreamDB C5 test), in three configs: plain, ASan+UBSan, TSan.
  # Before this job the unit suite never ran in CI at all.
  c-sdk-unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Plain build + full ctest (unit, regressions, all C certs)
        run: |
          cmake -S C_SDK -B /tmp/cb -DDCF_BUILD_NODE=ON -DDCF_BUILD_TESTS=ON -DDCF_BUILD_EXAMPLES=OFF
          cmake --build /tmp/cb -j"$(nproc)"
          ctest --test-dir /tmp/cb --output-on-failure

      - name: ASan+UBSan (unit + regressions + streamdb)
        run: |
          cmake -S C_SDK -B /tmp/cb-asan -DDCF_SAN=address -DDCF_BUILD_NODE=OFF -DDCF_BUILD_TESTS=ON -DDCF_BUILD_EXAMPLES=OFF
          cmake --build /tmp/cb-asan -j"$(nproc)" --target dcf_tests test_regressions test_streamdb_regress
          ctest --test-dir /tmp/cb-asan -R "unit_tests|regressions|streamdb_regress" --output-on-failure

      - name: TSan (unit + regressions + streamdb)
        run: |
          # TSan rejects the high ASLR entropy of modern runner kernels.
          sudo sysctl vm.mmap_rnd_bits=28 || true
          cmake -S C_SDK -B /tmp/cb-tsan -DDCF_SAN=thread -DDCF_BUILD_NODE=OFF -DDCF_BUILD_TESTS=ON -DDCF_BUILD_EXAMPLES=OFF
          cmake --build /tmp/cb-tsan -j"$(nproc)" --target dcf_tests test_regressions test_streamdb_regress
          ctest --test-dir /tmp/cb-tsan -R "unit_tests|regressions|streamdb_regress" --output-on-failure

  certify-hydramodem:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: HydraModem — full suite (unit/fuzz/stream/channel/loopback) + sanitizers
        run: |
          cd hydramodem
          make check
          make asan

      - name: HydraModem — DCF interop (a real DeModFrame survives TX->RX byte-exact)
        run: |
          cd hydramodem/dcf-tools
          ./build.sh
          ./build/dcf_loopback

      - name: HydraModem — hydra_symbols vectors vs the real hydra_frame_build (+ TX->RX per case)
        run: |
          cd hydramodem/dcf-tools
          ./build/hydra_symbols_certify

      - name: HydraModem — Faust DSP compile-check (only if faust is available)
        continue-on-error: true
        run: |
          if command -v faust >/dev/null 2>&1; then cd hydramodem && make validate; else echo "faust not installed; skipping"; fi

  certify-rust:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Run Rust wire certification
        working-directory: codec
        run: |
          cargo test --test certify
          cargo test --test certify_superpack
          cargo test --test certify_modulation
          cargo test --test certify_mesh
          cargo test --test certify_fec
          cargo test --test certify_pipe
          cargo test --test certify_hydrapack
          cargo test --test certify_pipemulti

  # DCF-SPA authorizer: token codec + verification + lifecycle (Rust unit +
  # cross-language check that a Python-built HMAC token verifies in Rust).
  # Authentication-only side channel; touches no wire vectors.
  spa:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Rust authorizer tests (+ Python cross-language)
        working-directory: spa
        run: cargo test
      - name: Python knock-client tests
        working-directory: python
        run: python3 -m unittest tests.test_spa -v

  certify-wasm:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust + wasm target
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Build the WASM codec
        run: |
          wasm-pack build codec-wasm --target web --out-dir ../web/src/wasm --out-name dcf_codec_wasm
          node web/scripts/inline-wasm.mjs

      - name: Certify WASM is byte-identical to the golden vectors
        run: node web/certify/certify_wasm.mjs

  certify-audio:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Regenerate audio vectors and diff against committed
        run: |
          python3 python/MCP/gen_audio_vectors.py /tmp/audio_vectors.json
          diff /tmp/audio_vectors.json    Documentation/audio_vectors.json
          diff /tmp/pm_param_vectors.json Documentation/pm_param_vectors.json
          diff /tmp/audio_vectors.gen.h   codec/audio_vectors.gen.h
          echo "audio vectors: committed == regenerated"

