From 43ab0d8b7c2024a466e6a3139f89bfaaa8c0e7e0 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 17 Jul 2026 09:16:52 +0800 Subject: [PATCH] fix(agent99): validate selfcheck control source --- agent99-contract-check.ps1 | 2 +- .../test_agent99_alert_dispatch_order_contract.py | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/agent99-contract-check.ps1 b/agent99-contract-check.ps1 index 9e7c80fd5..f68919a01 100644 --- a/agent99-contract-check.ps1 +++ b/agent99-contract-check.ps1 @@ -142,7 +142,7 @@ Add-Check "transport:jump_first" ($control.Contains("preferJumpHost") -and $cont Add-Check "transport:stale_process_guard" ($control.Contains("Invoke-AgentStaleSshProcessGuard") -and $control.Contains("taskkill.exe /PID") -and $control.Contains("ssh_stale_process_guard")) "timed-out and stale SSH clients are bounded" Add-Check "transport:cross_process_serialization" ($control.Contains("Enter-AgentSshTransportLock") -and $control.Contains("[IO.FileShare]::None") -and $control.Contains("ssh_transport_lock_failed")) "cross-process SSH sessions are serialized" Add-Check "windows99:input_independent_control" ($windowsControlBaseline.Contains('$FallbackInputTip = "0409:00000409"') -and $windowsControlBaseline.Contains('$PreservedChineseLanguage = "zh-Hant-TW"') -and $windowsControlBaseline.Contains('encodedCommandCompatible = $true') -and $windowsControlBaseline.Contains('inputMethodIndependent = $true') -and $windowsControlBaseline.Contains('Invoke-IndependentSnapshot') -and $windowsControlBaseline.Contains('Restore-WindowsControlBaseline') -and $windowsControlBaseline.Contains('$Mode -eq "Check" -and $runtimeVerified')) "Windows99 keeps Traditional Chinese/Bopomofo while enforcing a US-keyboard and UTF-8 fallback with an independent verifier, fail-closed drift detection, and rollback" -Add-Check "windows99:selfcheck_control_baseline" ($controlPlane.Contains('function Test-AgentWindowsControlBaseline') -and $controlPlane.Contains('$windowsControlBaseline = Test-AgentWindowsControlBaseline $runtimeManifest') -and $controlPlane.Contains('windows_control_baseline_verified_no_write') -and $controlPlane.Contains('windowsControlBaseline = $windowsControlBaseline')) "Agent99 SelfCheck continuously verifies the Windows99 keyboard, UTF-8 console, and SSH control baseline without applying writes" +Add-Check "windows99:selfcheck_control_baseline" ($control.Contains('function Test-AgentWindowsControlBaseline') -and $control.Contains('$windowsControlBaseline = Test-AgentWindowsControlBaseline $runtimeManifest') -and $control.Contains('windows_control_baseline_verified_no_write') -and $control.Contains('windowsControlBaseline = $windowsControlBaseline')) "Agent99 SelfCheck continuously verifies the Windows99 keyboard, UTF-8 console, and SSH control baseline without applying writes" $dbExecutorIdentityContract = [bool]( $dbBoundedExecutor.Contains('$CommandId = "telegram_receipt_index_v2_apply_v1"') -and $dbBoundedExecutor.Contains('$CanonicalAsset = "public.awooop_outbound_message"') -and diff --git a/apps/api/tests/test_agent99_alert_dispatch_order_contract.py b/apps/api/tests/test_agent99_alert_dispatch_order_contract.py index 6d1916e87..fe06ab387 100644 --- a/apps/api/tests/test_agent99_alert_dispatch_order_contract.py +++ b/apps/api/tests/test_agent99_alert_dispatch_order_contract.py @@ -253,6 +253,18 @@ def test_windows99_control_baseline_check_fails_closed_on_desired_state_drift() assert '$Mode -eq "Check" -and $runtimeVerified' in source[source.index("$passed =") :] +def test_windows99_contract_check_reads_selfcheck_from_defined_control_source() -> None: + source = (ROOT / "agent99-contract-check.ps1").read_text(encoding="utf-8") + contract = source[ + source.index('Add-Check "windows99:selfcheck_control_baseline"') : source.index( + "$dbExecutorIdentityContract" + ) + ] + + assert "$control.Contains" in contract + assert "$controlPlane.Contains" not in contract + + def test_agent99_typed_guard_rejects_before_dedupe_or_queue_write() -> None: source = SRE_INBOX.read_text(encoding="utf-8") processing = source[source.index("foreach ($file in $files)") :]