fix(reboot): surface windows99 locator identity evidence

apps/api/tests/test_awoooi_priority_work_order_readback_api.py

@@ -2,9 +2,12 @@ from __future__ import annotations
 
 import asyncio
 import json
+import os
 import urllib.error
 from pathlib import Path
 
+os.environ.setdefault("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/test")
+
 import pytest
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
@@ -813,7 +816,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         is False
     )
     assert state["windows99_vmx_source_locator_status"] == (
-        "collector_readback_no_scoped_relink_candidate"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert state["windows99_vmx_source_locator_required"] is True
     assert state["windows99_vmx_source_locator_check_mode_ready"] is True
@@ -827,19 +830,19 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
     )
     assert state["windows99_vmx_source_locator_target_aliases"] == ["111"]
     assert state["windows99_vmx_source_locator_next_executable_step"] == (
-        "provide_existing_vmx_source_or_backup_path"
+        "provide_verified_vmx_source_or_identity_evidence_then_scoped_relink_dry_run"
     )
     assert state["windows99_vmx_source_locator_expected_vmx_path_count"] == 1
-    assert state["windows99_vmx_source_locator_candidate_source_count"] == 0
+    assert state["windows99_vmx_source_locator_candidate_source_count"] == 8
     assert state["windows99_vmx_source_locator_alias_hint_candidate_count"] == 0
-    assert state["windows99_vmx_source_locator_unassigned_ubuntu_candidate_count"] == 0
+    assert state["windows99_vmx_source_locator_unassigned_ubuntu_candidate_count"] == 5
     assert (
         state[
             "windows99_vmx_source_locator_identity_unassigned_ubuntu_candidate_count"
         ]
-        == 0
+        == 1
     )
-    assert state["windows99_vmx_source_locator_candidate_confirmation_required"] is False
+    assert state["windows99_vmx_source_locator_candidate_confirmation_required"] is True
     assert (
         state[
             "windows99_vmx_source_locator_human_confirmation_required_for_dry_run"
@@ -850,7 +853,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         state[
             "windows99_vmx_source_locator_verified_source_or_identity_evidence_required"
         ]
-        is False
+        is True
     )
     assert (
         state["windows99_vmx_source_locator_controlled_relink_dry_run_ready"]
@@ -858,12 +861,12 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
     )
     assert state[
         "windows99_vmx_source_locator_controlled_relink_dry_run_blocker"
-    ] == "scoped_relink_candidate_not_verified"
+    ] == "verified_vmx_source_or_identity_evidence_missing"
     assert state["windows99_vmx_source_locator_relink_dry_run_plan_id"] == (
         "windows99-vmx-source-relink-dry-run-111"
     )
     assert state["windows99_vmx_source_locator_candidate_confirmation_status"] == (
-        "blocked_no_candidate_source_found"
+        "blocked_single_unassigned_ubuntu_candidate_identity_not_confirmed"
     )
     assert state["windows99_vmx_source_locator_candidate_identity_decision"] == (
         "blocked"
@@ -877,7 +880,12 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
     assert state["windows99_vmx_source_locator_candidate_relink_dry_run_ready"] is False
     assert state[
         "windows99_vmx_source_locator_candidate_confirmation_missing_evidence"
-    ] == ["existing_vmx_source_or_verified_backup_path"]
+    ] == [
+        "target_alias_identity_hint",
+        "verified_backup_or_authorized_console_candidate_identity",
+        "pre_apply_backup_plan",
+        "scoped_relink_dry_run",
+    ]
     assert (
         state[
             "windows99_vmx_source_locator_apply_allowed_by_candidate_confirmation_gate"
@@ -886,7 +894,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
     )
     assert state["windows99_vmx_source_locator_candidate_source_count_known"] is True
     assert state["windows99_vmx_source_locator_collector_readback_present"] is True
-    assert state["windows99_vmx_source_locator_file_content_read"] is False
