Add producer-owned Go approval fact validation and canonical vectors

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

scripts/check_go_approvalfact.py

@@ -0,0 +1,53 @@
+"""Development-only Go parity check against the actual Python producer."""
+from pathlib import Path
+import json
+import math
+import os
+import random
+import struct
+import subprocess
+import sys
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+from approval_engine.binding import binding_digest, canonical_binding, canonical_json
+
+
+def main():
+    rng = random.Random(20261016)
+    values = [0.0, -0.0, 5e-324, -5e-324, sys.float_info.max,
+              sys.float_info.min, 1.0, 1e-4, 1e-5, 1e15, 1e16, 1e20, 1e21]
+    for _ in range(12000):
+        value = struct.unpack(">d", rng.getrandbits(64).to_bytes(8, "big"))[0]
+        if math.isfinite(value):
+            values.append(value)
+    for power in range(-323, 309):
+        value = float("1e" + str(power))
+        values.extend([value, math.nextafter(value, 0.0), math.nextafter(value, math.inf)])
+    targets = [{"value": value} for value in values if math.isfinite(value)]
+    targets += [{"value": n} for n in [0, -1, 1, 2**53+1, 10**100, -(10**100)]]
+    targets += [json.loads('{"value":' + token + '}') for token in
+                ["-0", "-0.0", "1E0", "1.000", "100e-2", "1e-07", "1e+20"]]
+    targets += [{"text": "".join(chr(i) for i in range(32)) + '<>&é雪😀\u2028\u2029'}]
+    for _ in range(200):
+        points = [rng.randrange(0x110000) for _ in range(20)]
+        targets.append({"text": "".join(chr(c) for c in points if not 0xD800 <= c <= 0xDFFF)})
+    with tempfile.TemporaryDirectory(prefix="approval-go-oracle-") as tmp:
+        path = Path(tmp) / "oracle.jsonl"
+        with path.open("w") as stream:
+            for target in targets:
+                act = dict(action="execute-ccr", actor="service:secrets-engine",
+                           principal="principal", purpose="differential", target=target)
+                row = {"Raw": json.dumps(act, ensure_ascii=False, allow_nan=False),
+                       "Canonical": canonical_json(canonical_binding(act)).decode(),
+                       "Digest": binding_digest(act)}
+                stream.write(json.dumps(row, ensure_ascii=True, allow_nan=False) + "\n")
+        env = dict(os.environ, APPROVAL_TEST_ORACLE=str(path))
+        subprocess.run(["go", "test", "-count=1", "-run", "TestPythonDifferential", "-v", "./..."],
+                       cwd=ROOT / "adapters/go/approvalfact", env=env, check=True)
+        print(f"Python producer corpus: {len(targets)} cases")
+
+
+if __name__ == "__main__":
+    main()