fix(sre): classify Host188 compose failures

apps/api/tests/test_ansible_verified_closure.py

@@ -111,6 +111,48 @@ def _controlled_result_payload() -> dict:
     }
 
 
+def test_apply_result_prefers_safe_playbook_marker_over_stderr_warning() -> None:
+    result = service.AnsibleRunResult(
+        returncode=2,
+        stdout=(
+            "TASK [Require successful bounded Compose activation]\n"
+            "fatal: [host_188]: FAILED! => {\"msg\": "
+            "\"openclaw_compose_activation_failed:bind_source_missing\"}"
+        ),
+        stderr=(
+            "[WARNING]: Platform linux on host host_188 is using the "
+            "discovered Python interpreter."
+        ),
+        duration_ms=123,
+    )
+
+    status, output, dry_run_result, error = (
+        service._build_apply_result_payload(result)
+    )
+
+    assert status == "failed"
+    assert error == (
+        "openclaw_compose_activation_failed:bind_source_missing"
+    )
+    assert output["stderr_tail"].startswith("[WARNING]")
+    assert dry_run_result["returncode"] == 2
+
+
+def test_apply_result_does_not_project_untrusted_stdout_as_error() -> None:
+    result = service.AnsibleRunResult(
+        returncode=2,
+        stdout="fatal: [host_188]: FAILED! => secret-shaped-untrusted-output",
+        stderr="safe_transport_failure",
+        duration_ms=123,
+    )
+
+    _status, _output, _dry_run_result, error = (
+        service._build_apply_result_payload(result)
+    )
+
+    assert error == "safe_transport_failure"
+
+
 def test_runtime_stage_ids_only_accepts_durable_receipts() -> None:
     stage_ids = service._runtime_stage_ids(
         {

apps/api/tests/test_host188_openclaw_callback_forwarder_ansible_catalog.py

@@ -331,6 +331,19 @@ def test_openclaw_playbook_is_check_first_bounded_and_rollback_capable() -> None
         ]
         assert tasks[name]["args"]["chdir"] == "{{ openclaw_workdir }}"
         assert tasks[name]["no_log"] is True
+        assert tasks[name]["failed_when"] is False
+    assert tasks[
+        "Classify the bounded Compose activation result without secret output"
+    ]["no_log"] is True
+    assert tasks[
+        "Classify the bounded Compose rollback result without secret output"
+    ]["no_log"] is True
+    assert tasks["Require successful bounded Compose activation"][
+        "ansible.builtin.assert"
+    ]["fail_msg"].startswith("openclaw_compose_activation_failed:")
+    assert tasks["Require successful bounded Compose rollback activation"][
+        "ansible.builtin.assert"
+    ]["fail_msg"].startswith("openclaw_compose_rollback_failed:")
     assert "Install COMPOSE_FILE-only systemd drop-in" not in tasks
     rendered_override = tasks["Define exact non-secret managed overlay documents"][
         "ansible.builtin.set_fact"