Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

tests/test_handoff.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+import sys
+import unittest
+from datetime import datetime, timezone
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+
+from s1_handoff import build_receipt  # noqa: E402
+from s1_receipt import validate_receipt  # noqa: E402
+
+
+HOSTS = [
+    {"name": "Railiance01", "baseline_profile": "ufw-managed"},
+    {"name": "CoulombCore", "baseline_profile": "external-firewall"},
+]
+
+
+class HandoffTests(unittest.TestCase):
+    def test_all_hosts_and_evidence_produce_pass(self) -> None:
+        receipt = build_receipt(
+            revision="3734a1c",
+            inventory_digest="a" * 64,
+            hosts=HOSTS,
+            results={"Railiance01": 0, "CoulombCore": 0},
+            observed_at=datetime(2026, 8, 23, tzinfo=timezone.utc),
+            freshness_hours=24,
+            evidence=[
+                {"kind": "goss-tap", "sha256": "b" * 64},
+                {"kind": "goss-tap", "sha256": "c" * 64},
+            ],
+        )
+        self.assertEqual("pass", receipt["status"])
+        validate_receipt(receipt)
+
+    def test_one_failed_host_fails_aggregate(self) -> None:
+        receipt = build_receipt(
+            revision="3734a1c",
+            inventory_digest="a" * 64,
+            hosts=HOSTS,
+            results={"Railiance01": 0, "CoulombCore": 1},
+            observed_at=datetime(2026, 8, 23, tzinfo=timezone.utc),
+            freshness_hours=24,
+            evidence=[],
+        )
+        self.assertEqual("fail", receipt["status"])
+
+    def test_dry_run_cannot_claim_pass(self) -> None:
+        receipt = build_receipt(
+            revision="3734a1c",
+            inventory_digest="a" * 64,
+            hosts=HOSTS,
+            results=None,
+            observed_at=datetime(2026, 8, 23, tzinfo=timezone.utc),
+            freshness_hours=24,
+            evidence=[],
+        )
+        self.assertEqual("not-run", receipt["status"])
+
+
+if __name__ == "__main__":
+    unittest.main()