Cross-port conformance for PCF-DCP

Mirror the PCF-SIG cross-port machinery for DCP so all four implementations are
held to the same byte-exact canonical vector.

- reference/PCF-DCP-v1.0/tests/cross_port_testdata.rs: assert that the
  testdata/canonical.bin shipped by each language port (TS, PHP, .NET) is
  byte-identical to the reference 700-byte vector, and that the reference is
  exactly 700 bytes.
- cross-port-interop.yml: add a cross-port-byte-exact-dcp job that regenerates
  the DCP vector from each writer (Rust example, TS/PHP gen-testvector, an
  on-the-fly .NET CLI over ReferenceVector.Build) and asserts all four match the
  pinned SHA-256 b9bb5979… and each other; add DCP trigger paths.

Verified locally: the Rust, TypeScript, PHP and .NET writers all emit the same
700-byte file with SHA-256
b9bb59794abed008863063886d8d0daa810c44939c1c5d29449475ced8156b90.

https://claude.ai/code/session_01XzcjWWbNiuNX9ZywevfbQu

Author: claude

.github/workflows/cross-port-interop.yml

@@ -16,6 +16,8 @@ on:
     paths:
       - 'reference/PCF-SIG-v1.0/**'
       - 'implementations/**/pcf-sig/**'
+      - 'reference/PCF-DCP-v1.0/**'
+      - 'implementations/**/pcf-dcp/**'
       - 'implementations/ts/package.json'
       - 'implementations/ts/package-lock.json'
       - 'implementations/dotnet/Directory.Build.props'
@@ -25,6 +27,8 @@ on:
     paths:
       - 'reference/PCF-SIG-v1.0/**'
       - 'implementations/**/pcf-sig/**'
+      - 'reference/PCF-DCP-v1.0/**'
+      - 'implementations/**/pcf-dcp/**'
       - 'implementations/ts/package.json'
       - 'implementations/ts/package-lock.json'
       - 'implementations/dotnet/Directory.Build.props'
@@ -169,3 +173,111 @@ jobs:
             /tmp/ts.bin
             /tmp/php.bin
             /tmp/dotnet.bin
+
+  cross-port-byte-exact-dcp:
+    name: all DCP writers produce identical bytes
+    runs-on: ubuntu-latest
+    # Expected SHA-256 of the canonical 700-byte DCP vector (spec Section 17).
+    env:
+      EXPECTED_SHA256: b9bb59794abed008863063886d8d0daa810c44939c1c5d29449475ced8156b90
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: implementations/ts/package-lock.json
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: hash, mbstring
+          coverage: none
+          tools: composer:v2
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      # ---- Rust reference writer --------------------------------------------
+      - name: Generate Rust reference vector
+        run: cargo run -p pcf-dcp --example gen_testvector -- /tmp/rust.bin
+
+      # ---- TypeScript writer ------------------------------------------------
+      - name: Install npm deps and build pcf
+        working-directory: implementations/ts
+        run: |
+          npm ci
+          npm run build -w @kduma-oss/pcf
+      - name: Generate TS vector
+        working-directory: implementations/ts
+        run: npm run gen-testvector -w @kduma-oss/pcf-dcp -- /tmp/ts.bin
+
+      # ---- PHP writer -------------------------------------------------------
+      - name: Install composer deps
+        working-directory: implementations/php/pcf-dcp
+        run: composer install --prefer-dist --no-progress --no-interaction
+      - name: Generate PHP vector
+        working-directory: implementations/php/pcf-dcp
+        run: php examples/gen_testvector.php /tmp/php.bin
+
+      # ---- .NET writer ------------------------------------------------------
+      - name: Generate .NET vector
+        run: |
+          mkdir -p /tmp/dotnet-gen
+          cat > /tmp/dotnet-gen/GenTestVector.csproj <<'EOF'
+          <Project Sdk="Microsoft.NET.Sdk">
+            <PropertyGroup>
+              <OutputType>Exe</OutputType>
+              <TargetFramework>net8.0</TargetFramework>
+              <Nullable>disable</Nullable>
+            </PropertyGroup>
+            <ItemGroup>
+              <ProjectReference Include="$(GITHUB_WORKSPACE)/implementations/dotnet/pcf-dcp/src/Pcf.Dcp/Pcf.Dcp.csproj" />
+            </ItemGroup>
+          </Project>
+          EOF
+          cat > /tmp/dotnet-gen/Program.cs <<'EOF'
+          using System.IO;
+          using Pcf.Dcp;
+          File.WriteAllBytes(args[0], ReferenceVector.Build());
+          EOF
+          dotnet run --project /tmp/dotnet-gen/GenTestVector.csproj -c Release -- /tmp/dotnet.bin
+
+      # ---- Compare ----------------------------------------------------------
+      - name: All four DCP writers agree on byte-exact output
+        run: |
+          set -euo pipefail
+          ls -l /tmp/rust.bin /tmp/ts.bin /tmp/php.bin /tmp/dotnet.bin
+          fail=0
+          for f in /tmp/rust.bin /tmp/ts.bin /tmp/php.bin /tmp/dotnet.bin; do
+            d=$(sha256sum "$f" | awk '{print $1}')
+            echo "$f -> $d"
+            if [ "$d" != "$EXPECTED_SHA256" ]; then
+              echo "::error::$f sha256 = $d (expected $EXPECTED_SHA256)"
+              fail=1
+            fi
+            if ! cmp -s /tmp/rust.bin "$f"; then
+              echo "::error::$f differs from /tmp/rust.bin"
+              fail=1
+            fi
+          done
+          if [ "$fail" != "0" ]; then
+            echo "Cross-port DCP writer interop FAILED"
+            exit 1
+          fi
+          echo "All four DCP writers produced sha256 = $EXPECTED_SHA256"
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: cross-port-vectors-dcp
+          path: |
+            /tmp/rust.bin
+            /tmp/ts.bin
+            /tmp/php.bin
+            /tmp/dotnet.bin

