fix(sre): route callback ingress to Host188 executor

apps/api/tests/test_alertmanager_rule_bypass.py

@@ -132,6 +132,37 @@ def test_exact_alertmanager_chain_rule_precedes_llm() -> None:
     ) is True
 
 
+def test_exact_host188_callback_rule_precedes_llm() -> None:
+    rule_response = {
+        "rule_id": "telegram_callback_ingress_host188",
+        "suggested_action": "CONTROLLED_APPLY",
+        "kubectl_command": "",
+    }
+
+    assert _should_use_alertmanager_rule_first(
+        rule_response,
+        "ai_agent",
+    ) is True
+
+
+def test_host188_callback_rule_has_no_generic_kubernetes_action() -> None:
+    rule_response = match_rule(
+        {
+            "labels": {"alertname": "TelegramCallbackIngressUnverified"},
+            "alert_type": "custom",
+            "message": "callback ingress receipt is not fresh",
+            "severity": "warning",
+            "target_resource": "openclaw",
+        }
+    )
+
+    assert rule_response is not None
+    assert rule_response["rule_id"] == "telegram_callback_ingress_host188"
+    assert rule_response["risk_level"] == "medium"
+    assert rule_response["suggested_action"] == "CONTROLLED_APPLY"
+    assert rule_response["kubectl_command"] == ""
+
+
 def test_critical_alertmanager_incident_keeps_bounded_execution_risk_medium() -> None:
     rule_response = match_rule(
         {

apps/api/tests/test_classify_alert_early.py

@@ -15,6 +15,17 @@ import pytest
 
 from src.services.incident_service import classify_alert_early
 
+
+def test_telegram_callback_ingress_routes_to_ai_agent_controlled_lane():
+    for alertname in (
+        "TelegramCallbackIngressUnverified",
+        "TelegramCallbackForwarderDrift",
+    ):
+        assert classify_alert_early(alertname, "warning", {"host": "188"}) == (
+            "ai_agent",
+            "TYPE-3",
+        )
+
 # --------------------------------------------------------------------------- #
 # TYPE-4D: Config Drift
 # --------------------------------------------------------------------------- #