fix(automation): enforce durable alert closure

Restore D037 durable incident readback without weakening database failure semantics.

Fence Agent99 dispatch and terminal learning to canonical identities, durable leases, verifier receipts, and reconciler-owned checkpoints.

Drain backup and restore legacy receipts in bounded cohorts with strict transport, claim, projection, and no-false-green controls.

Keep SSH service refusal visible while separating it from broker network-policy reachability.

apps/api/tests/test_cs1_auto_execute.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import inspect
 from types import SimpleNamespace
 from unittest.mock import AsyncMock
@@ -116,26 +117,31 @@ async def test_webhook_router_writes_queue_receipt_without_side_effect(
         get_from_working_memory=AsyncMock(return_value=incident)
     )
     append = AsyncMock()
-
-    queue_kwargs: dict = {}
-
-    async def queue(**kwargs):
-        queue_kwargs.update(kwargs)
-        return {
-            "schema_version": "ai_decision_controlled_executor_handoff_v1",
-            "status": "controlled_check_mode_queued",
-            "automation_run_id": "00000000-0000-0000-0000-000000000101",
-            "queued": True,
-            "side_effect_performed": False,
-            "single_writer_executor": "awoooi-ansible-executor-broker",
-            "active_blockers": [],
+    queue = AsyncMock()
+    bridge = AsyncMock(
+        return_value={
+            "status": "deduplicated",
+            "dispatchPerformed": False,
+            "identity": {
+                "run_id": "00000000-0000-0000-0000-000000000101",
+                "trace_id": "00000000-0000-0000-0000-000000000102",
+                "work_item_id": "agent99-dispatch:awoooi:INC-QUEUE:backup",
+                "idempotency_key": "agent99:backup:INC-QUEUE",
+            },
+            "dispatchReceipt": {
+                "accepted": True,
+                "inbox_triggered": True,
+            },
+            "correlatedReceipt": {"receipt_persisted": True},
         }
+    )
 
     monkeypatch.setattr(webhooks, "get_incident_service", lambda: incident_service)
     monkeypatch.setattr(
         "src.jobs.awooop_ansible_candidate_backfill_job.enqueue_ai_decision_ansible_candidate",
         queue,
     )
+    monkeypatch.setattr(webhooks, "bridge_alertmanager_to_agent99", bridge)
     monkeypatch.setattr(
         "src.repositories.alert_operation_log_repository.get_alert_operation_log_repository",
         lambda: SimpleNamespace(append=append),
@@ -153,7 +159,12 @@ async def test_webhook_router_writes_queue_receipt_without_side_effect(
     assert handoff["queued"] is True
     assert handoff["side_effect_performed"] is False
     assert handoff["execution_priority"] == 30
-    assert queue_kwargs["proposal_data"]["execution_priority"] == 30
+    queue.assert_not_awaited()
+    bridge.assert_awaited_once()
+    expected_fingerprint = hashlib.sha256(
+        b"awoooi-prod:momo-postgres:MomoPostgresBackupFailed:momo-postgres"
+    ).hexdigest()[:32]
+    assert bridge.await_args.kwargs["fingerprint"] == expected_fingerprint
     append.assert_awaited_once()
     assert append.await_args.kwargs["context"]["side_effect_performed"] is False
     assert append.await_args.kwargs["context"]["execution_priority"] == 30