Add enterprise appliance experience Phase 1 foundation

tests/backend/test_experience_contracts.py

@@ -0,0 +1,24 @@
+from datetime import datetime, timezone
+
+from ._source import load_symbols
+
+
+def test_customer_state_normalizes_unknown_values():
+    ns = load_symbols("CUSTOMER_STATES", "customer_state", globals_dict={"utcnow": lambda: datetime.now(timezone.utc).isoformat()})
+    payload = ns["customer_state"]("mystery", "Status cannot be observed")
+    assert payload["schema"] == "cezen.customer_state.v1"
+    assert payload["state"] == "unavailable"
+    assert payload["summary"] == "Status cannot be observed"
+
+
+def test_error_envelope_has_customer_safe_fields():
+    ns = load_symbols("error_envelope")
+    payload = ns["error_envelope"]("service_unavailable", "Model service is unavailable", "Retry after checking health.", affected_scope="local inference", correlation_id="corr-1")
+    assert set(payload) == {"schema", "code", "message", "remediation", "affected_scope", "correlation_id"}
+    assert payload["correlation_id"] == "corr-1"
+
+
+def test_new_operation_interfaces_require_admin_in_source():
+    source = (__import__("pathlib").Path(__file__).resolve().parents[2] / "ansible/roles/cezen-backend/files/main.py").read_text()
+    assert 'actor.get("role") != "admin"' in source
+    assert '"admin_required"' in source