      - name: Build and run C audio certification (L2-only)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_audio_certify C_SDK/tests/test_audio_certify.c -lm
          /tmp/test_audio_certify

      - name: Run Rust audio certification
        working-directory: codec
        run: cargo test --test certify_audio

      - name: Regenerate Faust C and diff (only if faust is available)
        continue-on-error: true
        run: |
          if command -v faust >/dev/null 2>&1; then
            faust -lang c -cn DcfPmCodec codec/faust/dcf_pm_codec.dsp -o /tmp/dcf_pm_faust.c
            diff /tmp/dcf_pm_faust.c codec/faust/dcf_pm_faust.c \
              && echo "Faust C: committed == regenerated"
            faust -lang c -cn DcfRfModulator codec/faust/dcf_rf_modulator.dsp -o /tmp/dcf_rf_modulator.gen.c
            diff /tmp/dcf_rf_modulator.gen.c codec/faust/dcf_rf_modulator.gen.c \
              && echo "Faust RF modulator C: committed == regenerated"
          else
            echo "faust not installed — skipping Faust regeneration check"
          fi

  certify-game:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Regenerate game vectors and diff against committed
        run: |
          python3 python/MCP/gen_game_vectors.py /tmp/game_vectors.json
          diff /tmp/game_vectors.json    Documentation/game_vectors.json
          diff /tmp/game_vectors.json    python/MCP/game_vectors.json
          diff /tmp/game_vectors.gen.h   codec/game_vectors.gen.h
          echo "game vectors: committed == regenerated"

      - name: Build and run C game certification (L2-only)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_game_certify C_SDK/tests/test_game_certify.c -lm
          /tmp/test_game_certify

      - name: Run Rust game certification
        working-directory: codec
        run: cargo test --test certify_game

  certify-text:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Regenerate text vectors and diff against committed
        run: |
          python3 python/MCP/gen_text_vectors.py /tmp/text_vectors.json
          diff /tmp/text_vectors.json    Documentation/text_vectors.json
          diff /tmp/text_vectors.json    python/MCP/text_vectors.json
          diff /tmp/text_vectors.gen.h   codec/text_vectors.gen.h
          echo "text vectors: committed == regenerated"

      - name: Build and run C text certification (L2-only)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_text_certify C_SDK/tests/test_text_certify.c -lm
          /tmp/test_text_certify

      - name: Run Rust text certification
        working-directory: codec
        run: cargo test --test certify_text

  certify-qkd:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Run the canonical Python reference selftest
        run: python3 python/MCP/qkdlab_core.py

      - name: Regenerate qkd vectors and diff against committed
        run: |
          python3 python/MCP/gen_qkd_vectors.py /tmp/qkd_vectors.json
          diff /tmp/qkd_vectors.json    Documentation/qkd_vectors.json
          diff /tmp/qkd_vectors.json    python/MCP/qkd_vectors.json
          diff /tmp/qkd_vectors.gen.h   codec/qkd_vectors.gen.h
          echo "qkd vectors: committed == regenerated"

      - name: Build and run C qkd certification (L2-only)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_qkd_certify C_SDK/tests/test_qkd_certify.c -lm
          /tmp/test_qkd_certify

      - name: Run Rust qkd certification
        working-directory: codec
        run: |
          cargo test --test certify_qkd
          cargo test --lib qkd

