[AAASM-5756] ✨ (scripts): Add --root override and a negative control to check_contact_metadata.py

[Chisanan232]

Description

Adds a --root CLI override to scripts/check_contact_metadata.py (the script that syncs SECURITY.md and pyproject.toml's author email against the pinned canonical org contact-metadata registry), and adds a negative-control test proving the gate fails closed when the generated region is dropped.

This is 1 of 4 independent repo-scoped PRs for AAASM-5756 (parent cross-repo ticket). The other three land the equivalent slice in agent-assembly, node-sdk, and .github. No cross-repo dependency — this PR is self-contained and mergeable on its own.

• --root matches the exact precedent already established by scripts/check_claim_vocabulary.py (parser.add_argument("--root", default=".", help="repository root") → root = Path(args.root).resolve()), adapted to this script's existing --check-only argparse shape (default None, falling back to the existing _repo_root() when omitted so the default in-place-sync/check behavior is unchanged).
• No change to the script's content-generation logic, the pinned registry values, or the registry commit pin (REGISTRY_SOURCE/CANONICAL).

Type of Change

• ✨ New feature
• ♻️ Refactoring (test-only addition below)

Breaking Changes

• No

Related Issues

• Related JIRA ticket: AAASM-5756

Testing

• Unit tests added/updated — test/unit/test_contact_metadata_negative_control.py, 6 cases, all using tmp_path fixture copies of the real SECURITY.md/pyproject.toml driven through the script's own main() via --root.

The negative control proves the AC#4 gate-failure property: the parent ticket requires that dropping the generated region unambiguously turns the gate red. Cases and their exit codes (read from the script's own sys.exit/return sites, not assumed):

Case	Exit code	Why
Clean copy (byte-identical to real SECURITY.md/pyproject.toml)	0	in sync
BEGIN GENERATED: security_contact sentinel removed	2	fail-closed ContactDriftError — region not found
Whole generated block deleted (both sentinels + body)	2	same fail-closed path
Legacy .dev domain swapped into the block's email	1	in-region value drift under --check
SLA day-count edited	1	same drift path
pyproject.toml author email duplicated to 2 entries	2	fail-closed exactly-one-match count guard

The generated-region-removed → non-zero exit case is the one AC#4 requires to unambiguously exist; it's labeled in the test docstrings.

Verification (all run locally)

$ .venv/bin/python scripts/check_contact_metadata.py --check
Contact metadata is in sync with the pinned registry.
$ echo $?
0

$ .venv/bin/python -m pytest test/unit/test_contact_metadata_negative_control.py -v --no-cov
6 passed in 0.03s

$ .venv/bin/ruff check .
All checks passed!

$ .venv/bin/ruff format --check scripts/check_contact_metadata.py test/unit/test_contact_metadata_negative_control.py
2 files already formatted

$ .venv/bin/mypy agent_assembly
# 5 pre-existing errors, all `agent_assembly._core` (native shim not built in
# this checkout) / grpc stubs — unrelated to this PR's changed files
# (scripts/, test/), unchanged by this diff.

Checklist

• Code follows project style guidelines
• Self-review completed
• Comments added for complex logic
• Documentation updated if needed (module docstring in the new test file explains the AC#4 mapping)
• All tests passing

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

LGTM — merging.

Independent review (fresh agent, read-only) verified: `--root` fully redirects every path the script touches (pyproject.toml + SECURITY.md, no fallback to `file` when set); all 6 negative-control test cases construct genuine tmp_path fixtures and assert against the script's real exit-code control flow (traced line-by-line, not trusted); the AC#4 "region entirely removed → gate fails" case is unambiguous; the pyproject duplicate-author "fail-closed count guard" claim is real (verified the regex/count logic); no live-tree mutation; ruff/mypy clean; CI already green. Verdict: ship as-is.

Merging via the AAASM-5858 owner-only admin-merge exception: verified fresh as org admin (`Chisanan232`); CI green, no conflicts, no unresolved defect, no REQUEST_CHANGES; the only blocker is same-identity REVIEW_REQUIRED. Merge method: Create a merge commit.