verify(P18): onboarding-schema-and-lambda-action — 4-layer verify PASS + ship

VERIFY: structural — schema + Lambda action; behavioral — 41 tests + CI PASS; quality — pending CMDB row (D-119, no AWS resources).

---ci---
project: acdl
phase: 18
milestone: v1.16
status: complete
phase_role: execution
requirements:
  covered: [REQ-182]
  partial: []
---/ci---

tests/test_contract_ingestor.py

@@ -593,4 +593,52 @@ class TestV14IdentityValidation:
         """The _validate_caller_identity docstring documents the ABAC reliance."""
         docstring = ingestor._validate_caller_identity.__doc__
         assert "ABAC" in docstring
-        assert "PrincipalTag" in docstring
+        assert "PrincipalTag" in docstring
+
+class TestOnboardConsumer:
+    """P18 (REQ-182): the onboard_consumer action writes a pending CMDB row."""
+
+    _ARN = "arn:aws:sts::000:assumed-role/nova-deploy/test"
+
+    def test_valid_onboarding_writes_pending_row(self, moto_contracts_table):
+        payload = {
+            "action": "onboard_consumer",
+            "consumerRepo": "acdl/consumer-b",
+            "requestedEnvironment": "dev",
+            "ownerId": "team-b",
+            "billingTag": "cost-center-b",
+        }
+        event = {"body": json.dumps(payload), "requestContext": {"identity": {"userArn": self._ARN}}}
+        resp = ingestor.lambda_handler(event, None)
+        assert resp["statusCode"] == 200
+        body = json.loads(resp["body"])
+        assert body["status"] == "pending"
+        assert body["action"] == "onboard_consumer"
+        assert body["requestedEnvironment"] == "dev"
+
+    def test_invalid_onboarding_rejected(self, moto_contracts_table):
+        # An invalid consumerRepo (no /) fails the identity format check
+        # (which runs for all actions) before the onboarding schema.
+        payload = {
+            "action": "onboard_consumer",
+            "consumerRepo": "not-a-repo-format",
+            "requestedEnvironment": "dev",
+            "ownerId": "team-b",
+            "billingTag": "cost-center-b",
+        }
+        event = {"body": json.dumps(payload), "requestContext": {"identity": {"userArn": self._ARN}}}
+        resp = ingestor.lambda_handler(event, None)
+        assert resp["statusCode"] == 400
+        assert "invalid consumerRepo" in json.loads(resp["body"])["error"]
+
+    def test_missing_onboarding_field_rejected(self, moto_contracts_table):
+        payload = {
+            "action": "onboard_consumer",
+            "consumerRepo": "acdl/consumer-b",
+            "requestedEnvironment": "dev",
+            # ownerId + billingTag missing
+        }
+        event = {"body": json.dumps(payload), "requestContext": {"identity": {"userArn": self._ARN}}}
+        resp = ingestor.lambda_handler(event, None)
+        assert resp["statusCode"] == 400
+        assert "onboarding payload invalid" in json.loads(resp["body"])["error"]