Build cross-language conformance, negative, state-machine, and fuzz suites

[zoeyrose]

Outcome

Make the protocol specification executable across generated Go/Rust consumers and catch semantic incompatibility that Protobuf parsing alone cannot detect.

Scope and normative requirements

• Maintain golden descriptors and per-domain binary/JSON-debug fixtures with explicit schema version, expected validation/state result, and provenance.
• Create negative matrices for truncation, oversize, deep nesting, invalid UTF-8/value ranges, duplicate IDs, unknown fields/enums/features, stale/future revisions, invalid ordering/state, unauthorized data, and transaction mismatch.
• Run Go encode→Rust decode/validate and Rust encode→Go decode/validate plus full server/client state-machine integration.
• Provide fuzz dictionaries/corpora/targets for framing, every externally accepted message group, semantic validators, and state transitions.
• Track generator/runtime version compatibility and deterministic diagnostic codes.

Acceptance criteria

• Every released message/enum/state transition has positive and boundary fixtures; every normative rejection has at least one negative fixture.
• A failed fixture cannot partially mutate the reference session/world model.
• CI tests generated packages from clean release artifacts and rejects drift/breaking changes.
• Fuzz crashes/oom/timeouts have reproducible seeds and explicit resource budgets.
• No fixture copies GPL tests unless exact approved-grantor provenance/grant is recorded.

Dependencies and parallelization

Begins with M1 schemas and expands continuously. Each domain issue owns fixtures; this issue owns harness, coverage reports, and release gate.

Licensing and scope boundary

Protocol schemas, specifications, fixtures, and generators are MIT. Verified original past work by an approved MIT provenance grantor may be migrated under the recorded provenance grant. Compiled content artifacts are specified by content-toolkit; this repository owns network contracts only.