From 3ba45f5efdfab9642cc982de438d45ac2f51e5da Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Wed, 22 Jul 2026 17:25:42 +0800
Subject: [PATCH] fix(iwooos): prioritize Wazuh posture claim

---
 .../awooop_ansible_check_mode_service.py      | 28 +++++++++++--------
 .../tests/test_awooop_truth_chain_service.py  | 17 +++++++++++
 2 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/apps/api/src/services/awooop_ansible_check_mode_service.py b/apps/api/src/services/awooop_ansible_check_mode_service.py
index ba7ecaed1..fc7c55f2d 100644
--- a/apps/api/src/services/awooop_ansible_check_mode_service.py
+++ b/apps/api/src/services/awooop_ansible_check_mode_service.py
@@ -9580,6 +9580,9 @@ async def claim_pending_check_modes(
                   )
                 ORDER BY
                     CASE
+                        WHEN candidate.input ->> 'work_item_id'
+                            = 'P0-03-WAZUH-MANAGER-POSTURE'
+                        THEN -1
                         WHEN candidate.input ->> 'work_item_id' LIKE 'P0-%'
                         THEN 0
                         WHEN candidate.input ->> 'proposal_source'
@@ -12022,6 +12025,18 @@ async def run_pending_check_modes_once(
         0,
         remaining_limit - len(wazuh_capability_retry_claims),
     )
+    fresh_claims = (
+        await claim_pending_check_modes(
+            project_id=project_id,
+            limit=min(1, remaining_limit),
+            candidate_max_age_hours=(
+                settings.AWOOOP_ANSIBLE_CHECK_MODE_CANDIDATE_MAX_AGE_HOURS
+            ),
+        )
+        if remaining_limit
+        else []
+    )
+    remaining_limit = max(0, remaining_limit - len(fresh_claims))
     reclaimed_claims = (
         await claim_stale_pending_check_modes(
             project_id=project_id,
@@ -12123,25 +12138,14 @@ async def run_pending_check_modes_once(
                 fresh_candidate_claim_continues=True,
             )
     remaining_limit = max(0, remaining_limit - len(catalog_replay_claims))
-    fresh_claims = (
-        await claim_pending_check_modes(
-            project_id=project_id,
-            limit=remaining_limit,
-            candidate_max_age_hours=(
-                settings.AWOOOP_ANSIBLE_CHECK_MODE_CANDIDATE_MAX_AGE_HOURS
-            ),
-        )
-        if remaining_limit
-        else []
-    )
     claims = [
         *wazuh_capability_retry_claims,
+        *fresh_claims,
         *reclaimed_claims,
         *stdin_boundary_replay_claims,
         *semantic_catalog_reconciliation_claims,
         *failed_apply_catalog_replay_claims,
         *catalog_replay_claims,
-        *fresh_claims,
     ]
     execution_claims = [*wazuh_break_glass_apply_claims, *claims]
     completed = 0
diff --git a/apps/api/tests/test_awooop_truth_chain_service.py b/apps/api/tests/test_awooop_truth_chain_service.py
index 03d95e804..be77f285d 100644
--- a/apps/api/tests/test_awooop_truth_chain_service.py
+++ b/apps/api/tests/test_awooop_truth_chain_service.py
@@ -3295,6 +3295,11 @@ async def test_execution_broker_stdin_replay_never_enters_apply(
         "claim_stale_pending_check_modes",
         no_claims,
     )
+    monkeypatch.setattr(
+        service,
+        "claim_pending_check_modes",
+        no_claims,
+    )
     monkeypatch.setattr(
         service,
         "claim_stdin_boundary_failed_check_modes",
@@ -4139,15 +4144,27 @@ def test_ansible_claim_query_limits_recent_candidate_backlog() -> None:
 def test_ansible_claim_query_honors_bounded_execution_priority_before_fifo() -> None:
     source = inspect.getsource(claim_pending_check_modes)
 
+    assert "P0-03-WAZUH-MANAGER-POSTURE" in source
     assert "candidate.input ->> 'work_item_id' LIKE 'P0-%'" in source
     assert "alert_webhook_controlled_router" in source
     assert "ELSE 30" in source
     assert "candidate.input ->> 'execution_priority'" in source
     assert "LEAST(" in source
     assert "100" in source
+    assert source.index("P0-03-WAZUH-MANAGER-POSTURE") < source.index(
+        "candidate.input ->> 'work_item_id' LIKE 'P0-%'"
+    )
     assert source.index("execution_priority") < source.index("candidate.created_at ASC")
 
 
+def test_broker_claims_fresh_p0_before_general_replay_lanes() -> None:
+    source = inspect.getsource(run_pending_check_modes_once)
+
+    assert source.index("fresh_claims = (") < source.index("reclaimed_claims = (")
+    assert "limit=min(1, remaining_limit)" in source
+    assert source.index("*fresh_claims,") < source.index("*reclaimed_claims,")
+
+
 def test_ansible_transport_blocker_detects_repair_forced_command_denial() -> None:
     blockers = detect_ansible_transport_blockers(
         "fatal: host unreachable REPAIR_DENIED:invalid_command",