  # DCF-QKD bridge: the ETSI GS QKD 014 runtime (client + mock KME + SAE flow) over a
  # loopback DCF transport.  Stdlib only; no network, no photonic hardware.
  # Implements no cryptography; the wire carries key_IDs, never key material — the
  # TestExportInvariant case enforces that.  See Documentation/DCF_QKD_SPEC.md.
  qkd-bridge:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install Python dependencies
        run: pip install numpy
      - name: Beacon L2 laws + bridge end-to-end
        working-directory: python
        run: python3 -m unittest tests.test_qkd_beacon tests.test_qkd_bridge -v
      - name: End-to-end demo (machine-readable)
        run: python3 python/dcf/qkd/demo.py --json

  certify-sstv:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Regenerate SSTV vectors and diff against committed
        run: |
          python3 python/MCP/sstvlab_core.py
          python3 python/MCP/gen_sstv_vectors.py /tmp/sstv_vectors.json
          diff /tmp/sstv_vectors.json    Documentation/sstv_vectors.json
          diff /tmp/sstv_vectors.json    python/MCP/sstv_vectors.json
          diff /tmp/sstv_vectors.gen.h   codec/sstv_vectors.gen.h
          echo "sstv vectors: committed == regenerated"

      - name: Build and run C SSTV certification (L2-only)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_sstv_certify C_SDK/tests/test_sstv_certify.c -lm
          /tmp/test_sstv_certify

      - name: Run Rust SSTV certification
        working-directory: codec
        run: cargo test --test certify_sstv

  certify-snake:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Self-test the DCF-Snake (record) and DCF-Cue (cue) L2 references
        run: |
          python3 python/MCP/snakelab_core.py
          python3 python/MCP/monitorlab_core.py

      - name: Regenerate Snake vectors (record plane + BEACON clock + unwrap_pid) and diff
        run: |
          python3 python/MCP/gen_snake_vectors.py /tmp/snake_vectors.json
          diff /tmp/snake_vectors.json    Documentation/snake_vectors.json
          diff /tmp/snake_vectors.json    python/MCP/snake_vectors.json
          diff /tmp/snake_vectors.gen.h   codec/snake_vectors.gen.h
          echo "snake vectors: committed == regenerated"

      - name: Regenerate Cue vectors (cue plane PCM) and diff
        run: |
          python3 python/MCP/gen_monitor_vectors.py /tmp/monitor_vectors.json
          diff /tmp/monitor_vectors.json   Documentation/monitor_vectors.json
          diff /tmp/monitor_vectors.json   python/MCP/monitor_vectors.json
          diff /tmp/monitor_vectors.gen.h  codec/monitor_vectors.gen.h
          echo "cue vectors: committed == regenerated"

      - name: Build and run C Snake + Cue certification (L2-only)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_snake_certify C_SDK/tests/test_snake_certify.c -lm
          /tmp/test_snake_certify
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_monitor_certify C_SDK/tests/test_monitor_certify.c -lm
          /tmp/test_monitor_certify

      - name: Build and run C raw-L2 SuperPack batching (+ compile the AF_PACKET socket impl)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_snake_l2 C_SDK/tests/test_snake_l2.c -lm
          /tmp/test_snake_l2
          gcc -std=c11 -Wall -Wextra -I codec -c hydramodem/dcf-tools/snake_l2.c -o /tmp/snake_l2.o

      - name: Install Python dependencies
        run: pip install numpy

      - name: Run the Python raw-L2 transport tests (privilege-free batch double)
        run: python3 -m unittest python/tests/test_snake_l2.py -v

      - name: Run the quanta ⇄ DCF-Snake bridge tests (QSS splitter; no quanta binary needed)
        run: python3 -m unittest python/tests/test_quanta_bridge.py -v

      - name: Build and run the mixer/spoke DSP unit tests (servo/jitter/ASRC/PLC/cue-mix)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_snake_dsp C_SDK/tests/test_snake_dsp.c -lm
          /tmp/test_snake_dsp