+    assert state["windows99_vmx_source_locator_file_content_read"] is True
     assert state["windows99_vmx_source_locator_remote_write_performed"] is False
     assert state["windows99_vmx_source_locator_vm_power_change_performed"] is False
     assert state["windows99_vmx_source_backup_search_package_status"] == (
@@ -1014,28 +1022,28 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         "111"
     ]
     assert payload["summary"]["windows99_vmx_source_locator_status"] == (
-        "collector_readback_no_scoped_relink_candidate"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert payload["summary"]["windows99_vmx_source_locator_check_mode_ready"] is True
     assert payload["summary"]["windows99_vmx_source_locator_target_aliases"] == [
         "111"
     ]
-    assert payload["summary"]["windows99_vmx_source_locator_candidate_source_count"] == 0
+    assert payload["summary"]["windows99_vmx_source_locator_candidate_source_count"] == 8
     assert (
         payload["summary"][
             "windows99_vmx_source_locator_identity_unassigned_ubuntu_candidate_count"
         ]
-        == 0
+        == 1
     )
     assert (
         payload["summary"][
             "windows99_vmx_source_locator_candidate_confirmation_required"
         ]
-        is False
+        is True
     )
     assert payload["summary"][
         "windows99_vmx_source_locator_candidate_confirmation_status"
-    ] == "blocked_no_candidate_source_found"
+    ] == "blocked_single_unassigned_ubuntu_candidate_identity_not_confirmed"
     assert payload["summary"][
         "windows99_vmx_source_locator_candidate_identity_decision"
     ] == "blocked"
@@ -1067,7 +1075,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         payload["summary"][
             "windows99_vmx_source_locator_verified_source_or_identity_evidence_required"
         ]
-        is False
+        is True
     )
     assert (
         payload["rollups"][
@@ -1077,14 +1085,14 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
     )
     assert payload["rollups"][
         "windows99_vmx_source_locator_controlled_relink_dry_run_blocker"
-    ] == "scoped_relink_candidate_not_verified"
+    ] == "verified_vmx_source_or_identity_evidence_missing"
     assert (
         payload["rollups"]["windows99_vmx_source_locator_remote_write_performed"]
         is False
     )
     assert (
         payload["rollups"]["windows99_vmx_source_locator_file_content_read"]
-        is False
+        is True
     )
     assert payload["summary"]["windows99_vmx_source_backup_search_status"] == (
         "blocked_windows99_vmx_backup_source_not_found_some_hosts_unsearched"
@@ -1141,7 +1149,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         "windows99_vmx_source_repair_playbook_trust_writeback_ref"
     ].startswith("playbook://awoooi/windows99-vmx-source-repair/")
     assert in_progress["evidence"]["windows99_vmx_source_locator_status"] == (
-        "collector_readback_no_scoped_relink_candidate"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert (
         in_progress["evidence"]["windows99_vmx_source_locator_check_mode_ready"]
@@ -1153,17 +1161,17 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
     )
     assert (
         in_progress["evidence"]["windows99_vmx_source_locator_candidate_source_count"]
-        == 0
+        == 8
     )
     assert (
         in_progress["evidence"][
             "windows99_vmx_source_locator_candidate_confirmation_required"
         ]
-        is False
+        is True
     )
     assert in_progress["evidence"][
         "windows99_vmx_source_locator_candidate_confirmation_status"
-    ] == "blocked_no_candidate_source_found"
+    ] == "blocked_single_unassigned_ubuntu_candidate_identity_not_confirmed"
     assert (
         in_progress["evidence"][
             "windows99_vmx_source_locator_candidate_relink_dry_run_ready"
@@ -1186,7 +1194,7 @@ def test_awoooi_priority_work_order_readback_routes_closed_backup_to_host_boot_a
         in_progress["evidence"][
             "windows99_vmx_source_locator_verified_source_or_identity_evidence_required"
         ]
-        is False
+        is True
     )
     assert (
         in_progress["evidence"][

