From 18ba20acb855d3373106fc10150b9b52d1a32c6c Mon Sep 17 00:00:00 2001 From: Your Name Date: Sat, 18 Jul 2026 22:03:21 +0800 Subject: [PATCH] fix(agent99): enforce runtime manifest count parity --- agent99-contract-check.ps1 | 3 ++- agent99-signoz-metadata-executor.ps1 | 3 ++- ...oz_metadata_executor_runtime_entrypoint.py | 3 ++- .../test_agent99_live_preflight_decision.py | 2 +- ...remote_atomic_deploy_transport_contract.py | 25 ++++++++++++++++--- 5 files changed, 29 insertions(+), 7 deletions(-) diff --git a/agent99-contract-check.ps1 b/agent99-contract-check.ps1 index baba7ae80..254075ae9 100644 --- a/agent99-contract-check.ps1 +++ b/agent99-contract-check.ps1 @@ -192,7 +192,8 @@ $signozMetadataExecutorContract = [bool]( $signozMetadataExecutor.Contains('agent99_active:') -and $signozMetadataExecutor.Contains('$RemoteResult.completed -ne $true') -and $signozMetadataExecutor.Contains('Get-Agent99RuntimeSourceBinding') -and - $signozMetadataExecutor.Contains('$result.fileCount -eq 18') -and + $signozMetadataExecutor.Contains('$ExpectedRuntimeFileCount = 19') -and + $signozMetadataExecutor.Contains('$result.fileCount -eq $ExpectedRuntimeFileCount') -and $signozMetadataExecutor.Contains('pass_export_verified_restore_pending') -and $signozMetadataExecutor.Contains('productionRuntimeMutationPerformed = $false') -and $signozMetadataExecutor.Contains('rawSqliteRead = $false') -and diff --git a/agent99-signoz-metadata-executor.ps1 b/agent99-signoz-metadata-executor.ps1 index 57d328b27..f8bb4da7e 100644 --- a/agent99-signoz-metadata-executor.ps1 +++ b/agent99-signoz-metadata-executor.ps1 @@ -21,6 +21,7 @@ $IdentityFile = Join-Path $AgentRoot "keys\agent99_ed25519" $EvidenceDir = Join-Path $AgentRoot "evidence" $RuntimeManifestPath = Join-Path $AgentRoot "state\runtime-manifest.json" $EntrypointPath = [string]$MyInvocation.MyCommand.Path +$ExpectedRuntimeFileCount = 19 $SafeIdPattern = "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" $BundleId = "bb6d78b67f506072b2e45e92bc1d415364e25852282a9b068900665c578df011" $ToolchainRoot = "/backup/toolchains/signoz-metadata/$BundleId" @@ -220,7 +221,7 @@ function Get-Agent99RuntimeSourceBinding { } $result.ok = [bool]( $result.runtimeMatched -and - $result.fileCount -eq 18 -and + $result.fileCount -eq $ExpectedRuntimeFileCount -and $result.mismatchCount -eq 0 -and $result.sourceRevision -eq $SourceRevision -and $result.entrypointTracked -and diff --git a/scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py b/scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py index 54e787232..1b028c7bf 100644 --- a/scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py +++ b/scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py @@ -26,7 +26,8 @@ def test_entrypoint_is_fixed_to_windows99_host110_and_p0_obs_002() -> None: assert "._+" not in source assert '$EvidenceRunId = if ($RunId -match $SafeIdPattern)' in source assert "Get-Agent99RuntimeSourceBinding" in source - assert "$result.fileCount -eq 18" in source + assert "$ExpectedRuntimeFileCount = 19" in source + assert "$result.fileCount -eq $ExpectedRuntimeFileCount" in source assert "$result.sourceRevision -eq $SourceRevision" in source assert "$result.entrypointHashMatched" in source assert '$CredentialFile = "/etc/awoooi/secrets/signoz-metadata-api-key"' in source diff --git a/scripts/reboot-recovery/tests/test_agent99_live_preflight_decision.py b/scripts/reboot-recovery/tests/test_agent99_live_preflight_decision.py index 5c6be47c7..618993d11 100644 --- a/scripts/reboot-recovery/tests/test_agent99_live_preflight_decision.py +++ b/scripts/reboot-recovery/tests/test_agent99_live_preflight_decision.py @@ -84,7 +84,7 @@ $parameters = @{{ AgentRootPresent = [bool]$case.agentRootPresent Manifest = $case.manifest ManifestCheckRequired = [bool]$case.manifestCheckRequired - ExpectedRuntimeFileCount = 18 + ExpectedRuntimeFileCount = 19 TaskFailureCount = [int]$case.taskFailureCount RelayListenerCount = [int]$case.relayListenerCount RequiredEvidenceStaleCount = [int]$case.requiredEvidenceStaleCount diff --git a/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py b/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py index d09be65f3..96b623914 100644 --- a/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py +++ b/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py @@ -18,6 +18,9 @@ RECEIVER = ( / "scripts/reboot-recovery/agent99-remote-atomic-deploy-receiver.ps1" ) DEPLOYER = ROOT / "agent99-deploy.ps1" +BOOTSTRAP = ROOT / "agent99-bootstrap.ps1" +SIGNOZ_EXECUTOR = ROOT / "agent99-signoz-metadata-executor.ps1" +CONTRACT_CHECK = ROOT / "agent99-contract-check.ps1" LIVE_PREFLIGHT = ROOT / "scripts/reboot-recovery/agent99-live-preflight.ps1" EXPECTED_RUNTIME_FILES = ( @@ -71,25 +74,41 @@ def test_sender_is_valid_shell_with_check_as_the_default() -> None: assert "timeout --signal=TERM --kill-after=10" in source -def test_sender_and_receiver_allow_exactly_the_deployer_runtime_bundle() -> None: +def test_runtime_manifest_producers_and_consumers_share_exact_bundle_count() -> None: sender = SENDER.read_text(encoding="utf-8") receiver = RECEIVER.read_text(encoding="utf-8") deployer = DEPLOYER.read_text(encoding="utf-8") + bootstrap = BOOTSTRAP.read_text(encoding="utf-8") + signoz_executor = SIGNOZ_EXECUTOR.read_text(encoding="utf-8") + contract_check = CONTRACT_CHECK.read_text(encoding="utf-8") live_preflight = LIVE_PREFLIGHT.read_text(encoding="utf-8") sender_files = _quoted_array(sender, "RUNTIME_FILES=(", ")") receiver_files = _quoted_array(receiver, "$FixedRuntimeFiles = @(", ")") deployer_files = _quoted_array(deployer, "$runtimeFiles = @(", ")") + bootstrap_files = _quoted_array(bootstrap, "$agentFiles = @(", ")") assert sender_files == EXPECTED_RUNTIME_FILES assert receiver_files == EXPECTED_RUNTIME_FILES assert deployer_files == EXPECTED_RUNTIME_FILES + assert bootstrap_files == EXPECTED_RUNTIME_FILES + expected_count = len(EXPECTED_RUNTIME_FILES) preflight_count = re.search( r"-ExpectedRuntimeFileCount\s+(\d+)", live_preflight ) assert preflight_count is not None - assert int(preflight_count.group(1)) == len(EXPECTED_RUNTIME_FILES) - assert "expectedRuntimeFileCount\": 19" in sender + signoz_count = re.search( + r"\$ExpectedRuntimeFileCount\s*=\s*(\d+)", signoz_executor + ) + assert signoz_count is not None + assert int(preflight_count.group(1)) == expected_count + assert int(signoz_count.group(1)) == expected_count + assert f'expectedRuntimeFileCount\": {expected_count}' in sender + assert f"[int]$envelope.expectedRuntimeFileCount -ne {expected_count}" in receiver + assert f"fileCount = {expected_count}" in receiver + assert "$result.fileCount -eq $ExpectedRuntimeFileCount" in signoz_executor + assert "$ExpectedRuntimeFileCount = 19" in contract_check + assert "$result.fileCount -eq $ExpectedRuntimeFileCount" in contract_check assert "$filesByName.Count -ne $FixedRuntimeFiles.Count" in receiver assert "required_runtime_file_missing" in receiver assert "duplicate_runtime_file" in receiver