      - name: Build the DCF-Snake nodes + run the end-to-end in-process integration demo
        run: |
          cd hydramodem/dcf-tools
          cc -std=gnu11 -O2 -Wall -Wextra -I../../codec snake_loopback.c -lm -o /tmp/snake_loopback
          /tmp/snake_loopback
          # snake_source/snake_mixer #include "snake_ipc.h", which lives in the separate
          # DeMoD audio-stack repo (not vendored here) -- same guard as dcf-tools/build.sh.
          if [ -f "${DEMOD_IPC_INCLUDE:-/nonexistent}/snake_ipc.h" ]; then
            cc -std=gnu11 -O2 -Wall -Wextra -I../../codec -I"$DEMOD_IPC_INCLUDE" snake_source.c snake_l2.c -lm -lrt -o /tmp/snake_source
            cc -std=gnu11 -O2 -Wall -Wextra -I../../codec -I"$DEMOD_IPC_INCLUDE" snake_mixer.c  snake_l2.c -lm -lrt -o /tmp/snake_mixer
            head -c 200000 /dev/urandom > /tmp/pcm.f32
            /tmp/snake_source --selftest --no-quanta --block 1024 --in /tmp/pcm.f32
            /tmp/snake_mixer  --selftest --no-quanta --out /tmp/rec.f32
          else
            echo "skip: snake_source/snake_mixer need snake_ipc.h (external DeMoD audio-stack)"
          fi

      - name: Run Rust Snake + Cue certification
        working-directory: codec
        run: |
          cargo test --test certify_snake
          cargo test --test certify_monitor

  certify-lua:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Lua 5.4
        run: sudo apt-get update && sudo apt-get install -y lua5.4

      - name: Certify the Lua DCF-Audio framework
        run: lua5.4 lua/selftest.lua

      - name: Certify the Lua voice L3 + StreamDB history
        run: lua5.4 lua/selftest_voice.lua

      - name: Certify the deployment profiles and link budget
        run: |
          lua5.4 lua/selftest_profile.lua
          lua5.4 lua/dcf_talk.lua --budget

      - name: Certify the Lua agent harness
        run: lua5.4 lua/selftest_agent.lua

      - name: Certify the Lua DCF-Snake adapter
        run: lua5.4 lua/selftest_snake.lua

      - name: Certify the Lua transport (SuperPack + FEC batching)
        run: |
          lua5.4 -e 'local X=dofile("lua/dcf_transport.lua") local r=X.report(40,"wan") assert(r.datagrams==1 and r.kbps<90, "transport batching regressed") print(("transport OK: %d frames -> %d datagram, %.1f kbps"):format(r.frames,r.datagrams,r.kbps))'

      - name: Certify the Lua SuperPack container
        run: lua5.4 lua/dcf_superpack.lua

      - name: Certify the Lua FEC adapter
        run: lua5.4 lua/dcf_fec.lua

      - name: Smoke the rendezvous CLI
        run: lua5.4 lua/dcf_jam.lua --passphrase ci-jam --codec pcm --blocks 20

      - name: Smoke the full chat stack end to end
        run: |
          lua5.4 lua/dcf_talk.lua --blocks 40 --quiet
          lua5.4 lua/dcf_talk.lua --blocks 40 --loss 0.15 --quiet
          lua5.4 lua/dcf_talk.lua --blocks 40 --transport rf --corrupt 0.3 --quiet
          lua5.4 lua/dcf_talk.lua --blocks 40 --hub 8 --quiet

  certify-go:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

      - name: Vet the Go SDK
        working-directory: go
        run: go vet ./...

      - name: Certify the Go SDK (wire codec + game/audio/text adapters + UDP node)
        working-directory: go
        run: go test ./... -v

      - name: Race-check the UDP node
        working-directory: go
        run: go test -race ./node/

  certify-haskell:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up GHC and Cabal
        uses: haskell-actions/setup@v2
        with:
          ghc-version: '9.4'
          cabal-version: '3.10'

