Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

tests/test_inventory_contract.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+import copy
+import sys
+import unittest
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+
+from inventory_contract import (  # noqa: E402
+    InventoryError,
+    load_inventory,
+    managed_hetzner_servers,
+    validate_inventory,
+)
+
+
+class InventoryContractTests(unittest.TestCase):
+    def test_current_adopted_inventory_has_no_managed_hetzner_hosts(self) -> None:
+        payload = load_inventory(ROOT / "inventory" / "servers.yaml")
+        self.assertEqual([], managed_hetzner_servers(payload))
+        self.assertEqual(
+            {"CoulombCore", "Railiance01"},
+            {server["name"] for server in payload["servers"]},
+        )
+
+    def test_valid_hetzner_fixture_is_selected(self) -> None:
+        payload = load_inventory(
+            ROOT / "tests" / "fixtures" / "inventory" / "valid-hetzner.yaml"
+        )
+        self.assertEqual(
+            ["fixture-hetzner-01"],
+            [server["name"] for server in managed_hetzner_servers(payload)],
+        )
+
+    def test_adopted_host_cannot_carry_provisioning_fields(self) -> None:
+        with self.assertRaisesRegex(InventoryError, "must not carry"):
+            load_inventory(
+                ROOT / "tests" / "fixtures" / "inventory" / "invalid-mixed.yaml"
+            )
+
+    def test_managed_host_requires_complete_provisioning(self) -> None:
+        payload = yaml.safe_load(
+            (ROOT / "tests" / "fixtures" / "inventory" / "valid-hetzner.yaml").read_text()
+        )
+        broken = copy.deepcopy(payload)
+        del broken["servers"][0]["provisioning"]["server_type"]
+        with self.assertRaisesRegex(InventoryError, "server_type"):
+            validate_inventory(broken)
+
+    def test_managed_host_cannot_have_static_ip(self) -> None:
+        payload = yaml.safe_load(
+            (ROOT / "tests" / "fixtures" / "inventory" / "valid-hetzner.yaml").read_text()
+        )
+        payload["servers"][0]["ip"] = "192.0.2.20"
+        with self.assertRaisesRegex(InventoryError, "addresses come from provider"):
+            validate_inventory(payload)
+
+
+if __name__ == "__main__":
+    unittest.main()