feat(inventory): add Inventory endpoint family

[armando-rodriguez-cko]

Summary

Implements the new Inventory product added to the API on 2026-09-10: stock adjustments,
atomic multi-variant reservations (create/get/commit/release), stock levels (get/set), and
beta product knowledge (get/set/delete). All 10 endpoints require the OAuth scope
agentic:inventory, no secret/public key support, reusing this SDK's existing
AuthorizationType::OAUTH client pattern (already used by GooglePay).

Also verified the same swagger diff's PaymentSessionCaptureFlag/PaymentSessionCaptureOn
schema extraction: capture/capture_on are unchanged (Boolean/Time). Note:
PaymentInterfaces (pan_preference/provision_network_token) is not modeled in this SDK at
all, a pre-existing gap unrelated to this ticket, left out of scope.

Changes

• lib/checkout_sdk/inventory/inventory_client.rb — new client, all 10 methods
• lib/checkout_sdk/inventory/ — InventoryAdjustmentRequest, InventoryReservationItem,
  InventoryReservationRequest, InventorySetLevelsRequest, InventorySetProductRequest,
  InventoryMoney
• lib/checkout_sdk/checkout_api.rb / checkout_sdk.rb — wired the new client in
• spec/checkout_sdk/inventory/ — client and serialization specs, 694 examples passing

Responses stay untyped Hash and errors surface via CheckoutApiException, consistent with
every other domain in this SDK; this SDK has no per-domain typed error classes.

API Reference

• POST /inventory/adjustments
• POST /inventory/reservations
• GET /inventory/reservations/{id}
• POST /inventory/reservations/{id}/commit
• POST /inventory/reservations/{id}/release
• GET /inventory/{variant_id}
• PUT /inventory/{variant_id}
• GET /inventory/{variant_id}/product (Beta)
• PUT /inventory/{variant_id}/product (Beta)
• DELETE /inventory/{variant_id}/product (Beta)

Breaking changes

None. Purely additive.

README

No README changes needed.

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• exceeds_bounded_scope:753>250

Operational gates

• ✅ jira_ticket (INT-1698)
• ✅ independent_review

Files analysed: 15

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
exceeds_bounded_scope — 753>250	classifying	§2.1 M8	More than 250 non-test, non-doc, non-lockfile lines changed.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔵 Advisory review: Sound, but needs your judgement

This PR needs a human approval. The code itself reads as correct; whether it should land depends on context I don't have.

Purely additive new Inventory client wiring 10 endpoints; the code visible in the diff is structurally consistent with the existing SDK pattern, but the diff is truncated (several key pieces are missing) and a few design/verification questions warrant human review before approval.

For you to decide

• The diff is truncated — the body of set_inventory_product and delete_inventory_product, the tail of InventorySetProductRequest, and the AGENTIC_INVENTORY OAuth scope constant definition are all cut off, so correctness of those parts cannot be confirmed from what is shown.
• The client spec stubs credentials_mock.get_authorization to return the string 'oauth' and then asserts invoke_post is called with that literal; this does not verify that AuthorizationType::OAUTH is actually passed to the Client superclass initializer or that the real authorization chain would behave correctly under integration — it only validates the mock chain.
• The get_inventory_levels default-params branch sets params = { expand: 'product' } if expand_product and passes nil otherwise; the test correctly expects nil in the default case, but reviewers should confirm invoke_get in the actual ApiClient handles a nil params argument without raising (the diff does not show that caller).
• The OAuthScopes::AGENTIC_INVENTORY constant referenced in the client doc-comment is not visible in the diff — reviewer should verify it exists in the scopes file, otherwise the comment is misleading and the scope may not be enforced.
• The PR description claims '694 examples passing' but only ~5 new spec files covering inventory are visible; reviewer should confirm the CI run is actually green and those numbers are credible.
• The InventoryClient is initialised unconditionally in CheckoutApi#initialize regardless of whether OAuth credentials are configured; unlike a lazy accessor, any consumer using ApiSecretKey-only config will silently get a client that will fail at request time — reviewer should decide if this is acceptable given the SDK's existing pattern (e.g. GooglePayClient does the same).
• The API date in the PR description is '2026-09-10', which is in the future; reviewer should confirm this is not a typo and that the API endpoints are actually available/stable enough to ship an SDK client against.

⚠️ The diff was too large to read in full, so this review covers only part of the change.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud