fix(sre): verify DR scorecard RAG writeback

apps/api/src/jobs/agent99_controlled_dispatch_reconciler_job.py

@@ -31,6 +31,8 @@ from src.services.agent99_controlled_dispatch_ledger import (
     validate_agent99_outcome_identity,
 )
 from src.services.agent99_public_receipts import (
+    AGENT99_BACKUP_REQUIRED_VERIFIER_EVIDENCE_REFS,
+    AGENT99_REQUIRED_VERIFIER_EVIDENCE_REFS,
     extract_agent99_outcome_evidence_refs,
     sanitize_agent99_public_receipt_refs,
 )
@@ -749,8 +751,19 @@ async def _ensure_dr_scorecard(
 ) -> str | None:
     if "backup_health" not in identity.route_id:
         return "not_required"
+    required_refs = (
+        AGENT99_REQUIRED_VERIFIER_EVIDENCE_REFS
+        | AGENT99_BACKUP_REQUIRED_VERIFIER_EVIDENCE_REFS
+    )
+    safe_refs = sanitize_agent99_public_receipt_refs(
+        evidence_refs,
+        allowed_keys=required_refs,
+    )
+    if not required_refs.issubset(safe_refs):
+        return None
     try:
-        entry = await get_knowledge_service().create_entry(
+        knowledge = get_knowledge_service()
+        entry = await knowledge.create_entry(
             KnowledgeEntryCreate(
                 title=f"DR scorecard {identity.incident_id}",
                 content=(
@@ -758,7 +771,7 @@ async def _ensure_dr_scorecard(
                     "restore-drill, and source-resolution receipts. "
                     + "; ".join(
                         f"{key}={value}"
-                        for key, value in sorted(evidence_refs.items())
+                        for key, value in sorted(safe_refs.items())
                     )
                 ),
                 entry_type=EntryType.BEST_PRACTICE,
@@ -777,8 +790,17 @@ async def _ensure_dr_scorecard(
                 created_by="agent99_controlled_dispatch_reconciler",
             ),
             project_id=identity.project_id,
+            schedule_embedding=False,
         )
-        return f"knowledge_entries:{entry.id}:dr_scorecard"
+        embedded = await knowledge.ensure_entry_embedding(
+            entry.id,
+            entry.title,
+            entry.content,
+            project_id=identity.project_id,
+        )
+        if not embedded:
+            return None
+        return f"knowledge_entries:{entry.id}:dr_scorecard_embedding_verified"
     except Exception as exc:
         logger.warning(
             "agent99_dr_scorecard_writeback_failed",