fix(iwooos): repair wazuh host trust and retry

apps/api/src/services/iwooos_wazuh_controlled_executor_runtime.py

@@ -54,6 +54,10 @@ _LIVE_RUNTIME_SQL = """
                 check_mode.output ->> 'returncode',
                 check_mode.dry_run_result ->> 'returncode'
             ) AS check_returncode,
+            coalesce(
+                check_mode.output ->> 'timed_out',
+                check_mode.dry_run_result ->> 'timed_out'
+            ) AS check_timed_out,
             check_mode.duration_ms AS check_duration_ms,
             check_mode.created_at AS check_created_at
         FROM automation_operation_log check_mode
@@ -231,6 +235,8 @@ def build_iwooos_wazuh_controlled_executor_runtime_readback(
         data.get("check_status") == "success"
         and str(data.get("check_returncode") or "") == "0"
     )
+    check_failed = data.get("check_status") == "failed"
+    check_failure_class = _check_failure_class(data)
     apply_terminal = data.get("apply_status") in {"success", "failed"}
     apply_passed = (
         data.get("apply_status") == "success"
@@ -294,6 +300,8 @@ def build_iwooos_wazuh_controlled_executor_runtime_readback(
         active_blockers.append("wazuh_manager_posture_catalog_missing")
     if candidate_present and data.get("check_status") == "failed":
         active_blockers.append("wazuh_manager_posture_check_mode_failed")
+        if check_failure_class:
+            active_blockers.append(check_failure_class)
     if data.get("apply_status") == "failed":
         active_blockers.append("wazuh_manager_posture_controlled_probe_failed")
     if apply_passed and not verifier_passed:
@@ -311,6 +319,7 @@ def build_iwooos_wazuh_controlled_executor_runtime_readback(
             read_error_type=read_error_type,
             candidate_present=candidate_present,
             check_passed=check_passed,
+            check_failed=check_failed,
             apply_terminal=apply_terminal,
             apply_passed=apply_passed,
             runtime_closed=runtime_closed,
@@ -329,6 +338,7 @@ def build_iwooos_wazuh_controlled_executor_runtime_readback(
             "executor_policy_enabled_count": 1 if enabled and catalog_ready else 0,
             "dispatch_candidate_count": 1 if candidate_present else 0,
             "check_mode_passed_count": 1 if check_passed else 0,
+            "check_mode_failed_count": 1 if check_failed else 0,
             "runtime_execution_performed_count": 1 if apply_terminal else 0,
             "bounded_posture_execution_passed_count": 1 if apply_passed else 0,
             "independent_post_verifier_passed_count": 1 if verifier_passed else 0,
@@ -359,9 +369,12 @@ def build_iwooos_wazuh_controlled_executor_runtime_readback(
             for stage_id in required_stages
         ],
         "missing_stage_ids": missing_stage_ids,
+        "check_failure_class": check_failure_class,
         "next_safe_action": _next_action(
             candidate_present=candidate_present,
             check_passed=check_passed,
+            check_failed=check_failed,
+            check_failure_class=check_failure_class,
             apply_terminal=apply_terminal,
             apply_passed=apply_passed,
             verifier_passed=verifier_passed,
@@ -396,6 +409,7 @@ def _status(
     read_error_type: str | None,
     candidate_present: bool,
     check_passed: bool,
+    check_failed: bool,
     apply_terminal: bool,
     apply_passed: bool,
     runtime_closed: bool,
@@ -410,6 +424,8 @@ def _status(
         return "wazuh_manager_posture_executed_runtime_writeback_open"
     if check_passed:
         return "wazuh_manager_posture_check_passed_waiting_bounded_execution"
+    if check_failed:
+        return "wazuh_manager_posture_check_failed_waiting_bounded_retry"
     if candidate_present:
         return "wazuh_manager_posture_dispatched_waiting_check_mode"
     return "waiting_for_scheduled_wazuh_manager_posture_dispatch"
@@ -419,6 +435,8 @@ def _next_action(
     *,
     candidate_present: bool,
     check_passed: bool,
+    check_failed: bool,
+    check_failure_class: str | None,
     apply_terminal: bool,
     apply_passed: bool,
     verifier_passed: bool,
@@ -429,6 +447,11 @@ def _next_action(
         return "keep_scheduled_wazuh_manager_posture_runtime_receipts_fresh"
     if not candidate_present:
         return "internal_worker_enqueue_wazuh_manager_posture_candidate"
+    if check_failed:
+        return (
+            "repair_and_enqueue_bounded_retry:"
+            + (check_failure_class or "ansible_check_mode_failed")
+        )
     if not check_passed:
         return "worker_claim_and_run_allowlisted_ansible_check_mode"
     if not apply_terminal:
@@ -440,6 +463,19 @@ def _next_action(
     return "backfill_same_run_receipts:" + ",".join(missing_stage_ids[:6])
 
 
+def _check_failure_class(data: Mapping[str, Any]) -> str | None:
+    if data.get("check_status") != "failed":
+        return None
+    if str(data.get("check_timed_out") or "").lower() == "true":
+        return "ansible_check_mode_timeout"
+    returncode = str(data.get("check_returncode") or "").strip()
+    if returncode == "4":
+        return "ansible_target_unreachable"
+    if returncode.isdigit():
+        return f"ansible_check_mode_returncode_{returncode}"
+    return "ansible_check_mode_failed_unclassified"
+
+
 def _latest_receipt_at(data: Mapping[str, Any]) -> str | None:
     values = [
         value