fix(agent): prioritize p0 ansible candidates

apps/api/tests/test_awooop_truth_chain_service.py

@@ -1346,6 +1346,7 @@ def test_ansible_decision_audit_payload_is_dry_run_only() -> None:
     assert payload["input"]["check_mode"] is True
     assert payload["input"]["apply_enabled"] is False
     assert payload["input"]["approval_required"] is True
+    assert payload["input"]["execution_priority"] == 100
     assert payload["input"]["executor_candidates"]
     assert payload["output"]["decision_effect"] == "audit_only"
     assert payload["dry_run_result"]["check_mode_executed"] is False
@@ -1373,6 +1374,7 @@ def test_ansible_decision_audit_payload_marks_repair_candidate_queue_claimable()
         proposal_data={
             "source": "repair_candidate_controlled_queue",
             "risk_level": "medium",
+            "execution_priority": 0,
             "action": "systemctl restart node-exporter-188",
         },
         decision_path="repair_candidate_controlled_queue",
@@ -1389,6 +1391,7 @@ def test_ansible_decision_audit_payload_marks_repair_candidate_queue_claimable()
     assert payload["input"]["executor_candidates"]
     assert payload["dry_run_result"]["check_mode_executed"] is False
     assert payload["input"]["project_id"] == "awoooi"
+    assert payload["input"]["execution_priority"] == 0
 
 
 def test_ansible_decision_audit_payload_exposes_check_mode_safety_flags(
@@ -2701,6 +2704,16 @@ def test_ansible_claim_query_limits_recent_candidate_backlog() -> None:
     assert "AWOOOP_ANSIBLE_CHECK_MODE_CANDIDATE_MAX_AGE_HOURS" in source
 
 
+def test_ansible_claim_query_honors_bounded_execution_priority_before_fifo() -> None:
+    source = inspect.getsource(claim_pending_check_modes)
+
+    assert "candidate.input ->> 'work_item_id' LIKE 'P0-%'" in source
+    assert "candidate.input ->> 'execution_priority'" in source
+    assert "LEAST(" in source
+    assert "100" in source
+    assert source.index("execution_priority") < source.index("candidate.created_at ASC")
+
+
 def test_ansible_transport_blocker_detects_repair_forced_command_denial() -> None:
     blockers = detect_ansible_transport_blockers(
         "fatal: host unreachable REPAIR_DENIED:invalid_command",

apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py

@@ -247,6 +247,7 @@ async def test_wazuh_posture_scheduler_enqueues_after_mcp_and_log_evidence(
     assert recorded["incident"]["run_id"] == result["automation_run_id"]
     assert recorded["incident"]["work_item_id"] == ("P0-03-WAZUH-MANAGER-POSTURE")
     assert recorded["incident"]["asset_scope_aliases"] == ["security_manager_primary"]
+    assert recorded["proposal_data"]["execution_priority"] == 0
     assert recorded["incident"]["incident_id"] == "IWZ-POSTURE-2026071100"
     assert (
         recorded["incident"]["source_receipt_ref"]