fix(agent): bound host110 monitoring repair

apps/api/src/services/awooop_ansible_audit_service.py

@@ -426,14 +426,33 @@ _CATALOG: tuple[dict[str, Any], ...] = (
     },
     {
         "catalog_id": "ansible:110-devops",
-        "playbook_path": "infra/ansible/playbooks/110-devops.yml",
+        "playbook_path": "infra/ansible/playbooks/110-node-exporter-repair.yml",
+        "check_mode_playbook_path": "infra/ansible/playbooks/110-node-exporter-repair.yml",
         "inventory_hosts": ["host_110"],
-        "domains": ["swap", "harbor", "sentry", "gitea", "langfuse", "bitan", "runner", "keepalived", "nginx"],
+        "domains": ["monitoring", "prometheus", "node_exporter", "host_110"],
         "keywords": [
-            "110",
-            "docker",
-            "container",
-            "dockercontainerunhealthy",
+            "node-exporter-110",
+            "node exporter 110",
+            "nodeexporterdown",
+            "node_exporter",
+            "node-exporter",
+        ],
+        "activation_keywords": [
+            "node-exporter-110",
+            "node exporter 110",
+        ],
+        "supports_check_mode": True,
+        "auto_apply_enabled": True,
+        "approval_required": False,
+        "risk_level": "low",
+        "catalog_revision": "2026-07-14-node-exporter-bounded-v4",
+    },
+    {
+        "catalog_id": "ansible:110-devops-full-convergence",
+        "playbook_path": "infra/ansible/playbooks/110-devops.yml",
+        "check_mode_playbook_path": "infra/ansible/playbooks/110-devops.yml",
+        "inventory_hosts": ["host_110"],
+        "domains": [
             "swap",
             "harbor",
             "sentry",
@@ -441,14 +460,25 @@ _CATALOG: tuple[dict[str, Any], ...] = (
             "langfuse",
             "bitan",
             "runner",
-            "github-runner",
             "keepalived",
+            "nginx",
+            "backup",
+        ],
+        "keywords": [
+            "110-devops-full-convergence",
+            "harbor",
+            "sentry",
+            "langfuse",
+            "bitan",
+            "keepalived",
+            "github-runner",
         ],
         "supports_check_mode": True,
-        "auto_apply_enabled": True,
+        "auto_apply_enabled": False,
         "approval_required": False,
-        "risk_level": "medium",
-        "catalog_revision": "2026-07-14-host110-harbor-route-v3",
+        "risk_level": "high",
+        "no_write_only": True,
+        "catalog_revision": "2026-07-14-full-convergence-quarantined-v1",
     },
     {
         "catalog_id": "ansible:188-momo-backup-user",

apps/api/src/services/awooop_ansible_check_mode_service.py

@@ -1063,6 +1063,7 @@ def _claim_from_stale_check_mode_row(
         or ""
     )
     catalog_id = str(input_payload.get("catalog_id") or "")
+    catalog_item = get_ansible_catalog_item(catalog_id) or {}
     inventory_hosts = input_payload.get("inventory_hosts")
     source_playbook_path = str(
         input_payload.get("source_candidate_playbook_path")
@@ -1080,6 +1081,9 @@ def _claim_from_stale_check_mode_row(
         or not inventory_hosts
     ):
         return None
+    canonical_playbook_path = str(catalog_item.get("playbook_path") or "")
+    if not canonical_playbook_path:
+        return None
     try:
         claim_input = build_ansible_check_mode_claim_input(
             source_candidate_op_id=source_candidate_op_id,
@@ -1089,9 +1093,13 @@ def _claim_from_stale_check_mode_row(
                 "executor_candidates": [
                     {
                         "catalog_id": catalog_id,
-                        "playbook_path": source_playbook_path,
+                        # A stale row is evidence, never execution authority. Path
+                        # migrations must resolve through the current allowlisted
+                        # catalog so a repaired bounded playbook can replace an
+                        # unsafe or retired predecessor without trusting DB input.
+                        "playbook_path": canonical_playbook_path,
                         "inventory_hosts": inventory_hosts,
-                        "risk_level": input_payload.get("risk_level"),
+                        "risk_level": catalog_item.get("risk_level"),
                     }
                 ],
             },

apps/api/src/services/awooop_ansible_post_verifier.py

@@ -99,6 +99,31 @@ _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
         ),
     ),
     "ansible:110-devops": (
+        AssetPostcondition(
+            "host_110_node_exporter_container",
+            "service",
+            "host_110",
+            "test \"$(docker inspect --format '{{.State.Running}}' node-exporter 2>/dev/null)\" = true",
+        ),
+        AssetPostcondition(
+            "host_110_node_exporter_metrics",
+            "metric",
+            "host_110",
+            "test \"$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "
+            "http://127.0.0.1:9100/metrics)\" = 200",
+        ),
+        AssetPostcondition(
+            "host_110_node_exporter_prometheus_scrape",
+            "metric",
+            "host_110",
+            "for attempt in 1 2 3 4 5 6; do "
+            "curl -fsS --max-time 5 "
+            "'http://127.0.0.1:9090/api/v1/query?query=up%7Bjob%3D%22node-exporter-110%22%7D' "
+            "| grep -Eq '\"value\":\\[[^]]+,\"1\"\\]' && exit 0; "
+            "sleep 5; done; exit 1",
+        ),
+    ),
+    "ansible:110-devops-full-convergence": (
         AssetPostcondition(
             "host_110_docker_runtime",
             "service",