Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

scripts/new_host.py

@@ -14,6 +14,11 @@ def main():
     p.add_argument("--role", default="test")
     p.add_argument("--image", default="ubuntu-24.04")
     p.add_argument("--user", default="admin")
+    p.add_argument(
+        "--reuse-existing",
+        action="store_true",
+        help="succeed only when an existing record exactly matches the request",
+    )
     args = p.parse_args()
 
     inv_path = os.path.join("inventory", "servers.yaml")
@@ -23,20 +28,33 @@ def main():
             data = yaml.safe_load(f) or {}
     servers = data.setdefault("servers", [])
 
-    # Prevent duplicates
-    if any(s.get("name") == args.name for s in servers):
-        print(f"ERROR: host '{args.name}' already exists in {inv_path}", file=sys.stderr)
+    candidate = {
+        "name": args.name,
+        "provider": "hetzner",
+        "lifecycle_mode": "provider-managed",
+        "ssh_user": args.user,
+        "baseline_profile": "ufw-managed",
+        "provisioning": {
+            "server_type": args.type,
+            "region": args.region,
+            "role": args.role,
+            "image": args.image,
+            "labels": [],
+        },
+    }
+    existing = next((s for s in servers if s.get("name") == args.name), None)
+    if existing is not None:
+        if args.reuse_existing and existing == candidate:
+            print(f"Reusing matching host '{args.name}' from {inv_path}")
+            return
+        print(
+            f"ERROR: host '{args.name}' already exists with a different declaration",
+            file=sys.stderr,
+        )
         sys.exit(1)
 
-    servers.append({
-        "name": args.name,
-        "labels": [],
-        "role": args.role,
-        "region": args.region,
-        "type": args.type,
-        "image": args.image,
-        "ssh_user": args.user,
-    })
+    data.setdefault("schema_version", "1.0")
+    servers.append(candidate)
 
     with open(inv_path, "w", encoding="utf-8") as f:
         yaml.safe_dump(data, f, sort_keys=False)