Freeze current project-local SaaS Dispatcher contract and examples

scripts/check-current-contracts.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Check provenance and reproducible digests of the sole current local bundle."""
+import hashlib
+import json
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+BUNDLE = ROOT / "contracts" / "local"
+MANIFEST = BUNDLE / "manifest.json"
+
+
+def digest(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def main() -> None:
+    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
+    for relative, expected in manifest["sources"].items():
+        path = ROOT / relative
+        actual = digest(path)
+        if actual != expected:
+            raise SystemExit(f"source hash mismatch: {relative}: {actual} != {expected}")
+
+    paths = sorted(
+        (p for p in BUNDLE.rglob("*.json")
+         if p != MANIFEST and (p.parent == BUNDLE or p.relative_to(BUNDLE).parts[0] == "examples")),
+        key=lambda p: p.relative_to(BUNDLE).as_posix(),
+    )
+    if len(paths) < 10:
+        raise SystemExit("missing current contract examples or schemas")
+    listing = "".join(f"{p.relative_to(BUNDLE).as_posix()} {digest(p)}\n" for p in paths)
+    actual = hashlib.sha256(listing.encode("utf-8")).hexdigest()
+    if actual != manifest["bundle_sha256"]:
+        raise SystemExit(f"contract bundle hash mismatch: {actual} != {manifest['bundle_sha256']}")
+    print(f"current local contract: {len(paths)} JSON files, source and bundle hashes valid")
+
+
+if __name__ == "__main__":
+    main()

scripts/check-current-contracts.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")/.."
+python3 scripts/check-current-contracts.py
+go test ./contracts -run 'TestCurrentContract' -count=1