fix(agent99): reconcile live cold-start dispatches

apps/api/src/services/agent99_same_run_reconcile.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 
 import json
 import math
+import re
 import time
 import urllib.error
 import urllib.parse
@@ -82,16 +83,51 @@ _COLD_START_QUERIES = {
 }
 
 
-def is_cold_start_same_run_identity(identity: Agent99DispatchIdentity) -> bool:
-    """Limit this transport to the existing cold-start Recover identity."""
+def is_cold_start_same_run_identity(
+    identity: Agent99DispatchIdentity,
+    receipt: dict[str, Any] | None = None,
+) -> bool:
+    """Admit only a canonical cold-start Recover dispatch to no-write Status."""
 
-    return bool(
+    legacy_identity = bool(
         identity.route_id == AGENT99_COLD_START_ROUTE_ID
         and identity.incident_id == AGENT99_COLD_START_INCIDENT_ID
         and str(identity.run_id) == AGENT99_COLD_START_RUN_ID
         and identity.source_fingerprint.startswith("legacy-cold-start:")
         and identity.execution_generation == "1"
     )
+    if legacy_identity:
+        return True
+
+    scope = (
+        receipt.get("dispatch_scope")
+        if isinstance(receipt, dict)
+        and isinstance(receipt.get("dispatch_scope"), dict)
+        else {}
+    )
+    try:
+        generation = int(identity.execution_generation)
+    except ValueError:
+        return False
+    expected_work_item_id = (
+        f"agent99-dispatch:awoooi:{identity.incident_id}:"
+        f"{AGENT99_COLD_START_ROUTE_ID}"
+    )
+    return bool(
+        identity.project_id == "awoooi"
+        and identity.route_id == AGENT99_COLD_START_ROUTE_ID
+        and re.fullmatch(r"INC-[0-9]{8}-[0-9A-F]{6}", identity.incident_id)
+        is not None
+        and identity.work_item_id == expected_work_item_id
+        and re.fullmatch(r"[0-9a-f]{32,64}", identity.source_fingerprint)
+        is not None
+        and 1 <= generation <= 3
+        and scope.get("schema_version") == "agent99_dispatch_scope_v1"
+        and scope.get("kind") == "host_recovery"
+        and scope.get("suggested_mode") == "Recover"
+        and scope.get("target_resource") == "cold-start-gate"
+        and scope.get("controlled_apply_requested") is True
+    )
 
 
 def agent99_same_run_evidence_id(identity: Agent99DispatchIdentity) -> str:
@@ -235,6 +271,7 @@ def read_cold_start_source_resolution(
 def request_agent99_same_run_status_reconcile(
     identity: Agent99DispatchIdentity,
     source_receipt: dict[str, Any],
+    dispatch_receipt: dict[str, Any] | None = None,
     *,
     relay_url: str | None = None,
     relay_token: str | None = None,
@@ -242,7 +279,7 @@ def request_agent99_same_run_status_reconcile(
 ) -> dict[str, Any]:
     """Ask Agent99 for one idempotent, no-write Status on the existing run."""
 
-    if not is_cold_start_same_run_identity(identity):
+    if not is_cold_start_same_run_identity(identity, dispatch_receipt):
         return {
             "status": "identity_not_eligible_fail_closed",
             "accepted": False,