fix(agent99): complete same-run status reconcile

apps/api/tests/test_agent99_same_run_reconcile.py

@@ -829,3 +829,73 @@ def test_windows_relay_and_control_plane_enforce_same_run_no_write_contract() ->
     assert "Get-AgentEvidenceAtPath $exactEvidencePath" in queue_branch
     assert "Send-AgentTelegram" not in queue_branch
     assert "Invoke-AgentCompletionCallback" not in queue_branch
+
+
+def test_windows_relay_allows_only_one_audited_failed_no_write_status_retry() -> None:
+    root = Path(__file__).resolve().parents[3]
+    relay = (root / "agent99-sre-alert-relay.ps1").read_text(encoding="utf-8")
+
+    field_helper = relay[relay.index("function Get-AgentField") :]
+    field_helper = field_helper[: field_helper.index("function Get-AgentEnvValue")]
+    assert "$Object -is [Collections.IDictionary]" in field_helper
+    assert "$Object.Contains($Name)" in field_helper
+    assert "return $Object[$Name]" in field_helper
+
+    retry_start = relay.index(
+        "function Test-AgentSameRunFailedNoWriteOutcomeRetryEligible"
+    )
+    retry_end = relay.index("function Start-AgentSameRunStatusReconcile")
+    retry_contract = relay[retry_start:retry_end]
+
+    assert '$SameRunRetryAuditDir = Join-Path $SameRunStateDir "retry-audit"' in relay
+    assert '"agent99_same_run_status_retry_v1"' in retry_contract
+    assert 'retryOrdinal = 1' in retry_contract
+    assert 'status = "retry_reserved"' in retry_contract
+    assert 'preservesFailedOutcome = $true' in retry_contract
+    assert 'runtimeWriteAuthorized = $false' in retry_contract
+    assert '[string](Get-AgentField $Result "mode" "") -eq "Status"' in retry_contract
+    assert '[string](Get-AgentField $outcome "state" "") -eq "failed"' in retry_contract
+    assert '-not [bool](Get-AgentField $Result "controlledApply" $true)' in retry_contract
+    assert '[bool](Get-AgentField $Result "reconcileOnly" $false)' in retry_contract
+    assert '-not [bool](Get-AgentField $Result "runtimeWritePerformed" $true)' in retry_contract
+    assert '[bool](Get-AgentField $Result "suppressTelegram" $false)' in retry_contract
+    assert '-not [bool](Get-AgentField $outcome "resolved" $true)' in retry_contract
+    assert '-not [bool](Get-AgentField $outcome "transportOk" $true)' in retry_contract
+    assert '-not [bool](Get-AgentField $outcome "verifierPassed" $true)' in retry_contract
+    assert '[bool](Get-AgentField $outcome "sourceEventResolved" $false)' in retry_contract
+    assert "Test-AgentPublicReceiptRef $SourceEvidence" in retry_contract
+    assert "Test-AgentPublicReceiptRef $previousSourceEvidence" in retry_contract
+    assert '$previousSourceEvidence.StartsWith("prometheus:cold-start:")' in retry_contract
+    assert "Test-AgentSameRunIdentityMatchesExisting $canonicalIdentity $Identity" in retry_contract
+    assert '"agent99_same_run_single_flight_lock_v1"' in retry_contract
+    assert '[IO.FileMode]::CreateNew' in retry_contract
+    assert 'failedOutcomeSha256 = $failedOutcomeSha256' in retry_contract
+    assert 'previousLockSha256 = $previousLockSha256' in retry_contract
+    assert 'Move-Item -LiteralPath $ProcessedPath -Destination $outcomeAuditPath' in retry_contract
+    assert 'Move-Item -LiteralPath $LockPath -Destination $lockAuditPath' in retry_contract
+    assert 'same_run_status_retry_already_consumed_fail_closed' in retry_contract
+    assert 'same_run_status_retry_archive_failed_fail_closed' in retry_contract
+    assert 'mode = "Recover"' not in retry_contract
+    assert 'controlledApply = $true' not in retry_contract
+
+    start = relay[relay.index("function Start-AgentSameRunStatusReconcile") :]
+    marker_branch = start.index(
+        "if (-not $singleRetryPrepared -and "
+        "(Test-Path -LiteralPath $retryMarkerPath -PathType Leaf))"
+    )
+    marker_rejected = start.index(
+        'reason = "same_run_status_retry_already_consumed_fail_closed"',
+        marker_branch,
+    )
+    marker_pending = start.index(
+        'status = "same_run_status_reconcile_pending"',
+        marker_rejected,
+    )
+    general_pending = start.index(
+        "if ($queuePending -or $runningPending -or $lockPending)",
+        marker_pending,
+    )
+    assert marker_branch < marker_rejected < marker_pending < general_pending
+    assert "(($queuePending -or $runningPending) -and $lockPending)" in start[
+        marker_branch:marker_pending
+    ]

apps/api/tests/test_agent99_transport_recovery_deploy_contract.py

@@ -8,6 +8,9 @@ CONTROL = ROOT / "agent99-control-plane.ps1"
 DEPLOY = ROOT / "agent99-deploy.ps1"
 BOOTSTRAP = ROOT / "agent99-bootstrap.ps1"
 SRE_INBOX = ROOT / "agent99-sre-alert-inbox.ps1"
+REMOTE_ATOMIC_RECEIVER = (
+    ROOT / "scripts/reboot-recovery/agent99-remote-atomic-deploy-receiver.ps1"
+)
 
 
 def test_agent99_uses_dedicated_identity_and_preferred_jump_route() -> None:
@@ -312,6 +315,84 @@ def test_agent99_deployer_backs_up_manifest_before_runtime_promotion() -> None:
     assert "Copy-AgentRuntimeFileWithRetry (Join-Path $StageDir $name) $livePath" in deploy
 
