implement ops hub extension contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

tests/test_extension_contract.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import json
+import unittest
+
+from ops_hub.extension_contract import (
+    CONTRACT_ID,
+    CONTRACT_VERSION,
+    PACKAGE_PATH,
+    REUSE_SURFACE_ID,
+    find_secret_violations,
+    load_extension_package,
+    package_sha256,
+    validate_owner_invariants,
+    validation_receipt,
+)
+
+
+class ExtensionContractTests(unittest.TestCase):
+    def test_owner_package_is_valid_and_versioned(self) -> None:
+        package = load_extension_package()
+        validate_owner_invariants(package)
+        self.assertEqual(package["descriptor"]["contract_id"], CONTRACT_ID)
+        self.assertEqual(package["descriptor"]["contract_version"], CONTRACT_VERSION)
+        self.assertEqual(package["manifest"]["reuse_surface_id"], REUSE_SURFACE_ID)
+
+    def test_package_is_canonical_json_and_receipt_is_non_secret(self) -> None:
+        package = load_extension_package()
+        self.assertEqual(package, json.loads(PACKAGE_PATH.read_text(encoding="utf-8")))
+        receipt = validation_receipt()
+        self.assertTrue(receipt["ok"])
+        self.assertEqual(len(package_sha256()), 64)
+        self.assertEqual(receipt["secret_violations"], [])
+
+    def test_secret_detection_reports_paths_without_values(self) -> None:
+        value = {
+            "nested": {"api_token": "do-not-return"},
+            "database": "postgresql://runtime:do-not-return@example.invalid/hub",
+        }
+        self.assertEqual(find_secret_violations(value), ["$.nested.api_token", "$.database"])
+
+    def test_service_catalog_handoff_and_event_boundary_are_declared(self) -> None:
+        manifest = load_extension_package()["manifest"]
+        self.assertIn("capability.operations.service-catalog", manifest["provides"])
+        self.assertEqual(manifest["events_emitted"], ["ops.endpoint.verified"])
+        self.assertEqual(manifest["events_consumed"], ["hub.progress.recorded"])
+        self.assertIn("port.events.interaction", manifest["consumes"])
+
+
+if __name__ == "__main__":
+    unittest.main()