fix(agent99): verify Windows control baseline in selfcheck

apps/api/tests/test_agent99_alert_dispatch_order_contract.py

@@ -4,6 +4,7 @@ ROOT = Path(__file__).resolve().parents[3]
 SRE_INBOX = ROOT / "agent99-sre-alert-inbox.ps1"
 TELEGRAM_INBOX = ROOT / "agent99-telegram-inbox.ps1"
 CONTROL_PLANE = ROOT / "agent99-control-plane.ps1"
+WINDOWS_CONTROL_BASELINE = ROOT / "agent99-windows-control-baseline.ps1"
 SRE_RELAY = ROOT / "agent99-sre-alert-relay.ps1"
 
 
@@ -215,6 +216,43 @@ def test_agent99_control_plane_health_is_exact_selfcheck_no_write() -> None:
         assert scope_field in processing
 
 
+def test_agent99_selfcheck_verifies_windows99_control_baseline_no_write() -> None:
+    source = CONTROL_PLANE.read_text(encoding="utf-8")
+    verifier = source[
+        source.index("function Test-AgentWindowsControlBaseline") : source.index(
+            "function Test-AgentSelfHealth"
+        )
+    ]
+    selfcheck = source[
+        source.index("function Test-AgentSelfHealth") : source.index(
+            "function Get-AgentUnixAgeMinutes"
+        )
+    ]
+
+    assert '"agent99-windows-control-baseline.ps1"' in verifier
+    assert "-Mode Check" in verifier
+    assert "-Mode Apply" not in verifier
+    assert 'runtimeWritePerformed = $false' in verifier
+    assert 'receipt.verifier.passed -eq $true' in verifier
+    assert 'receipt.transport.inputMethodIndependent -eq $true' in verifier
+    assert 'receipt.transport.encodedCommandCompatible -eq $true' in verifier
+    assert 'receipt.terminal -eq "verified_check_no_write"' in verifier
+    assert "$windowsControlBaseline = Test-AgentWindowsControlBaseline" in selfcheck
+    assert 'windowsControlBaseline = $windowsControlBaseline' in selfcheck
+    assert 'windowsControlBaselineSeverity = $windowsControlBaseline.severity' in selfcheck
+    assert 'New-AgentOutcomeCheck "windows99_control_baseline_no_write"' in source
+    assert '"windows_control_baseline_evidence_ref"' in source
+
+
+def test_windows99_control_baseline_check_fails_closed_on_desired_state_drift() -> None:
+    source = WINDOWS_CONTROL_BASELINE.read_text(encoding="utf-8")
+    terminal = source[source.index("$terminal = if") : source.index("$receipt =")]
+
+    assert '$Mode -eq "Check" -and $runtimeVerified' in terminal
+    assert '$Mode -eq "Check" -and $independentAgreement' not in terminal
+    assert '$Mode -eq "Check" -and $runtimeVerified' in source[source.index("$passed =") :]
+
+
 def test_agent99_typed_guard_rejects_before_dedupe_or_queue_write() -> None:
     source = SRE_INBOX.read_text(encoding="utf-8")
     processing = source[source.index("foreach ($file in $files)") :]