 
+def test_agent99_atomic_deploy_regenerates_and_verifies_root_launcher() -> None:
+    bootstrap = BOOTSTRAP.read_text(encoding="utf-8")
+    deploy = DEPLOY.read_text(encoding="utf-8")
+
+    assert "[switch]$WriteLauncherOnly" in bootstrap
+    assert "function Write-AgentLauncher" in bootstrap
+    launcher_only = bootstrap[bootstrap.index("if ($WriteLauncherOnly)") :]
+    launcher_only = launcher_only[: launcher_only.index("function Copy-AgentFile")]
+    assert 'Join-Path $BinDir "agent99-control-plane.ps1"' in launcher_only
+    assert 'Write-AgentLauncher (Join-Path $AgentRoot "agent99-run.ps1")' in launcher_only
+    assert "Ensure-AgentHost112CanonicalSshConfig" not in launcher_only
+    assert "Set-AgentBootstrapProperty" not in launcher_only
+
+    staged_check = deploy[deploy.index('$launcherValidationRoot = Join-Path $StageDir') :]
+    staged_check = staged_check[: staged_check.index("$stagedFiles = @(")]
+    assert "-WriteLauncherOnly" in staged_check
+    assert '"staged_no_live_write"' in staged_check
+    assert 'Write-DeployEvidence $false "preflight_failed" "launcher_contract_failed"' in staged_check
+
+    promotion = deploy[deploy.index("$configBackedUp = $false") :]
+    promotion = promotion[: promotion.index("$config = Get-Content $ConfigPath")]
+    assert promotion.index('Copy-Item -Force $LauncherPath') < promotion.index(
+        "foreach ($name in $runtimeFiles)"
+    )
+    assert 'name = "agent99-run.ps1"' in promotion
+    assert 'Join-Path $BinDir "agent99-bootstrap.ps1"' in promotion
+    assert 'Get-AgentLauncherContract $LauncherPath "live_post_promotion"' in promotion
+    assert "Promoted Agent99 launcher reconcile contract verification failed." in promotion
+    assert "launcherContract = $script:LauncherContract" in deploy
+
+
+def test_agent99_launcher_contract_covers_same_run_flags_and_forwarding() -> None:
+    bootstrap = BOOTSTRAP.read_text(encoding="utf-8")
+    deploy = DEPLOY.read_text(encoding="utf-8")
+
+    for marker in (
+        '[switch]`$ReconcileOnly',
+        '[string]`$ReconcileEvidenceId = ""',
+        '[switch]`$ReconcileQueueOnly',
+        '[string]`$ReconcileQueueId = ""',
+        "-ReconcileOnly:`$ReconcileOnly",
+        "-ReconcileEvidenceId `$ReconcileEvidenceId",
+        "-ReconcileQueueOnly:`$ReconcileQueueOnly",
+        "-ReconcileQueueId `$ReconcileQueueId",
+    ):
+        assert marker in bootstrap
+    assert "Management.Automation.Language.Parser" in bootstrap
+    assert "Management.Automation.Language.Parser" in deploy
+    assert "reconcileOnlyForwarded = $true" in bootstrap
+    assert "reconcileQueueOnlyForwarded = $true" in bootstrap
+
+
+def test_agent99_remote_rollback_and_post_verifier_include_root_launcher() -> None:
+    receiver = REMOTE_ATOMIC_RECEIVER.read_text(encoding="utf-8")
+
+    assert '$LauncherPath = Join-Path $AgentRoot "agent99-run.ps1"' in receiver
+    assert "function Get-AgentLauncherContract" in receiver
+    assert '$rows += "agent99-run.ps1`t$(Get-AgentSha256File $LauncherPath)`n"' in receiver
+    restore = receiver[receiver.index("function Restore-AgentBundle") :]
+    restore = restore[: restore.index("function Write-AgentRemoteDeployReceipt")]
+    assert "[bool]$BeforeLauncherPresent" in restore
+    assert 'Join-Path $BackupPath "agent99-run.ps1"' in restore
+    assert "Copy-AgentFileWithRetry $backupLauncher $LauncherPath" in restore
+    assert "Remove-Item -LiteralPath $LauncherPath -Force" in restore
+    assert "$liveLauncherContract.ok" in receiver
+    assert (
+        '[string]$liveLauncherContract.sha256 -eq '
+        '[string]$prior.launcherContract.sha256'
+    ) in receiver
+    assert "$launcherContract.ok" in receiver
+    assert (
+        '[string]$launcherContract.sha256 -eq '
+        '[string]$deploy.payload.launcherContract.sha256'
+    ) in receiver
+    assert "launcherContract = $launcherContract" in receiver
+    assert "failedLauncherContract = $launcherContract" in receiver
+
+
 def test_agent99_completion_callback_waits_for_durable_same_trace_readback() -> None:
     source = CONTROL.read_text(encoding="utf-8")
     deploy = DEPLOY.read_text(encoding="utf-8")