fix(iwooos): close Wazuh capability retry gate

apps/api/tests/test_telegram_webhook_execution_handoff.py

@@ -29,8 +29,10 @@ class _FakeApprovalService:
         self.approval = approval
         self.execution_triggered = execution_triggered
         self.sign_message = sign_message
+        self.sign_calls: list[dict] = []
 
-    async def sign_approval(self, **_kwargs):
+    async def sign_approval(self, **kwargs):
+        self.sign_calls.append(kwargs)
         return self.approval, self.sign_message, self.execution_triggered
 
     async def reject_approval(self, **_kwargs):
@@ -83,10 +85,14 @@ async def test_telegram_approval_schedules_executor_after_required_signature(mon
         "user": {"id": 42, "username": "ops"},
     })
     monkeypatch.setattr(telegram_api, "get_telegram_gateway", lambda: fake_gateway)
+    approval_service = _FakeApprovalService(
+        approval,
+        execution_triggered=True,
+    )
     monkeypatch.setattr(
         telegram_api,
         "get_approval_service",
-        lambda: _FakeApprovalService(approval, execution_triggered=True),
+        lambda: approval_service,
     )
     monkeypatch.setattr(telegram_api, "_finalize_telegram_approval", fake_finalize)
     monkeypatch.setattr(
@@ -115,6 +121,15 @@ async def test_telegram_approval_schedules_executor_after_required_signature(mon
         "execution_triggered": True,
     }]
     assert op_log_repo.rows[0]["kwargs"]["action_detail"] == "approve"
+    assert approval_service.sign_calls[0]["authenticated_principal_id"] == (
+        "tg_42"
+    )
+    assert approval_service.sign_calls[0]["authentication_method"] == (
+        "telegram_whitelist_nonce"
+    )
+    assert approval_service.sign_calls[0]["approver_role"] == "owner"
+    assert approval_service.sign_calls[0]["telegram_user_id"] == 42
+    assert approval_service.sign_calls[0]["telegram_message_id"] == 99
 
 
 @pytest.mark.asyncio