fix(recovery): persist Host111 broker transport

apps/api/src/services/awooop_ansible_post_verifier.py

@@ -6,6 +6,7 @@ import asyncio
 import hashlib
 import os
 import re
+import shlex
 import time
 from collections.abc import Awaitable, Callable, Mapping
 from dataclasses import dataclass
@@ -24,9 +25,11 @@ VERIFIER_ID = "asset_specific_read_only_host_postconditions"
 INDEPENDENT_SOURCE = "broker_ssh_host_runtime_readback"
 _SAFE_HOST_ALIAS_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
 _SAFE_REMOTE_ID_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
-_FIXED_PROXY_JUMP_BY_HOST = {
+_FIXED_PROXY_TARGET_BY_HOST = {
     "host_111": "wooo@192.168.0.110",
 }
+_INVENTORY_PROXY_KEY_PATH = Path("/run/secrets/ssh_mcp_key")
+_INVENTORY_PROXY_KNOWN_HOSTS_PATH = Path("/etc/ssh-mcp/known_hosts")
 _RUNTIME_CLOSURE_RECEIPT_CATALOGS = frozenset(
     {"ansible:188-openclaw-callback-forwarder"}
 )
@@ -699,6 +702,23 @@ def _load_inventory_hosts(inventory_path: Path) -> dict[str, dict[str, str]]:
     return hosts
 
 
+def _pinned_proxy_command(
+    *,
+    proxy_target: str,
+    ssh_key_path: Path,
+    known_hosts_path: Path,
+) -> str:
+    if not re.fullmatch(r"[A-Za-z0-9_.-]+@[A-Za-z0-9_.-]+", proxy_target):
+        raise ValueError("postcondition_proxy_target_invalid")
+    return (
+        f"ssh -i {shlex.quote(str(ssh_key_path))} "
+        f"-o UserKnownHostsFile={shlex.quote(str(known_hosts_path))} "
+        "-o StrictHostKeyChecking=yes -o IdentitiesOnly=yes "
+        "-o BatchMode=yes -o ConnectTimeout=10 "
+        f"-W %h:%p {proxy_target}"
+    )
+
+
 def build_read_only_probe_command(
     condition: AssetPostcondition,
     *,
@@ -729,14 +749,30 @@ def build_read_only_probe_command(
         "-o",
         "ConnectTimeout=10",
     ]
-    proxy_jump = _FIXED_PROXY_JUMP_BY_HOST.get(condition.inventory_host)
-    if proxy_jump is not None:
+    proxy_target = _FIXED_PROXY_TARGET_BY_HOST.get(condition.inventory_host)
+    if proxy_target is not None:
+        inventory_proxy_command = _pinned_proxy_command(
+            proxy_target=proxy_target,
+            ssh_key_path=_INVENTORY_PROXY_KEY_PATH,
+            known_hosts_path=_INVENTORY_PROXY_KNOWN_HOSTS_PATH,
+        )
         expected_common_args = (
-            f"-o ProxyJump={proxy_jump} -o StrictHostKeyChecking=yes"
+            f'-o ProxyCommand="{inventory_proxy_command}" '
+            "-o StrictHostKeyChecking=yes"
         )
         if target.get("ansible_ssh_common_args") != expected_common_args:
-            raise ValueError("postcondition_proxy_jump_policy_mismatch")
-        command.extend(["-o", f"ProxyJump={proxy_jump}"])
+            raise ValueError("postcondition_proxy_command_policy_mismatch")
+        command.extend(
+            [
+                "-o",
+                "ProxyCommand="
+                + _pinned_proxy_command(
+                    proxy_target=proxy_target,
+                    ssh_key_path=ssh_key_path,
+                    known_hosts_path=known_hosts_path,
+                ),
+            ]
+        )
     command.extend([f"{user}@{host}", condition.probe])
     return command