feat(awooop): project ai route repair work item

apps/api/src/services/platform_operator_service.py

@@ -1007,7 +1007,7 @@ def _ai_route_repair_evidence_item(
     observed_state = _as_dict(payload.get("observed_state"))
     side_effects = _ai_route_repair_side_effects(payload.get("side_effects"))
 
-    return {
+    evidence = {
         "schema_version": (
             payload.get("schema_version")
             or envelope.get("schema_version")
@@ -1037,6 +1037,12 @@ def _ai_route_repair_evidence_item(
         "provider_ts": row.get("provider_ts"),
         "received_at": row.get("received_at"),
     }
+    evidence["work_item"] = _ai_route_repair_work_item(evidence)
+    evidence["playbook_recommendation"] = _ai_route_repair_playbook_recommendation(
+        evidence
+    )
+    evidence["owner_action"] = _ai_route_repair_owner_action(evidence)
+    return evidence
 
 
 def _ai_route_repair_side_effects(value: Any) -> dict[str, bool | None]:
@@ -1078,6 +1084,101 @@ def _source_ref_count(envelope: Any) -> int:
     return total
 
 
+def _ai_route_repair_work_item(evidence: Mapping[str, Any]) -> dict[str, Any]:
+    target = str(evidence.get("target_resource") or "unknown").strip()
+    blockers = _as_string_list(evidence.get("access_blockers"))
+    open_item = bool(blockers)
+    work_item_id = f"ai-route-repair:{target or 'unknown'}"
+    return {
+        "schema_version": "awooop_ai_route_repair_work_item_v1",
+        "work_item_id": work_item_id,
+        "status": "open" if open_item else "watching",
+        "kind": "ai_route_primary_lane_repair",
+        "next_step": (
+            "restore_primary_ollama_lane_access"
+            if open_item
+            else "continue_route_monitoring"
+        ),
+        "reason": "primary_lane_unavailable" if open_item else "primary_lane_observed",
+        "needs_human": open_item,
+        "owner": "cloud_sre_operator",
+        "target_resource": target or None,
+        "target_href": "/awooop/runs",
+        "decision_effect": "none",
+        "safety_level": "read_only_work_item_projection",
+        "writes_incident_state": False,
+        "writes_auto_repair_result": False,
+        "writes_runtime_route": False,
+    }
+
+
+def _ai_route_repair_playbook_recommendation(
+    evidence: Mapping[str, Any],
+) -> dict[str, Any]:
+    blockers = set(_as_string_list(evidence.get("access_blockers")))
+    live_probe = _as_dict(evidence.get("live_probe"))
+    steps: list[dict[str, Any]] = []
+    if any(blocker.startswith("gcloud_") for blocker in blockers):
+        steps.append({
+            "step": "verify_cloud_control_plane_access",
+            "scope": "gcp_compute_read",
+            "mode": "manual_or_approved",
+        })
+    if "gcp_a_ssh_refused" in blockers or (
+        live_probe.get("gcp_a_direct_22") == "connection_refused"
+    ):
+        steps.append({
+            "step": "restore_gcp_a_os_access",
+            "scope": "gcp_serial_console_or_os_login",
+            "mode": "manual_or_approved",
+        })
+    if "gcp_a_ollama_11434_refused" in blockers or (
+        live_probe.get("gcp_a_direct_11434") == "connection_refused"
+    ):
+        steps.append({
+            "step": "restore_ollama_service_on_gcp_a",
+            "scope": "systemd_ollama",
+            "mode": "manual_or_approved",
+        })
+    if live_probe.get("proxy_110_11435") == "http_502":
+        steps.append({
+            "step": "verify_110_proxy_after_gcp_a_recovery",
+            "scope": "nginx_proxy_readback",
+            "mode": "read_only_verification",
+        })
+    steps.append({
+        "step": "verify_ai_route_status_returns_primary",
+        "scope": "awooop_ai_route_status",
+        "mode": "read_only_verification",
+    })
+
+    return {
+        "schema_version": "awooop_ai_route_playbook_recommendation_v1",
+        "playbook_id": "ai_route_primary_lane_recovery",
+        "status": "candidate_from_live_evidence",
+        "safe_to_auto_execute": False,
+        "requires_approval": True,
+        "decision_effect": "none",
+        "steps": steps,
+    }
+
+
+def _ai_route_repair_owner_action(evidence: Mapping[str, Any]) -> dict[str, Any]:
+    work_item = _as_dict(evidence.get("work_item"))
+    playbook = _as_dict(evidence.get("playbook_recommendation"))
+    return {
+        "schema_version": "awooop_ai_route_owner_action_v1",
+        "lead_agent": "Hermes",
+        "supporting_agents": ["OpenClaw", "ElephantAlpha"],
+        "human_owner": "Cloud/SRE owner",
+        "automation_state": "blocked_by_external_cloud_or_os_access",
+        "next_step": work_item.get("next_step") or "continue_route_monitoring",
+        "playbook_id": playbook.get("playbook_id"),
+        "safe_to_auto_repair": False,
+        "blocking_reason": work_item.get("reason") or "unknown",
+    }
+
+
 def _ai_route_lane_state(
     *,
     policy_order: list[dict[str, Any]],