      - name: Certify the Haskell DeModFrame codec against the golden vectors
        working-directory: haskell
        run: cabal test --test-show-details=direct

  certify-java:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Certify the Java DeModFrame codec against the golden vectors
        run: |
          javac -d /tmp/jout java/com/demod/dcf/Frame.java java/com/demod/dcf/Certify.java \
            java/com/demod/dcf/SuperPack.java java/com/demod/dcf/SuperPackCertify.java \
            java/com/demod/dcf/FEC.java java/com/demod/dcf/FECCertify.java \
            java/com/demod/dcf/Medium.java java/com/demod/dcf/MediumCertify.java \
            java/com/demod/dcf/JsonLite.java \
            java/com/demod/dcf/Game.java java/com/demod/dcf/GameCertify.java \
            java/com/demod/dcf/Text.java java/com/demod/dcf/TextCertify.java \
            java/com/demod/dcf/McEvent.java java/com/demod/dcf/MinecraftCertify.java
          java -cp /tmp/jout com.demod.dcf.Certify Documentation/golden_vectors.json
          java -cp /tmp/jout com.demod.dcf.SuperPackCertify Documentation/superpack_vectors.json
          java -cp /tmp/jout com.demod.dcf.FECCertify Documentation/fec_vectors.json
          java -cp /tmp/jout com.demod.dcf.MediumCertify Documentation/medium_vectors.json
          java -cp /tmp/jout com.demod.dcf.GameCertify Documentation/game_vectors.json
          java -cp /tmp/jout com.demod.dcf.TextCertify Documentation/text_vectors.json
          java -cp /tmp/jout com.demod.dcf.MinecraftCertify Documentation/minecraft_vectors.json

  certify-minecraft:
    # DCF-Minecraft: the register/EVENT vectors (Python + Java), the datapack generator, the
    # punctim mc sidecar (fake server: RCON/FIFO/chat log), the Bedrock /connect bridge, and the
    # loader-agnostic core + Paper plugin jars via plain javac (the Fabric mod is Gradle-only).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Regenerate minecraft vectors and diff against committed
        run: |
          python3 python/MCP/gen_minecraft_vectors.py /tmp/minecraft_vectors.json
          diff /tmp/minecraft_vectors.json Documentation/minecraft_vectors.json
          diff /tmp/minecraft_vectors.json python/MCP/minecraft_vectors.json
          echo "minecraft vectors: committed == regenerated"

      - name: Python — vectors, datapack generator, sidecar (fake server), Bedrock bridge
        working-directory: python
        run: |
          python3 -m unittest tests.test_minecraft_vectors tests.test_minecraft_datapack \
                              tests.test_minecraft_sidecar tests.test_bedrock_ws -v
          python3 punctim.py version --json | grep -q '"mc"'

      - name: Set up JDK 21 (core) and 25 (Paper plugin)
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: |
            21
            25

      - name: Build the core + Paper plugin jars (javac) and run the core loopback
        env:
          PAPER_JDK: ${{ env.JAVA_HOME }}
        run: |
          JAVA_HOME="$JAVA_HOME_21_X64" bash minecraft/build.sh
          unzip -l minecraft/build/dcf-minecraft-paper.jar | grep -q plugin.yml
          unzip -l minecraft/build/dcf-minecraft-paper.jar | grep -q 'com/demod/dcf/Frame.class'

  certify-kotlin:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Set up Kotlin
        uses: fwilhe2/setup-kotlin@main

      - name: Certify the Kotlin DeModFrame codec against the golden vectors
        run: |
          kotlinc kotlin/src/main/kotlin/dcf/Frame.kt kotlin/src/main/kotlin/dcf/SuperPack.kt kotlin/src/main/kotlin/dcf/FEC.kt kotlin/src/main/kotlin/dcf/Certify.kt -include-runtime -d /tmp/kcert.jar
          java -cp /tmp/kcert.jar dcf.CertifyKt Documentation/golden_vectors.json

  certify-node:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Certify the Node.js DeModFrame codec against the golden vectors
        run: node JS/nodejs/test/certify.js

      - name: Certify the Node.js SuperPack container
        run: node JS/nodejs/test/certify_superpack.js

      - name: Certify the Node.js FEC adapter
        run: node JS/nodejs/test/certify_fec.js

