awoooi/apps/api/tests/test_agent99_control_plane_outcome_contract.py

from __future__ import annotations

from pathlib import Path

_REPO_ROOT = Path(__file__).resolve().parents[3]
_CONTROL_PLANE = _REPO_ROOT / "agent99-control-plane.ps1"
_BOOTSTRAP = _REPO_ROOT / "agent99-bootstrap.ps1"
_SRE_INBOX = _REPO_ROOT / "agent99-sre-alert-inbox.ps1"


def test_agent99_queue_uses_verified_outcome_not_exit_code() -> None:
    source = _CONTROL_PLANE.read_text(encoding="utf-8")

    assert "function Get-AgentOutcomeContract" in source
    assert 'schemaVersion = "agent99_outcome_contract_v1"' in source
    assert "ok = [bool]$outcome.resolved" in source
    assert "outcomeState = $outcome.state" in source
    assert "verifierPassed = [bool]$outcome.verifierPassed" in source
    assert "sourceEventResolutionRequired" in source
    assert '"verifying"' in source
    assert '"candidate_ready"' in source
    assert "ok = [bool]($exitCode -eq 0)" not in source
    assert 'New-AgentOutcomeCheck "host112_guest_ready" $host112Ok' in source
    assert "$data.host112Recovery -and $data.host112Recovery.verified" in source


def test_agent99_problem_counts_separate_verified_resolution() -> None:
    source = _CONTROL_PLANE.read_text(encoding="utf-8")

    assert 'schemaVersion = "agent99_problem_counts_v2"' in source
    assert "totalVerifiedResolved" in source
    assert "legacyResolvedCountMayIncludeTransportOnly" in source
    assert "verifiedResolved" in source
    assert "totalDegraded" in source
    assert "totalBlocked" in source
    assert "totalVerifying" in source
    assert "totalCandidateReady" in source


def test_agent99_runtime_manifest_is_generated_and_self_checked() -> None:
    control_source = _CONTROL_PLANE.read_text(encoding="utf-8")
    bootstrap_source = _BOOTSTRAP.read_text(encoding="utf-8")

    assert "function Test-AgentRuntimeManifest" in control_source
    assert 'reason = "runtime_manifest_missing"' in control_source
    assert "runtimeManifest = Test-AgentRuntimeManifest" in control_source
    assert 'schemaVersion = "agent99_runtime_manifest_v1"' in bootstrap_source
    assert 'Join-Path $StateDir "runtime-manifest.json"' in bootstrap_source
    assert "Get-FileHash -Algorithm SHA256" in bootstrap_source
    assert "if (-not $runtimeMatched)" in bootstrap_source


def test_agent99_outcome_contract_has_runtime_self_test() -> None:
    source = _CONTROL_PLANE.read_text(encoding="utf-8")

    assert "[switch]$SelfTestOutcomeContract" in source
    assert "function Invoke-AgentOutcomeContractSelfTest" in source
    assert '$operatorResolved.state -eq "resolved"' in source
    assert '$alertVerifying.state -eq "verifying"' in source
    assert '$alertResolvedByVerifier.state -eq "resolved"' in source
    assert '$alertTransportFailedVerifier.state -eq "failed"' in source
    assert "-not $alertTransportFailedVerifier.sourceEventResolved" in source
    assert '"mode_verifier_can_resolve"' in source
    assert "sourceEventResolutionPolicy" in source
    assert '$failedPostCondition.state -eq "degraded"' in source
    assert '$transportFailed.state -eq "failed"' in source
    assert '$securityCandidate.state -eq "candidate_ready"' in source


def test_agent99_posts_fenced_outcome_to_production_ingestion() -> None:
    source = _CONTROL_PLANE.read_text(encoding="utf-8")
    inbox = _SRE_INBOX.read_text(encoding="utf-8")

    assert "function Send-AgentOutcomeWriteback" in source
    assert "/api/v1/webhooks/agent99/outcomes" in source
    assert '"X-Agent99-Relay-Token" = $token' in source
    assert "$attempt -le 3" in source
    assert "agent99_outcome_receipt_id" in source
    assert "post_verifier_evidence_ref" in source
    assert "source_event_evidence_ref" in source
    for field in (
        "projectId",
        "sourceFingerprint",
        "dispatchRouteId",
        "singleFlightKey",
        "lockOwner",
        "canonicalDigest",
        "automationRunId",
        "traceId",
        "workItemId",
        "idempotencyKey",
        "executionGeneration",
        "incidentId",
    ):
        assert field in inbox
        assert field in source


def test_agent99_backupcheck_reads_offsite_and_escrow_without_mutation() -> None:
    source = _CONTROL_PLANE.read_text(encoding="utf-8")
    readback = source[
        source.index("function Test-AgentBackupProtectionReceipts") :
        source.index("function Invoke-AgentBackupReadbackContractSelfTest")
    ]

    assert "[switch]$SelfTestBackupReadbackContract" in source
    assert "function Convert-AgentBackupProtectionReadback" in source
    for metric in (
        "awoooi_backup_offsite_configured",
        "awoooi_backup_offsite_fresh",
        "awoooi_backup_offsite_remote_verify_ok",
        "awoooi_backup_credential_escrow_fresh",
        "awoooi_backup_dr_credential_escrow_missing_count",
    ):
        assert metric in source
    assert "stat -c '__PROTECTION_MTIME__=%Y'" in readback
    assert "grep -E" in readback
    assert "backupRunPerformed = $false" in source
    assert "restoreRunPerformed = $false" in source
    assert "markerWritePerformed = $false" in source
    assert '"offsite_verify_evidence_ref"' in source
    assert '"escrow_evidence_ref"' in source
    assert "protectionMaxAgeMinutes" in source
    assert "protectionEscrowExpectedCount" in source
    assert "$evidenceAgeMinutes -ge -5" in source
    assert "$evidenceAgeMinutes -le" in source
    assert "function Get-AgentBackupProviderMetricRows" in source
    assert "$offsiteFresh.Count -eq $offsiteFreshRows.Count" in source
    assert "$remoteVerify.Count -eq $remoteVerifyRows.Count" in source
    assert "$configuredProviderNames.Count -gt 0" in source
    assert "$verifiedProviderNames.Count -eq $configuredProviderNames.Count" in source
    assert "$escrowFresh.Count -eq $ExpectedEscrowFreshCount" in source
    assert "$escrowMissingValues.Count -eq 1" in source
    assert 'provider="b2"} 0' in source
    assert 'provider="rclone"} 1' in source
    assert "optionalB2ProviderTerminalEligible" in source
    assert "allProvidersUnconfiguredBlocked" in source
    assert "configuredProviderStaleBlocked" in source
    assert "configuredProviderRemoteVerifyFailedBlocked" in source
    assert "escrowMissingBlocked" in source
    assert "escrowPartialFreshnessBlocked" in source
    assert "-not $staleResult.offsiteVerify.ok" in source
    assert "-not $noProviderResult.offsiteVerify.ok" in source
    assert "-not $staleProviderResult.offsiteVerify.ok" in source
    assert "-not $remoteVerifyResult.offsiteVerify.ok" in source
    assert "-not $escrowMissingResult.escrow.ok" in source
    assert "-not $escrowPartialResult.escrow.ok" in source
    for mutation in ("rclone ", "rsync ", " rm ", "restore ", "Set-Content"):
        assert mutation not in readback