fix(ops): classify systemd runner alerts as host resources

apps/api/src/services/alert_rule_engine.py

@@ -7,7 +7,7 @@ OpenClaw 告警規則匹配引擎
 - 規則在 YAML 定義，不需要改 Python 代碼
 - 匹配邏輯: alertname 完全匹配 > alert_type 部分匹配 > message 關鍵字
 - priority 越小越優先，999 = 通用兜底
-- 變數替換: {target} {host} {container} {instance} {job} {namespace}
+- 變數替換: {target} {host} {container} {instance} {job} {namespace} {unit}
 
 自動規則生成:
 - 只有 generic_fallback 觸發時才生成（具體規則不觸發）
@@ -185,6 +185,7 @@ def _extract_vars(alert_context: dict) -> dict[str, str]:
     host = instance.split(":")[0] if ":" in instance else instance
     job = labels.get("job", "exporter")
     namespace = alert_context.get("namespace", "awoooi-prod")
+    unit = labels.get("unit", "")
 
     # GAP-A4: 多層 label 查找，由最權威到最弱
     target = ""
@@ -245,6 +246,7 @@ def _extract_vars(alert_context: dict) -> dict[str, str]:
         "instance": instance,
         "job": job,
         "namespace": namespace,
+        "unit": unit,
     }
 
 

apps/api/src/services/incident_service.py

@@ -116,7 +116,7 @@ def classify_alert_early(
     1. ConfigurationDrift / KubeConfigDrift → TYPE-4D (Config Drift 卡片)
     2. severity=info/none → TYPE-1 (純資訊，無按鈕)
     3. backup/heartbeat 關鍵字 → TYPE-1（但 backup failure age > 24h → TYPE-3，見下）
-    4. Docker/Host 前綴 → infrastructure TYPE-3
+    4. Docker/Host/Systemd runner 前綴 → infrastructure/host_resource TYPE-3
     5. Kube/Pod/Deploy/Node/Velero/ArgoCD 前綴 → kubernetes TYPE-3
     6. Postgres/Redis 前綴 → database TYPE-3
     7. 預設 → general TYPE-3
@@ -183,6 +183,12 @@ def classify_alert_early(
     if severity in ("info", "none"):
         return "info", "TYPE-1"
 
+    # 2026-05-05 ogt + Codex: self-hosted runners are host-level systemd services.
+    # Must run before the generic "watchdog" heartbeat rule because
+    # SystemdRunnerWatchdogEnabled contains "Watchdog" but is not a heartbeat.
+    if alertname.startswith("SystemdRunner"):
+        return "host_resource", "TYPE-3"
+
     # 5. Backup / Heartbeat — 純資訊，不進 LLM
     # HostBackupFailed 必須在 Host prefix 前攔截，否則被歸 host_resource/TYPE-3
     # 2026-04-12 ogt: 只針對已知主機備份監控 alertname，不用寬泛關鍵字