      - name: Certify the Node.js DCF-Text adapter
        run: node JS/nodejs/test/certify_text.js

      - name: Certify the Node.js DCF-SSTV adapter
        run: node JS/nodejs/test/certify_sstv.js

  certify-perl:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Perl
        uses: shogo82148/actions-setup-perl@v1
        with:
          perl-version: '5.38'

      - name: Certify the Perl DeModFrame codec against the golden vectors
        working-directory: perl
        run: |
          perl Makefile.PL
          make test

  certify-cpp:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Certify the C++ DeModFrame codec against the golden vectors
        run: |
          g++ -std=c++17 -Wall -Wextra -I cpp/include -o /tmp/cpp_certify cpp/tests/certify.cpp
          /tmp/cpp_certify Documentation/golden_vectors.json

      - name: Certify the C++ SuperPack container
        run: |
          g++ -std=c++17 -Wall -Wextra -I cpp/include -o /tmp/cpp_superpack cpp/tests/certify_superpack.cpp
          /tmp/cpp_superpack

      - name: Certify the C++ FEC adapter
        run: |
          g++ -std=c++17 -Wall -Wextra -I cpp/include -o /tmp/cpp_fec cpp/tests/certify_fec.cpp
          /tmp/cpp_fec

  certify-swift:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Swift
        uses: swift-actions/setup-swift@v2
        with:
          swift-version: '5.10'

      - name: Certify the Swift DeModFrame codec against the golden vectors
        working-directory: swift
        run: swift test

  certify-lisp:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install SBCL
        run: sudo apt-get update && sudo apt-get install -y sbcl

      # Dependency-free (no Quicklisp): reads Documentation/{golden,fec}_vectors.json
      # directly via a tiny in-tree JSON reader and certifies all 109 encode + 137
      # syndrome frame vectors plus the full FEC vector set.
      - name: Certify the Lisp DeModFrame wire + FEC codecs against the golden vectors
        run: sbcl --non-interactive --load lisp/src/wire.lisp --load lisp/src/fec.lisp

      # Build the StreamDB foreign library and run the full Punctim SDK FiveAM
      # suite. continue-on-error so a flaky Quicklisp bootstrap (which needs the
      # network) can't fail the job — the dependency-free cert above is the gate.
      - name: Build libstreamdb + run the Punctim FiveAM suite
        continue-on-error: true
        run: |
          sudo apt-get install -y uuid-dev curl
          gcc -shared -fPIC -O2 \
            lisp/streamdb/streamdb.c lisp/streamdb/libstreamdb_wrapper.c \
            -o /usr/local/lib/libstreamdb.so -luuid
          sudo ldconfig
          curl -sLO https://beta.quicklisp.org/quicklisp.lisp
          sbcl --non-interactive \
            --load quicklisp.lisp \
            --eval '(quicklisp-quickstart:install :path "quicklisp/")' \
            --load lisp/src/punctim.lisp \
            --eval '(sb-ext:exit :code (if (d-lisp::run-tests) 0 1))'

  # DCF-Medium: the medium codecs (.dcf stream / hex / UDP proto+bare / raw-L2 / HydraModem
  # symbol stream / AFSK bits) that carry the 17-byte quantum over one medium without parsing
  # it. Regenerate the certificate (the generator asserts the medium laws), diff every
  # committed copy, then certify Python / C / Rust / Go / Node / C++. The other medium certs
  # ride their language jobs: Java MediumCertify -> certify-java, Perl t/medium.t ->
  # certify-perl (`make test` runs t/*.t), hydra_symbols_certify -> certify-hydramodem.
  # Spec: Documentation/DCF_MEDIUM_SPEC.md. The 246-vector wire certificate is untouched.
  certify-medium:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Python dependencies
        run: pip install numpy

