test(ap2): add mandate conformance corpus and reference verifier

.cspell.json

@@ -4,6 +4,7 @@
   "caseSensitive": true,
   "useGitignore": true,
   "ignorePaths": [
+    "contrib/mandate-corpus/vectors/**",
     ".github/**",
     ".cspell/**",
     ".gemini/**",
@@ -13,9 +14,9 @@
   ],
   "dictionaryDefinitions": [
     {
-        "name": "custom-words",
-        "path": "./.cspell/custom-words.txt",
-        "addWords": true
+      "name": "custom-words",
+      "path": "./.cspell/custom-words.txt",
+      "addWords": true
     }
   ],
   "dictionaries": [

.cspell/custom-words.txt

@@ -1,59 +1,124 @@
-aapt
-absl
-achatassistant
 ACMRTUXB
+ASGI
 Adyen
-agentic
 Agentic
-agenticpayments
 Algorand
-androidx
 Applebot
-appname
-ASGI
-bazel
+BVNK
 Blackhawk
 Boku
-BVNK
-celerybeat
-classpath
 CLASSPATH
 CMSPI
-cmwallet
-cncf
+CYGPATTERN
 Cobo
 Connor
-contentnegotiation
-credman
 Crossmint
-cryptographical
-CYGPATTERN
+DCQL
+DPAN
 Dafiti
-disclosable
-Disclosable
-davecgh
-dcql
 Dcql
-DCQL
-deviceauth
 Dfile
-dmypy
+Disclosable
 Doku
 Dorg
-DPAN
 Drawables
+EC
+ES256
 Ebanx
+Fiuu
+Forter
+Fudd's
+Garena
+Gravitee
+Hashkey
+Imtp
+JAVACMD
+JWK
+Jetpack
+KXMYBJWNQ
+Kaia
+Klarna
+Kotlinx
+Ktor
+Lazada
+Licence
+Lightspark
+Loja
+MERCANTILE
+MSYS
+Mispick
+Momo
+Monee
+Mysten
+Nuvei
+OURCYGPATTERN
+Otherville
+PKI
+Palo
+Paynet
+Payoneer
+Payplug
+Proguard
+ROOTDIRS
+ROOTDIRSRAW
+RPCURL
+Revolut
+Riskified
+Rulebook
+SECP
+Shopcider
+Shopee
+Signifyd
+Splitit
+Spyder
+Truelayer
+Trulioo
+Wallex
+Wayfair
+Worldline
+Worldpay
+XVCJ
+Xdock
+Xendit
+Yapily
+Zalopay
+Zalora
+aapt
+absl
+achatassistant
+agentic
+agenticpayments
+androidx
+appname
+authorisation
+authorise
+authorises
+base64url
+bazel
+cand
+celerybeat
+classpath
+cmwallet
+cncf
+cnf
+conformance
+contentnegotiation
+credentagent
+credman
+crypto
+cryptographical
+davecgh
+dcql
+deviceauth
+disclosable
+dmypy
 emvco
 endlocal
 envoyproxy
 esac
 felixge
-Fiuu
 fontawesome
-Forter
 fqcn
-Fudd's
-Garena
 gemini
 genai
 generativeai
@@ -63,75 +128,63 @@ gofmt
 gopkg
 gradletasknamecache
 gradlew
-Gravitee
 groupcache
 gson
-Hashkey
 honnef
 hprof
 htmlcov
 httpsnoop
 icns
 imei
-Imtp
 inlinehilite
 inmemory
 ipynb
 issuerauth
-JAVACMD
 jetbrains
-Jetpack
+jsonschema
 jvmargs
-Kaia
+jwcrypto
 keepattributes
 keepclassmembers
-Klarna
 kotlin
 kotlinx
-Kotlinx
 ktor
-Ktor
-KXMYBJWNQ
-Lazada
 libpeerconnection
-Lightspark
 linenums
 llms
 llmstxt
 logr
 longrunning
 mastercard
 micropayments
-Mispick
-Momo
-Monee
 msys
-MSYS
 multistep
-Mysten
 nexi
+nonusd
+normalise
+normalises
+normalising
 nosetests
-Nuvei
 objx
 octicons
 okhttp
+openid
+openmobilehub
 opentelemetry
 otelgrpc
 otelhttp
-Otherville
-OURCYGPATTERN
-Palo
 passcodes
-Paynet
-Payoneer
+payee
+payloads
+payoffs
 paypal
-Payplug
 pids
+pisp
 pmezard
 proguard
-Proguard
 prometheus
 protoc
+pyca
 pyflow
 pymdownx
 pypa
@@ -141,47 +194,28 @@ refundability
 renamesourcefileattribute
 representment
 repudiable
-Revolut
-Riskified
-ROOTDIRS
-ROOTDIRSRAW
 ropeproject
-RPCURL
-Rulebook
 screenreaders
+sdjwt
 setlocal
 sharedpref
-Shopcider
-Shopee
 sideloaded
-Signifyd
 skus
 solana
-Splitit
-Spyder
 spyderproject
 spyproject
 stablecoins
 stdr
 stretchr
 superfences
-Truelayer
-Trulioo
 udpa
+unexecutability
 unmarshal
+unmerged
 viewmodel
 vulnz
-Wallex
-Wayfair
 webassets
-Worldline
-Worldpay
-Xdock
-Xendit
 xerrors
+xfail
 xmocksignature
 xrandomnonce
-XVCJ
-Yapily
-Zalopay
-Zalora

.github/workflows/mandate-corpus.yml

@@ -0,0 +1,44 @@
+# Конформити-корпус мандатов AP2.
+#
+# Векторы обязаны ломаться вслед за SDK: если изменение верификации тихо
+# ломает проверку подписи или cnf-привязки, тест падает в том же PR,
+# а не через месяц у продавца.
+name: mandate-corpus
+
+on:
+  pull_request:
+    paths:
+      - 'code/sdk/python/**'
+      - 'contrib/mandate-corpus/**'
+      - '.github/workflows/mandate-corpus.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'code/sdk/python/**'
+      - 'contrib/mandate-corpus/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  vectors:
+    name: signed mandate fixtures
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12'
+      # pyproject.toml lives at the repository root; the package under
+      # code/sdk/python is declared via [tool.setuptools.packages.find].
+      - run: pip install -e .
+      - name: verify fixtures
+        run: python contrib/mandate-corpus/tools/verify_fixtures.py
+      - name: negative vectors
+        run: python contrib/mandate-corpus/tools/negative_vectors.py
+      # Воспроизводитель дефекта expected_aud; падает, пока дефект открыт.
+      # continue-on-error — снимок флага сделает шаг обязательным.
+      - name: poc expected_aud (known defect, non-blocking)
+        continue-on-error: true
+        run: python contrib/mandate-corpus/tools/poc_aud_not_enforced.py