feat: harden work-record and SBOM client contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

tests/test_sbom.py

@@ -4,10 +4,14 @@ import json
 import subprocess
 from pathlib import Path
 
+import pytest
+
 from repo_manager.cli import main
 from repo_manager.sbom_client import (
+    SBOMContractError,
     licence_report_from_snapshot,
     scan_repository_via_nexus,
+    validate_snapshot_contract,
 )
 
 
@@ -74,6 +78,14 @@ def test_scan_delegates_to_sbom_nexus_without_shell(monkeypatch, tmp_path: Path)
     assert result["schema"] == "sbom-nexus.snapshot.v1"
     assert result["product_owner"] == "sbom-nexus"
     assert result["delegated_by"] == "repo-manager"
+    assert result["repo_manager_context"] == {
+        "mode": "local-preview",
+        "authoritative": False,
+        "persisted": False,
+        "advances_last_attempt_at": False,
+        "advances_last_success_at": False,
+        "creates_snapshot_history": False,
+    }
 
 
 def test_missing_nexus_cli_returns_actionable_error(monkeypatch, tmp_path: Path) -> None:
@@ -98,10 +110,41 @@ def test_licence_report_alias_preserves_shape() -> None:
         "entry_count",
         "licence_report",
         "errors",
+        "repo_manager_context",
         "delegated_by",
         "product_owner",
     }
     assert result["licence_report"]["copyleft_direct_count"] == 0
+    assert result["repo_manager_context"]["authoritative"] is False
+
+
+def test_snapshot_contract_allows_additive_fields_and_rejects_unknown_schema() -> None:
+    validate_snapshot_contract({**_snapshot(), "future_addition": {"accepted": True}})
+
+    with pytest.raises(SBOMContractError, match="unsupported SBOM Nexus schema"):
+        validate_snapshot_contract({**_snapshot(), "schema": "sbom-nexus.snapshot.v2"})
+
+
+def test_scan_turns_unknown_schema_into_deterministic_contract_error(
+    monkeypatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("SBOM_NEXUS_CLI", "/opt/sbom-nexus/bin/sbom-nexus")
+    monkeypatch.setattr(
+        subprocess,
+        "run",
+        lambda command, **kwargs: subprocess.CompletedProcess(
+            command,
+            0,
+            json.dumps({**_snapshot(), "schema": "future.snapshot.v9"}),
+            "",
+        ),
+    )
+
+    result = scan_repository_via_nexus(tmp_path)
+
+    assert result["ok"] is False
+    assert result["errors"][0]["reason"] == "sbom-nexus-contract"
+    assert result["repo_manager_context"]["persisted"] is False
 
 
 def test_cli_scan_preserves_output_file_behavior(monkeypatch, tmp_path: Path, capsys) -> None: