Merge remote-tracking branch 'origin/main' into codex/p0-obs-001-20260714

scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh

@@ -426,7 +426,11 @@ if(Test-Path -LiteralPath $p -PathType Leaf){try{$m=Get-Content -LiteralPath $p
 $c=[ordered]@{executed=$false;ok=$false;exitCode=-1;errorType=''}
 try{& powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File (Join-Path $b 'agent99-contract-check.ps1') -SourceRoot $b 2>$null|Out-Null;$c.executed=$true;$c.exitCode=$LASTEXITCODE;$c.ok=[bool]($c.exitCode-eq 0)}catch{$c.executed=$true;$c.errorType=$_.Exception.GetType().Name}
 $z=[ordered]@{};foreach($n in 'remoteWritePerformed,liveRuntimeWritePerformed,livePromotionAttempted,livePromotionPerformed,secretValueRead,privateKeyValueRead,tokenValueRead,environmentSecretRead,uiInteraction,vmPowerChange,hostReboot,serviceRestart,scheduledTaskRestart,scheduledTaskModification'.Split(',')){$z[$n]=$false}
-[ordered]@{schemaVersion='agent99_remote_atomic_deploy_receipt_v1';status='check_ready';mode='check';sourceRevision='__SOURCE_REVISION__';expectedRuntimeFileCount=14;manifestSha256='__MANIFEST_SHA256__';plannedStagingPath='C:\Wooo\Agent99\deploy\remote-source-__STAGE_TOKEN__';runtimeManifest=[pscustomobject]$r;runtimeContract=[pscustomobject]$c;livePreflight=[ordered]@{executed=$false;reason='apply_only_after_validate_only'};transportPayloadMode='control_command_no_stdin';transientTransportPayloadStored=$false;transientTransportPayloadDeletedBeforeReceiver=$false;transportPayloadContainsSecrets=$false;operationBoundaries=$z;nextSafeAction='rerun_with_apply_and_trace_run_work_item_after_source_commit_and_transport_check'}|ConvertTo-Json -Compress -Depth 8'''
+$ready=[bool]($c.executed-and$c.ok-and$c.exitCode-eq 0)
+$status=if($ready){'check_ready'}else{'check_failed_no_apply'}
+$next=if($ready){'rerun_with_apply_and_trace_run_work_item_after_source_commit_and_transport_check'}else{'repair_runtime_contract_before_apply'}
+[ordered]@{schemaVersion='agent99_remote_atomic_deploy_receipt_v1';status=$status;mode='check';sourceRevision='__SOURCE_REVISION__';expectedRuntimeFileCount=14;manifestSha256='__MANIFEST_SHA256__';plannedStagingPath='C:\Wooo\Agent99\deploy\remote-source-__STAGE_TOKEN__';runtimeManifest=[pscustomobject]$r;runtimeContract=[pscustomobject]$c;livePreflight=[ordered]@{executed=$false;reason='apply_only_after_validate_only'};transportPayloadMode='control_command_no_stdin';transientTransportPayloadStored=$false;transientTransportPayloadDeletedBeforeReceiver=$false;transportPayloadContainsSecrets=$false;operationBoundaries=$z;nextSafeAction=$next}|ConvertTo-Json -Compress -Depth 8
+if(-not$ready){exit 65}'''
 script = (
     script.replace("__SOURCE_REVISION__", source_revision)
     .replace("__MANIFEST_SHA256__", manifest_sha256)

scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py

@@ -671,6 +671,9 @@ def test_check_mode_uses_bounded_control_command_without_ssh_stdin(
     assert "agent99-contract-check.ps1" in check_script
     assert "Get-FileHash" in check_script
     assert "runtimeContract" in check_script
+    assert "$ready=[bool]($c.executed-and$c.ok-and$c.exitCode-eq 0)" in check_script
+    assert "'check_failed_no_apply'" in check_script
+    assert "if(-not$ready){exit 65}" in check_script
     assert check_script.count("ProgressPreference") == 1
     assert "remoteWritePerformed" in check_script
     assert "$z[$n]=$false" in check_script

scripts/security/tests/test_runtime_image_mirror_controller.py

@@ -47,7 +47,7 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
 
         self.assertEqual(policy.work_item_id, "AIA-P0-006-02A")
         self.assertEqual(policy.risk_level, "high")
-        self.assertEqual(len(policy.images), 5)
+        self.assertEqual(len(policy.images), 6)
         self.assertNotIn("github.com", raw)
         self.assertNotIn("ghcr.io", raw)
         self.assertIn('"external_pull_allowed": false', raw)
@@ -71,9 +71,9 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
                 for image in policy.images
             )
         )
-        self.assertTrue(
-            all(image.workload.container_kind == "container" for image in policy.images)
-        )
+        container_kinds = [image.workload.container_kind for image in policy.images]
+        self.assertEqual(container_kinds.count("container"), 5)
+        self.assertEqual(container_kinds.count("init_container"), 1)
 
     def test_policy_loads_and_validates_init_container_kind(self) -> None:
         image = self._image_with_container_kind("init_container")
@@ -103,6 +103,27 @@ class RuntimeImageMirrorControllerTest(unittest.TestCase):
         self.assertNotIn("ghcr.io", raw)
         self.assertIn('"external_pull_allowed": false', raw)
 
+    def test_argocd_copyutil_canary_matches_verified_staging_contract(self) -> None:
+        policy = controller.load_policy(POLICY_PATH)
+        staging = controller.load_staging_policy(STAGING_POLICY_PATH).images[0]
+        canary = next(
+            image
+            for image in policy.images
+            if image.asset_id == "runtime-image:argocd-copyutil"
+        )
+
+        self.assertEqual(canary.source_index_digest, staging.source_index_digest)
+        self.assertEqual(canary.platform_digest, staging.platform_digest)
+        self.assertEqual(canary.push_ref, staging.push_ref)
+        self.assertEqual(canary.workload, staging.workload)
+        self.assertEqual(
+            canary.target_registry_digest,
+            "sha256:8b7e25d7e6036d6750c5bda8920cbd80d8902c25771666f6767dc97bd7fab8fc",
+        )
+        self.assertTrue(
+            canary.runtime_ref.endswith("@" + canary.target_registry_digest)
+        )
+
     def test_policy_rejects_external_pull_and_mutable_runtime_ref(self) -> None:
         payload = json.loads(POLICY_PATH.read_text(encoding="utf-8"))
         with tempfile.TemporaryDirectory() as temp: