fix(windows99): validate vmx candidate confirmation

apps/api/tests/test_windows99_vmx_source_locator_readback_api.py

@@ -12,6 +12,7 @@ from src.api.v1 import agents
 from src.api.v1.agents import router
 from src.services.windows99_vmx_source_locator_readback import (
     build_windows99_vmx_source_locator_readback,
+    validate_windows99_vmx_source_candidate_confirmation_packet,
 )
 from src.services.windows99_vmx_source_repair_package import (
     build_windows99_vmx_source_repair_package,
@@ -202,6 +203,131 @@ def test_windows99_vmx_source_locator_builder_projects_redacted_receipt() -> Non
     assert payload["vm_power_change_performed"] is False
 
 
+def test_windows99_candidate_confirmation_validator_accepts_redacted_packet() -> None:
+    repair_package = build_windows99_vmx_source_repair_package(
+        _scorecard(),
+        generated_at="2026-07-03T11:21:00+08:00",
+    )
+    locator = build_windows99_vmx_source_locator_readback(
+        _scorecard(),
+        repair_package=repair_package,
+        collector_receipt={
+            "schema_version": "windows99_vmx_source_locator_receipt_v1",
+            "collector_readback_present": True,
+            "collector_collection_status": (
+                "collected_windows99_vmx_source_locator_stdout"
+            ),
+            "target_host_alias": "99",
+            "target_vm_aliases": ["111"],
+            "expected_vmx_path_present_count": 0,
+            "candidate_source_count": 1,
+            "candidate_source_fingerprint_count": 1,
+            "alias_hint_candidate_count": 0,
+            "unassigned_ubuntu_candidate_count": 0,
+            "identity_metadata_read": True,
+            "bounded_identity_metadata_only": True,
+            "identity_target_hint_count": 1,
+            "identity_unassigned_ubuntu_candidate_count": 0,
+            "locate_status": "single_identity_candidate_requires_confirmation",
+        },
+    )
+
+    payload = validate_windows99_vmx_source_candidate_confirmation_packet(
+        {
+            "schema_version": "windows99_vmx_source_candidate_confirmation_packet_v1",
+            "target_host_alias": "99",
+            "target_vm_aliases": ["111"],
+            "candidate_identity_kind": "authorized_console_identity",
+            "candidate_identity_evidence_ref": (
+                "console://awoooi/windows99/candidate-identity-redacted-111"
+            ),
+            "candidate_match_count": 1,
+            "redacted_metadata_only": True,
+            "bounded_identity_metadata_only": True,
+            "path_fingerprint_only": True,
+            "raw_path_output": False,
+            "secret_value_read": False,
+            "remote_write_performed": False,
+            "host_reboot_performed": False,
+            "vm_power_change_performed": False,
+            "windows_registry_apply_performed": False,
+            "scheduled_task_write_performed": False,
+            "apply_requested": False,
+            "vm_power_change_requested": False,
+        },
+        locator_readback=locator,
+    )
+
+    assert payload["schema_version"] == (
+        "windows99_vmx_source_candidate_confirmation_validation_v1"
+    )
+    assert payload["status"] == (
+        "accepted_for_scoped_relink_dry_run_preparation_only"
+    )
+    assert payload["accepted"] is True
+    assert payload["missing_fields"] == []
+    assert payload["rejected_fields"] == []
+    assert payload["projected_confirmation_gate"][
+        "can_prepare_scoped_relink_dry_run"
+    ] is True
+    assert payload["projected_confirmation_gate"][
+        "apply_allowed_by_confirmation_gate"
+    ] is False
+    assert payload["operation_boundaries"]["request_payload_saved"] is False
+    assert payload["operation_boundaries"]["remote_write_performed"] is False
+    assert payload["operation_boundaries"]["vm_power_change_performed"] is False
+
+
+def test_windows99_candidate_confirmation_validator_rejects_sensitive_payload() -> None:
+    locator = build_windows99_vmx_source_locator_readback(
+        _scorecard(),
+        collector_receipt={
+            "schema_version": "windows99_vmx_source_locator_receipt_v1",
+            "collector_readback_present": True,
+            "target_host_alias": "99",
+            "target_vm_aliases": ["111"],
+            "candidate_source_count": 1,
+            "identity_metadata_read": True,
+            "bounded_identity_metadata_only": True,
+            "locate_status": "single_identity_candidate_requires_confirmation",
+        },
+    )
+
+    payload = validate_windows99_vmx_source_candidate_confirmation_packet(
+        {
+            "schema_version": "windows99_vmx_source_candidate_confirmation_packet_v1",
+            "target_host_alias": "99",
+            "target_vm_aliases": ["111"],
+            "candidate_identity_kind": "authorized_console_identity",
+            "candidate_identity_evidence_ref": "D:\\raw\\path\\vm.vmx",
+            "candidate_match_count": 1,
+            "redacted_metadata_only": True,
+            "bounded_identity_metadata_only": True,
+            "path_fingerprint_only": True,
+            "raw_path_output": True,
+            "secret_value_read": False,
+            "remote_write_performed": False,
+            "host_reboot_performed": False,
+            "vm_power_change_performed": False,
+            "windows_registry_apply_performed": False,
+            "scheduled_task_write_performed": False,
+            "apply_requested": False,
+            "vm_power_change_requested": False,
+        },
+        locator_readback=locator,
+    )
+
+    assert payload["accepted"] is False
+    assert payload["status"] == "rejected_candidate_confirmation_packet"
+    assert "raw_path_output" in payload["rejected_fields"]
+    assert "forbidden_fragments" in payload["rejected_fields"]
+    assert payload["forbidden_fragment_count"] >= 1
+    assert payload["projected_confirmation_gate"][
+        "can_prepare_scoped_relink_dry_run"
+    ] is False
+    assert payload["operation_boundaries"]["apply_gate_opened"] is False
+
+
 def test_windows99_vmx_source_locator_endpoint_returns_public_safe_readback(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
@@ -261,3 +387,71 @@ def test_windows99_vmx_source_locator_endpoint_returns_public_safe_readback(
     assert "D:\\" not in response.text
     assert "uuid." not in response.text
     assert "generatedAddress" not in response.text
+
+
+def test_windows99_candidate_confirmation_endpoint_is_no_persist_validator(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    repair_package = build_windows99_vmx_source_repair_package(_scorecard())
+    locator = build_windows99_vmx_source_locator_readback(
+        _scorecard(),
+        repair_package=repair_package,
+        collector_receipt={
+            "schema_version": "windows99_vmx_source_locator_receipt_v1",
+            "collector_readback_present": True,
+            "target_host_alias": "99",
+            "target_vm_aliases": ["111"],
+            "candidate_source_count": 1,
+            "identity_metadata_read": True,
+            "bounded_identity_metadata_only": True,
+            "locate_status": "single_identity_candidate_requires_confirmation",
+        },
+    )
+    monkeypatch.setattr(
+        agents,
+        "validate_windows99_vmx_source_candidate_confirmation_packet",
+        lambda packet: validate_windows99_vmx_source_candidate_confirmation_packet(
+            packet,
+            locator_readback=locator,
+        ),
+    )
+    app = FastAPI()
+    app.include_router(router, prefix="/api/v1")
+    client = TestClient(app)
+
+    response = client.post(
+        "/api/v1/agents/windows99-vmx-source-locator-readback/"
+        "validate-candidate-confirmation",
+        json={
+            "schema_version": "windows99_vmx_source_candidate_confirmation_packet_v1",
+            "target_host_alias": "99",
+            "target_vm_aliases": ["111"],
+            "candidate_identity_kind": "verified_backup_path_fingerprint",
+            "candidate_identity_evidence_ref": (
+                "backup://awoooi/windows99/redacted-fingerprint-111"
+            ),
+            "candidate_match_count": 1,
+            "redacted_metadata_only": True,
+            "bounded_identity_metadata_only": True,
+            "path_fingerprint_only": True,
+            "raw_path_output": False,
+            "secret_value_read": False,
+            "remote_write_performed": False,
+            "host_reboot_performed": False,
+            "vm_power_change_performed": False,
+            "windows_registry_apply_performed": False,
+            "scheduled_task_write_performed": False,
+            "apply_requested": False,
+            "vm_power_change_requested": False,
+        },
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["accepted"] is True
+    assert payload["operation_boundaries"]["no_persist_validator"] is True
+    assert payload["operation_boundaries"]["request_payload_saved"] is False
+    assert payload["operation_boundaries"]["apply_gate_opened"] is False
+    assert payload["operation_boundaries"]["vm_power_change_performed"] is False
+    assert "D:\\" not in response.text
+    assert "192.168.0." not in response.text