apps/api/tests/test_windows99_vmx_source_locator_readback_api.py

@@ -1,5 +1,9 @@
 from __future__ import annotations
 
+import os
+
+os.environ.setdefault("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/test")
+
 import pytest
 from fastapi import FastAPI
 from fastapi.testclient import TestClient
@@ -219,33 +223,38 @@ def test_windows99_vmx_source_locator_endpoint_returns_public_safe_readback(
     payload = response.json()
     assert payload["schema_version"] == "windows99_vmx_source_locator_readback_v1"
     assert payload["status"] == (
-        "collector_readback_no_scoped_relink_candidate"
+        "collector_readback_verified_source_required_before_relink_dry_run"
     )
     assert payload["target_vm_aliases"] == ["111"]
     assert payload["locator_check_mode_ready"] is True
     assert payload["effective_locator_collect_ready"] is False
     assert payload["locator_collect_blocker"] == "ssh_batch_permission_denied"
     assert payload["collector_readback_present"] is True
-    assert payload["candidate_source_count"] == 0
-    assert payload["candidate_confirmation_required"] is False
+    assert payload["candidate_source_count"] == 8
+    assert payload["unassigned_ubuntu_candidate_count"] == 5
+    assert payload["identity_metadata_read"] is True
+    assert payload["identity_unassigned_ubuntu_candidate_count"] == 1
+    assert payload["candidate_confirmation_required"] is True
     assert payload["human_confirmation_required_for_dry_run"] is False
-    assert payload["verified_source_or_identity_evidence_required"] is False
+    assert payload["verified_source_or_identity_evidence_required"] is True
     assert payload["controlled_relink_dry_run_ready"] is False
     assert payload["controlled_relink_dry_run_blocker"] == (
-        "scoped_relink_candidate_not_verified"
+        "verified_vmx_source_or_identity_evidence_missing"
     )
     assert payload["controlled_relink_dry_run_plan"]["plan_id"] == (
         "windows99-vmx-source-relink-dry-run-111"
     )
     assert payload["controlled_relink_dry_run_plan"]["remote_write_performed"] is False
-    assert payload["candidate_confirmation_status"] == "blocked_no_candidate_source_found"
+    assert payload["candidate_confirmation_status"] == (
+        "blocked_single_unassigned_ubuntu_candidate_identity_not_confirmed"
+    )
     assert payload["candidate_identity_evidence_sufficient"] is False
     assert payload["candidate_relink_dry_run_ready"] is False
     assert payload["apply_allowed_by_candidate_confirmation_gate"] is False
     assert payload["public_lan_topology_redacted"] is True
     assert payload["raw_path_output"] is False
-    assert payload["file_content_read"] is False
-    assert payload["bounded_identity_metadata_only"] is False
+    assert payload["file_content_read"] is True
+    assert payload["bounded_identity_metadata_only"] is True
     assert payload["remote_write_performed"] is False
     assert payload["vm_power_change_performed"] is False
     assert "192.168.0." not in response.text

docs/operations/windows99-vmx-source-locator-receipt.snapshot.json

@@ -1,30 +1,30 @@
 {
   "schema_version": "windows99_vmx_source_locator_receipt_v1",
-  "generated_at": "2026-07-03T17:57:16+08:00",
-  "receipt_ref": "log://awoooi/p0-006/windows99-vmx-source-locator-111-20260703-1757",
-  "source": "live_via_110_no_secret_check_mode",
+  "generated_at": "2026-07-09T18:47:44+08:00",
+  "receipt_ref": "log://awoooi/p0-006/windows99-vmx-source-locator-111-20260709-1847",
+  "source": "live_windows99_no_secret_bounded_identity_check_mode",
   "collector_schema_version": "windows99_vmx_source_locator_collector_v1",
   "collector_readback_present": true,
   "collector_collection_status": "collected_windows99_vmx_source_locator_stdout",
   "target_host_alias": "99",
-  "via_host_alias": "110",
+  "via_host_alias": "none",
   "target_vm_aliases": ["111"],
   "expected_vmx_path_count": 1,
   "expected_vmx_path_present_count": 0,
   "discovery_root_count": 6,
   "discovery_root_present_count": 2,
-  "candidate_source_count": 0,
+  "candidate_source_count": 8,
   "candidate_source_count_known": true,
   "candidate_source_fingerprint_count": 0,
   "alias_hint_candidate_count": 0,
-  "unassigned_ubuntu_candidate_count": 0,
-  "identity_metadata_read": false,
-  "bounded_identity_metadata_only": false,
+  "unassigned_ubuntu_candidate_count": 5,
+  "identity_metadata_read": true,
+  "bounded_identity_metadata_only": true,
   "identity_target_hint_count": 0,
-  "identity_unassigned_ubuntu_candidate_count": 0,
-  "locate_status": "blocked_missing_expected_vmx_source_no_candidate_found",
-  "safe_next_step": "provide_existing_vmx_source_or_backup_path_then_rerun_locator_check_mode_no_write",
-  "candidate_confirmation_required": false,
+  "identity_unassigned_ubuntu_candidate_count": 1,
+  "locate_status": "single_identity_unassigned_ubuntu_candidate_requires_confirmation",
+  "safe_next_step": "confirm_single_unassigned_ubuntu_candidate_is_target_alias_before_scoped_relink_dry_run",
+  "candidate_confirmation_required": true,
   "controlled_relink_dry_run_ready": false,
   "apply_allowed_by_this_receipt": false,
   "public_lan_topology_redacted": true,