      - name: Regenerate medium vectors (laws) and diff every committed copy
        run: |
          python3 python/MCP/gen_medium_vectors.py /tmp/medium_vectors.json
          diff /tmp/medium_vectors.json   Documentation/medium_vectors.json
          diff /tmp/medium_vectors.json   python/MCP/medium_vectors.json
          diff /tmp/medium_vectors.gen.h  codec/medium_vectors.gen.h
          echo "medium vectors: committed == regenerated"

      - name: Python — punctim certify + medium unit tests
        run: |
          python3 python/punctim.py certify
          cd python && python3 -m unittest tests.test_medium -v

      - name: Build and run C medium certification (header-only codec/demod_medium.h)
        run: |
          gcc -std=c11 -Wall -Wextra -I codec \
            -o /tmp/test_medium_certify C_SDK/tests/test_medium_certify.c -lm
          /tmp/test_medium_certify

      - name: Run Rust medium certification
        working-directory: codec
        run: cargo test --test certify_medium

      - name: Run Go medium certification
        working-directory: go
        run: go test ./medium/ -v

      - name: Run Node.js medium certification
        run: node JS/nodejs/test/certify_medium.js

      - name: Build and run C++ medium certification
        run: |
          g++ -std=c++17 -Wall -Wextra -I cpp/include -o /tmp/cpp_medium cpp/tests/certify_medium.cpp
          /tmp/cpp_medium

  # Cross-language I/O matrix: the five `punctim` CLIs (Python / C / Rust / Go / Node) x the
  # digital media — encode in one language, decode in another, byte-exact (tests/io_matrix.py,
  # stdlib). CLIs are found at their default paths (PUNCTIM_{PY,C,RS,GO,JS} override); the
  # HydraModem tools join via HYDRA_TOOLS_DIR (default hydramodem/dcf-tools/build) when they
  # build, and are skipped otherwise. The results table is uploaded as an artifact.
  io-matrix:
    needs: certify-medium
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Python dependencies
        run: pip install numpy

      - name: Build the C punctim CLI (cmake -> C_SDK/build/punctim)
        run: |
          cmake -S C_SDK -B C_SDK/build -DDCF_BUILD_NODE=ON -DDCF_BUILD_EXAMPLES=OFF
          cmake --build C_SDK/build --target punctim

      - name: Build the Rust punctim CLI (codec/target/debug/punctim)
        working-directory: codec
        run: cargo build --bin punctim

      - name: Build the Go punctim CLI (go/bin/punctim)
        working-directory: go
        run: go build -o bin/punctim ./cmd/punctim

      - name: Build the HydraModem tools (best-effort; hydra media are skipped without them)
        run: |
          cd hydramodem/dcf-tools && ./build.sh || true

      - name: Run the I/O matrix
        run: python3 tests/io_matrix.py

      - name: Upload the I/O matrix results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: io-matrix-results
          path: tests/io_matrix_results.md
          if-no-files-found: warn

  # Exsecutor — the 14th wire binding. The codec and its certificate live upstream
  # (ALH477/exsecutor, conformance entry 23): a DeModFrame encode/decode written in
  # Exsecutor, checked against a VENDORED copy of this repo's golden_vectors.json.
  # Exsecutor is GPL-3.0, so nothing is vendored here in the other direction — `exsc`
  # is a compiler invoked as a subprocess and its Exception A puts no obligation on
  # compiler output. See LICENSING.md and Documentation/DCF_EXSECUTOR.md.
  #
  # This job's real work is DRIFT DETECTION, and it cuts both ways: it fails if
  # upstream's vendored certificate stops matching the one this repo ships, which is
  # what would silently happen the next time golden_vectors.json is regenerated.
  certify-exsecutor:
    runs-on: ubuntu-latest
    steps:
      - name: Check out Punctim
        uses: actions/checkout@v4
        with:
          path: punctim

      - name: Check out Exsecutor
        uses: actions/checkout@v4
        with:
          repository: ALH477/exsecutor
          path: exsecutor

      - name: Certificate drift — upstream's vendored copy must equal ours
        run: |
          ours=punctim/Documentation/golden_vectors.json
          theirs=exsecutor/vendor/hydramesh-wire/golden_vectors.json
          echo "ours:   $(sha256sum $ours   | cut -c1-64)"
          echo "theirs: $(sha256sum $theirs | cut -c1-64)"
          if ! cmp -s "$ours" "$theirs"; then
            echo "::error::certificate drift — Exsecutor vendors a stale golden_vectors.json."
            echo "Re-vendor it upstream (vendor/hydramesh-wire/, update PROVENANCE.md digests)."
            diff <(head -40 "$ours") <(head -40 "$theirs") || true
            exit 1
          fi
          echo "vendored certificate is byte-identical to the one this repo ships"
          cmp -s punctim/Documentation/WIRE_QUANTUM_SPEC.md \
                 exsecutor/vendor/hydramesh-wire/WIRE_QUANTUM_SPEC.md \
            && echo "vendored WIRE_QUANTUM_SPEC.md is byte-identical too" \
            || echo "::warning::vendored WIRE_QUANTUM_SPEC.md differs from ours"

      - name: In-tree codec must not drift from the Exsecutor original
        run: |
          # The three .exsc files are a relicensed copy (LGPL-3.0-only, by explicit
          # grant of the copyright holder). Only the licence header may differ —
          # compare bodies with the header block stripped.
          # Two passes: sed's `1` address counts INPUT lines, so the trailing
          # `//` of the header only becomes line 1 after the range delete.
          strip_hdr() {
            sed '/^\/\/ SPDX-License-Identifier: LGPL-3.0-only$/,/^\/\/ and Documentation\/DCF_EXSECUTOR\.md\.$/d' "$1" \
              | sed '1{/^\/\/$/d}'
          }
          fail=0
          check() {
            if diff <(strip_hdr "punctim/exsecutor/$1") <(cat "exsecutor/$2") >/tmp/d.$$ 2>&1; then
              echo "  ok   $1 == upstream $2"
            else
              echo "::warning::$1 differs from upstream $2 (first lines below)"
              head -20 /tmp/d.$$; fail=1
            fi
          }
          check codex.exsc      tests/conformance/entry23/codex.exsc
          check probatio.exsc   tests/conformance/entry23/probatio.exsc
          [ "$fail" = 0 ] && echo "in-tree codec is in sync with upstream" || true

      - name: Install Nix
        uses: cachix/install-nix-action@v27
        with:
          extra_nix_config: "experimental-features = nix-command flakes"

      # certify.sh is self-sufficient given nix and fasmg: it builds the pinned
      # compiler with `nix build .#exsc` (GPL-3.0-or-later, run as a subprocess,
      # never linked) and supplies fasmg's $INCLUDE from `.#fasmg-x86` rather than
      # inheriting it. Nothing from the Exsecutor checkout is needed here — that
      # checkout exists only for the drift comparison and the upstream suite below.
      - name: Certify the IN-TREE codec against this repo's live certificate
        working-directory: punctim
        env:
          PUNCTIM_REQUIRE_EXSECUTOR: "1"   # a missing toolchain fails here, never skips
        run: |
          nix shell nixpkgs#fasmg --command ./exsecutor/certify.sh 2>&1 | tee /tmp/cert.log
          grep -q "certificate: 246/246 vectors" /tmp/cert.log \
            || { echo "::error::in-tree Exsecutor codec did not report 246/246"; exit 1; }

      # `if: always()` so this still reports when the step above fails — without it
      # a failure upstream of here skips it, and the mutation result goes unseen.
      - name: Upstream entry 23 (mutation + purity checks this repo does not reproduce)
        working-directory: exsecutor
        if: always()
        continue-on-error: true
        run: |
          nix develop --command bash tests/run.sh 2>&1 | tee /tmp/exs.log | grep -iE "entry23|RESULT" || true
          grep -q "entry 23: .*mutant .*fails" /tmp/exs.log \
            && echo "upstream mutation checks present (a broken codec is proven to fail)" \
            || echo "::warning::upstream reported no mutant checks"