reference/PCF-DCP-v1.0/tests/cross_port_testdata.rs

@@ -0,0 +1,84 @@
+//! Cross-port test-vector parity check.
+//!
+//! Every PCF-DCP language port ships its own copy of the canonical 700-byte
+//! container vector under `implementations/<lang>/pcf-dcp/testdata/
+//! canonical.bin`. Each port's own test suite asserts that its writer produces
+//! this byte sequence; this Rust workspace test additionally asserts that the
+//! shipped *files* are byte-identical, so that any future regeneration of the
+//! reference vector cannot leave one port out of sync.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+/// The reference vector compiled into the test binary.
+const REFERENCE: &[u8] = include_bytes!("../testdata/canonical.bin");
+
+/// Locate the repository root from this crate's `CARGO_MANIFEST_DIR`.
+/// reference/PCF-DCP-v1.0 → repository root is two levels up.
+fn repo_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .expect("PCF-DCP-v1.0 crate has a parent (reference/)")
+        .parent()
+        .expect("reference/ has a parent (repo root)")
+        .to_path_buf()
+}
+
+fn read_port_vector(rel: &str) -> Vec<u8> {
+    let path = repo_root().join(rel);
+    fs::read(&path).unwrap_or_else(|e| {
+        panic!(
+            "failed to read {}: {e}\n\
+             every PCF-DCP language port MUST ship a copy of the canonical \
+             test vector identical to reference/PCF-DCP-v1.0/testdata/canonical.bin",
+            path.display(),
+        )
+    })
+}
+
+fn assert_byte_identical(label: &str, port: &[u8]) {
+    assert_eq!(
+        port.len(),
+        REFERENCE.len(),
+        "{label} ships canonical.bin of length {} bytes; reference is {} bytes",
+        port.len(),
+        REFERENCE.len(),
+    );
+    if port != REFERENCE {
+        let first_diff = port
+            .iter()
+            .zip(REFERENCE.iter())
+            .position(|(a, b)| a != b)
+            .unwrap_or(REFERENCE.len());
+        panic!(
+            "{label} canonical.bin diverges from reference at offset {first_diff}: \
+             port byte = 0x{:02x}, reference byte = 0x{:02x}",
+            port.get(first_diff).copied().unwrap_or(0),
+            REFERENCE.get(first_diff).copied().unwrap_or(0),
+        );
+    }
+}
+
+#[test]
+fn typescript_port_testdata_matches_reference() {
+    let port = read_port_vector("implementations/ts/pcf-dcp/testdata/canonical.bin");
+    assert_byte_identical("TypeScript port", &port);
+}
+
+#[test]
+fn php_port_testdata_matches_reference() {
+    let port = read_port_vector("implementations/php/pcf-dcp/testdata/canonical.bin");
+    assert_byte_identical("PHP port", &port);
+}
+
+#[test]
+fn dotnet_port_testdata_matches_reference() {
+    let port = read_port_vector("implementations/dotnet/pcf-dcp/testdata/canonical.bin");
+    assert_byte_identical(".NET port", &port);
+}
+
+/// Sanity: the reference itself is the canonical 700-byte vector we expect.
+#[test]
+fn reference_has_canonical_length() {
+    assert_eq!(REFERENCE.len(), 700);
+}