feat: finalize encryption and voting provider contracts

tests/test_voting_contract.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import unittest
+
+from govoplan_core.core.voting import VotingResult
+
+
+def result_with_evidence(*evidence):
+    return VotingResult(
+        ballot_id="ballot-1",
+        revision=2,
+        counts={"yes": 1},
+        weighted_counts={"yes": 1},
+        cast_count=1,
+        cast_weight=1,
+        eligible_count=1,
+        eligible_weight=1,
+        quorum_met=True,
+        threshold_met=True,
+        winning_options=("yes",),
+        result_sha256="a" * 64,
+        evidence=evidence,
+    )
+
+
+class VotingContractTests(unittest.TestCase):
+    def test_accepts_sanitized_provider_evidence(self) -> None:
+        value = result_with_evidence(
+            {
+                "kind": "reference_provider_result",
+                "provider_id": "local_confidential",
+                "certified": False,
+            }
+        )
+
+        self.assertEqual("local_confidential", value.evidence[0]["provider_id"])
+
+    def test_rejects_secret_or_raw_selection_evidence(self) -> None:
+        with self.assertRaisesRegex(ValueError, "sensitive field"):
+            result_with_evidence({"access_token": "not-for-projection"})
+        with self.assertRaisesRegex(ValueError, "sensitive field"):
+            result_with_evidence({"nested": {"selections": ["yes"]}})
+
+    def test_rejects_non_json_or_oversized_evidence(self) -> None:
+        with self.assertRaisesRegex(ValueError, "bounded JSON"):
+            result_with_evidence({"value": b"binary"})
+        with self.assertRaisesRegex(ValueError, "size limit"):
+            result_with_evidence({"value": "x" * (64 * 1024)})
+
+
+if __name__ == "__main__":
+    unittest.main()