Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

tests/test_baseline_contract.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+import copy
+import json
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+
+from baseline_contract import (  # noqa: E402
+    BaselineError,
+    load_spec,
+    profile_hostvars,
+    validate_repo_consumers,
+    validate_spec,
+)
+
+
+class BaselineContractTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.payload = load_spec(ROOT / "spec" / "server-baseline.yaml")
+
+    def test_profiles_resolve_distinct_firewall_controls(self) -> None:
+        managed = profile_hostvars(self.payload, "ufw-managed")
+        external = profile_hostvars(self.payload, "external-firewall")
+        self.assertTrue(managed["ufw_manage"])
+        self.assertIn("ufw", managed["baseline_required_services"])
+        self.assertFalse(external["ufw_manage"])
+        self.assertNotIn("ufw", external["baseline_required_services"])
+        self.assertIn("replacement_control", external["baseline_firewall"])
+
+    def test_governed_package_mismatch_fails(self) -> None:
+        broken = copy.deepcopy(self.payload)
+        broken["defaults"]["packages"].remove("htop")
+        with self.assertRaisesRegex(BaselineError, "htop"):
+            validate_spec(broken)
+
+    def test_governed_ssh_weakening_fails(self) -> None:
+        broken = copy.deepcopy(self.payload)
+        broken["defaults"]["ssh_directives"]["PermitRootLogin"] = "yes"
+        with self.assertRaisesRegex(BaselineError, "SSH"):
+            validate_spec(broken)
+
+    def test_ansible_and_goss_consume_shared_variables(self) -> None:
+        validate_repo_consumers(ROOT)
+
+    def test_dynamic_inventory_resolves_each_host_profile(self) -> None:
+        raw = subprocess.check_output(
+            [sys.executable, str(ROOT / "ansible" / "inventory_from_yaml.py")],
+            text=True,
+            cwd=ROOT,
+        )
+        hostvars = json.loads(raw)["_meta"]["hostvars"]
+        self.assertEqual("external-firewall", hostvars["CoulombCore"]["baseline_profile"])
+        self.assertEqual("ufw-managed", hostvars["Railiance01"]["baseline_profile"])
+
+
+if __name__ == "__main__":
+    unittest.main()