Phase1 skeleton: replace demo main.py with src.server contract

- Overlay ModelHub XC Phase1 (health/status, STRATEGY_ID gate, dry-run)
- Dockerfile CMD -> python -m src.server; FROM stays platform TCR base
- Remove demo main.py and requirements.txt (stdlib only)
- Add tests/, scripts/, docs/, Makefile, config/examples (no secrets)

tests/test_gate.py

@@ -0,0 +1,138 @@
+"""Gate defaults to dry-run / blocked; live only with dual confirm + STRATEGY_ID."""
+
+from __future__ import annotations
+
+import os
+import unittest
+from unittest import mock
+
+from src.gate import LIVE_CONFIRM_VALUE, attempt_live_submit, evaluate_gate
+
+
+class FakeClient:
+    def __init__(self) -> None:
+        self.calls = []
+
+    def submit(self, payload):
+        self.calls.append(payload)
+        return {"task_id": "fake-1"}
+
+
+class TestGate(unittest.TestCase):
+    def _clear_gate_env(self):
+        return mock.patch.dict(
+            os.environ,
+            {
+                "STRATEGY_ID": "sid-1",
+                "ALLOW_LIVE_SUBMIT": "0",
+                "LIVE_CONFIRM": "",
+            },
+            clear=False,
+        )
+
+    def test_default_dry_run(self) -> None:
+        with self._clear_gate_env():
+            d = evaluate_gate()
+        self.assertFalse(d.allowed)
+        self.assertEqual(d.mode, "dry-run")
+
+    def test_missing_strategy_blocked(self) -> None:
+        env = {
+            "ALLOW_LIVE_SUBMIT": "1",
+            "LIVE_CONFIRM": LIVE_CONFIRM_VALUE,
+        }
+        # Remove STRATEGY_ID
+        base = {k: v for k, v in os.environ.items() if k != "STRATEGY_ID"}
+        base.update(env)
+        with mock.patch.dict(os.environ, base, clear=True):
+            d = evaluate_gate()
+        self.assertFalse(d.allowed)
+        self.assertEqual(d.mode, "blocked")
+
+    def test_allow_without_confirm_blocked(self) -> None:
+        with mock.patch.dict(
+            os.environ,
+            {
+                "STRATEGY_ID": "sid-1",
+                "ALLOW_LIVE_SUBMIT": "1",
+                "LIVE_CONFIRM": "YES",
+            },
+            clear=False,
+        ):
+            d = evaluate_gate()
+        self.assertFalse(d.allowed)
+        self.assertEqual(d.mode, "blocked")
+
+    def test_dual_gate_opens(self) -> None:
+        with mock.patch.dict(
+            os.environ,
+            {
+                "STRATEGY_ID": "sid-1",
+                "ALLOW_LIVE_SUBMIT": "1",
+                "LIVE_CONFIRM": LIVE_CONFIRM_VALUE,
+            },
+            clear=False,
+        ):
+            d = evaluate_gate()
+        self.assertTrue(d.allowed)
+        self.assertEqual(d.mode, "live")
+
+    def test_open_gate_without_client_still_blocked(self) -> None:
+        """Phase1: no real HTTP client even when gate is open."""
+        with mock.patch.dict(
+            os.environ,
+            {
+                "STRATEGY_ID": "sid-1",
+                "ALLOW_LIVE_SUBMIT": "1",
+                "LIVE_CONFIRM": LIVE_CONFIRM_VALUE,
+            },
+            clear=False,
+        ):
+            result = attempt_live_submit({"modelAddress": "x/y"})
+        self.assertFalse(result["submitted"])
+        self.assertIn("no real", result["reason"].lower())
+        self.assertEqual(result["mode"], "blocked")
+        self.assertFalse(result["ok"])
+
+    def test_prd_example_and_whitespace_id_never_submit(self) -> None:
+        cases = [
+            {"ALLOW_LIVE_SUBMIT": "true", "LIVE_CONFIRM": LIVE_CONFIRM_VALUE},
+            {"ALLOW_LIVE_SUBMIT": "1", "LIVE_CONFIRM": "", "CONFIRM_LIVE": "YES"},
+            {"ALLOW_LIVE_SUBMIT": "1", "LIVE_CONFIRM": LIVE_CONFIRM_VALUE, "STRATEGY_ID": "   "},
+        ]
+        for overrides in cases:
+            with self.subTest(overrides=overrides):
+                client = FakeClient()
+                env = {"STRATEGY_ID": "sid-test", **overrides}
+                with mock.patch.dict(os.environ, env, clear=True):
+                    result = attempt_live_submit({}, client=client)
+                self.assertFalse(result["submitted"])
+                self.assertFalse(result["ok"])
+                self.assertEqual(client.calls, [])
+                self.assertTrue(result["reason"])
+
+    def test_injected_fake_client(self) -> None:
+        client = FakeClient()
+        with mock.patch.dict(
+            os.environ,
+            {
+                "STRATEGY_ID": "sid-1",
+                "ALLOW_LIVE_SUBMIT": "1",
+                "LIVE_CONFIRM": LIVE_CONFIRM_VALUE,
+            },
+            clear=False,
+        ):
+            result = attempt_live_submit({"modelAddress": "x/y"}, client=client)
+        self.assertTrue(result["submitted"])
+        self.assertEqual(len(client.calls), 1)
+
+    def test_default_attempt_rejects(self) -> None:
+        client = FakeClient()
+        with self._clear_gate_env():
+            result = attempt_live_submit({"modelAddress": "x/y"}, client=client)
+        self.assertFalse(result["submitted"])
+        self.assertEqual(len(client.calls), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()