test(cross-impl): add 4-language JCS substrate runners for row #3 reproduction

[chopmob-cloud]

Summary

This PR adds single-file JCS RFC 8785 cross-implementation runners to tests/cross-impl/, closing the row #3 (urn:x402:audit-chain) in-line reproduction anchor for the May 27 working-doc publish deadline.

The work was offered in A2A discussion #1734 by @kenneives in response to the call for maintainer substrate PRs.

What is included

• tests/cross-impl/runner_python.py — uses rfc8785@0.1.4 (Trail of Bits / William Woodruff)
• tests/cross-impl/runner_node.js — uses canonicalize@3.0.0 (Samuel Erdtman + Anders Rundgren)
• tests/cross-impl/runner_go.go — uses gowebpki/jcs@v1.0.1 (Web PKI WG), with go.mod/go.sum
• tests/cross-impl/JcsRunner.java — uses cyberphone/json-canonicalization (Anders Rundgren, RFC 8785 author)
• tests/cross-impl/fixtures/ — 5 fixture files, 53 vectors total
• tests/cross-impl/README.md — setup and run instructions for all four languages

A fifth implementation (Rust serde_jcs by seritalien) has been validated externally against the same vector set; it is noted in the README but a runner is not included here.

Fixture breakdown

File	Vectors	Body key	Expected key
ap2-omh-v0.json	7	mandate_body	expected_jcs_bytes_b64
per_chain_envelope_v0.json	19	mandate_body	expected_jcs_bytes_b64
privacy_class_v0.1.json	13	attestation_body	expected_jcs_bytes_b64
aps_vectors.json	10	input	canonical_sha256
ctef_vectors.json	4	input_object	canonical_sha256

Total: 53 vectors / 4 implementations / 37 pair invariants

All implementations produce byte-identical JCS canonicalisation output. Python runner confirmed 53/53 PASS locally.

How to run

# Python
pip install rfc8785 && python tests/cross-impl/runner_python.py

# JavaScript
cd tests/cross-impl && npm install canonicalize && node runner_node.js

# Go
cd tests/cross-impl && go run runner_go.go

# Java — see JcsRunner.java header for compile instructions

Vector sources

Authored by chopmob-cloud (AlgoVoi), Apache 2.0:

• AP2 OMH v0: https://gist.github.com/chopmob-cloud/1dca25fd6107db4b7a30bed5dbf2ded8
• CTEF + APS v1: https://gist.github.com/chopmob-cloud/5f35eaa527d292bf3ddc52f8725a85c9
• privacy_class v0.1: https://gist.github.com/chopmob-cloud/30bcbc717c86493f737feb92c415ba07
• per_chain_envelope v0: https://gist.github.com/chopmob-cloud/e1bf4c9efde6f0e94b77c238cb33d78d

In-tree mirror (pending merge): x402-foundation/x402#2412

Test plan

• python tests/cross-impl/runner_python.py prints 53/53 PASS
• node tests/cross-impl/runner_node.js prints 53/53 PASS
• cd tests/cross-impl && go run runner_go.go prints 53/53 PASS
• Java runner compiles and prints 53/53 PASS after building webpki JAR per README

[chopmob-cloud]

@kenneives -- flagging the May 27 publish deadline. PR #21 adds four single-file runners (Python / JS / Go / Java) plus all 53 vectors and 37 pair invariants to tests/cross-impl/ against v0.3.3-cross-extension-matrix.

Python runner confirmed 53/53 locally before commit. The fixture path and runner structure were confirmed clean by @Liuyanfeng1234 earlier today (no adjustments needed). Rust is excluded with a reference to seritalien/serde_jcs noted in the README.

The PR is merge-ready on our side. Let us know if you need any adjustments to the path, runner structure, or fixture format before the deadline.

-- AlgoVoi (chopmob-cloud)

[chopmob-cloud]

Merged -- thanks @kenneives. The four AlgoVoi-authored runners (Python / JS / Go / Java) and the full 53-vector / 37-pair-invariant set are now reproducible in-tree under tests/cross-impl/ on v0.3.3-cross-extension-matrix, ahead of the May 27 publish deadline.

This gives the v0.3.2 layering figure row #3 an in-repo reproduction anchor: a reviewer can now re-run the byte-for-byte JCS matrix from the agentgraph tree directly rather than resolving external gist URLs. The figure row #3 status cell can cite tests/cross-impl/ as the reproduction path.

AlgoVoi will keep the runner set in sync as the substrate matrix extends -- the Rust fifth implementation (serde_jcs, Vauban Pay) and any new anchor sets land as follow-up commits against the same directory.

-- AlgoVoi (chopmob-cloud)