fix(ai): enforce ollama first for drift governance

apps/api/src/services/ai_router.py

@@ -1090,6 +1090,11 @@ class AIRouterExecutor:
                     )
                     and bool(provider_order)
                     and provider_order[0].startswith("ollama")
+                ) or (
+                    bool(context)
+                    and bool(context.get("enforce_ollama_first"))
+                    and bool(provider_order)
+                    and provider_order[0].startswith("ollama")
                 )
                 if (
                     cached_provider == "ollama"

apps/api/src/services/drift_interpreter.py

@@ -21,7 +21,7 @@ from typing import TYPE_CHECKING
 
 import structlog
 
-from src.models.drift import DriftIntent, DriftInterpretation, DriftItem
+from src.models.drift import DriftIntent, DriftInterpretation
 
 if TYPE_CHECKING:
     from src.models.drift import DriftReport
@@ -62,7 +62,7 @@ class NemotronDriftInterpreter:
     ❌ 不直接呼叫 kubectl 或 git
     """
 
-    async def analyze(self, report: "DriftReport") -> DriftInterpretation:
+    async def analyze(self, report: DriftReport) -> DriftInterpretation:
         """
         分析漂移意圖
 
@@ -85,7 +85,7 @@ class NemotronDriftInterpreter:
         result = await self._call_nemotron(prompt)
         return result
 
-    def _format_diff_for_prompt(self, report: "DriftReport") -> str:
+    def _format_diff_for_prompt(self, report: DriftReport) -> str:
         """格式化 diff 給 Nemotron 分析用"""
         lines = []
         for item in report.items[:10]:  # 最多 10 項避免 token 過多
@@ -111,7 +111,17 @@ class NemotronDriftInterpreter:
         try:
             from src.services.openclaw import get_openclaw
             openclaw = get_openclaw()
-            response_text, _provider, success = await openclaw.call(prompt)
+            response_text, _provider, success = await openclaw.call(
+                prompt,
+                alert_context={
+                    "intent_hint": "config",
+                    "task_type": "diagnose",
+                    "enforce_ollama_first": True,
+                    "allow_gcp_heavy_model": True,
+                    "target_resource": "config-drift",
+                    "alert_type": "ConfigDriftInternalScan",
+                },
+            )
 
             if not success or not response_text:
                 logger.warning("drift_interpreter_openclaw_failed", provider=_provider)

apps/api/src/services/openclaw.py

@@ -194,14 +194,20 @@ class OpenClawService:
 
     def _cloud_fallback_allowed_for_alert(self, alert_context: dict | None) -> bool:
         """Cloud fallback is allowed after the ordered Ollama lane for alerts."""
+        if alert_context and alert_context.get("allow_cloud_fallback") is False:
+            return False
         if not self._is_incident_alert_context(alert_context):
             return True
         return bool(getattr(settings, "ALERT_AI_ALLOW_CLOUD_FALLBACK", True))
 
     def _alert_enforces_ollama_first(self, alert_context: dict | None) -> bool:
-        """Alert cards must try GCP-A/GCP-B/111 before Gemini backup."""
+        """Alert and AI-governance lanes must try GCP-A/GCP-B/111 before Gemini backup."""
         return (
-            self._is_incident_alert_context(alert_context)
+            bool(alert_context)
+            and (
+                bool(alert_context.get("enforce_ollama_first"))
+                or self._is_incident_alert_context(alert_context)
+            )
             and bool(getattr(settings, "ALERT_AI_ENFORCE_OLLAMA_FIRST", True))
         )
 
@@ -1144,9 +1150,12 @@ class OpenClawService:
                 exec_context = dict(alert_context) if alert_context else {}
                 if decision.intent == IntentType.DIAGNOSE:
                     exec_context["task_type"] = "diagnose"
-                if self._is_incident_alert_context(alert_context):
-                    exec_context["ollama_model"] = getattr(settings, "ALERT_OLLAMA_MODEL", "qwen3:14b")
-                    exec_context["allow_gcp_heavy_model"] = True
+                if self._alert_enforces_ollama_first(alert_context):
+                    exec_context.setdefault("task_type", "diagnose")
+                    exec_context.setdefault("ollama_model", getattr(settings, "ALERT_OLLAMA_MODEL", "qwen3:14b"))
+                    exec_context["allow_gcp_heavy_model"] = bool(
+                        exec_context.get("allow_gcp_heavy_model", True)
+                    )
                     exec_context["alert_requires_ollama_before_cloud"] = True
 
                 result = await executor.execute(