Merge remote-tracking branch 'origin/main' into codex/ai-automation-codebase-review-20260710

apps/api/tests/test_host188_openclaw_callback_forwarder_ansible_catalog.py

@@ -8,6 +8,7 @@ import yaml
 
 from src.services.awooop_ansible_audit_service import (
     _catalog_hints,
+    build_ansible_decision_audit_payload,
     get_ansible_catalog_item,
 )
 from src.services.awooop_ansible_check_mode_service import (
@@ -72,7 +73,13 @@ def _incident() -> dict:
         "signals": [
             {
                 "alert_name": "TelegramCallbackIngressUnverified",
-                "labels": {"component": "openclaw", "host": "188"},
+                "labels": {
+                    "component": "openclaw",
+                    "host": "188",
+                    "trace_id": "aia-sre-017-callback-002",
+                    "run_id": "aia-sre-017-callback-002",
+                    "work_item_id": "AIA-SRE-017",
+                },
             }
         ],
     }
@@ -134,6 +141,48 @@ def test_openclaw_incident_selects_one_exact_bounded_catalog() -> None:
     assert hints["cross_domain_fallback_allowed"] is False
 
 
+def test_openclaw_candidate_preserves_same_run_correlation() -> None:
+    payload = build_ansible_decision_audit_payload(
+        incident=_incident(),
+        proposal_data={
+            "source": "alert_webhook_controlled_router",
+            "risk_level": "medium",
+            "source_fingerprint": "callback-fingerprint",
+            "source_occurrence_id": "alert-callback-002",
+            "source_recurrence_verified": True,
+        },
+        decision_path="repair_candidate_controlled_queue",
+        not_used_reason="test",
+    )
+
+    assert payload is not None
+    assert payload["input"]["trace_id"] == "aia-sre-017-callback-002"
+    assert payload["input"]["run_id"] == "aia-sre-017-callback-002"
+    assert payload["input"]["work_item_id"] == "AIA-SRE-017"
+    assert payload["input"]["run_namespace"] == "awoooi"
+
+
+def test_openclaw_candidate_generates_safe_correlation_when_source_omits_it() -> None:
+    incident = _incident()
+    incident["signals"][0]["labels"] = {
+        "component": "openclaw",
+        "host": "188",
+    }
+    payload = build_ansible_decision_audit_payload(
+        incident=incident,
+        proposal_data={"source": "test", "risk_level": "medium"},
+        decision_path="repair_candidate_controlled_queue",
+        not_used_reason="test",
+    )
+
+    assert payload is not None
+    assert payload["input"]["trace_id"] == payload["input"]["run_id"]
+    assert payload["input"]["trace_id"].startswith("ansible:awoooi:")
+    assert payload["input"]["work_item_id"].startswith(
+        "ansible-controlled:awoooi:"
+    )
+
+
 def test_openclaw_catalog_and_independent_verifier_are_exact() -> None:
     catalog = get_ansible_catalog_item(CATALOG_ID)
     conditions = postconditions_for_catalog(CATALOG_ID)