fix(recovery): persist Host111 broker transport

apps/api/tests/test_executor_network_policy_boundary.py

@@ -187,9 +187,14 @@ def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
         "192.168.0.110 192.168.0.112 192.168.0.120 "
         "192.168.0.121 192.168.0.188"
     )
-    assert f"ssh-keyscan -T 5 {expected_hosts}" in workflow
-    assert "EXPECTED_HOSTS=5" in workflow
-    assert workflow.count(expected_hosts) >= 4
+    expected_known_hosts = (
+        "192.168.0.110 192.168.0.111 192.168.0.112 192.168.0.120 "
+        "192.168.0.121 192.168.0.188"
+    )
+    assert f"ssh-keyscan -T 5 {expected_known_hosts}" in workflow
+    assert "EXPECTED_HOSTS=6" in workflow
+    assert workflow.count(expected_known_hosts) >= 4
+    assert workflow.count(expected_hosts) >= 2
     assert "except ConnectionRefusedError:" in workflow
     assert "broker_ssh_refused_but_egress_permitted=" in workflow
     assert "broker_ssh_allowlisted_endpoint_unavailable=" in workflow

apps/api/tests/test_host111_ollama_ansible_catalog.py

@@ -30,6 +30,13 @@ EXPECTED_ALLOWLIST = (
     "192.168.0.120/32,192.168.0.121/32"
 )
 EXPECTED_PROXY_JUMP = "wooo@192.168.0.110"
+EXPECTED_PROXY_COMMAND = (
+    "ssh -i /run/secrets/ssh_mcp_key "
+    "-o UserKnownHostsFile=/etc/ssh-mcp/known_hosts "
+    "-o StrictHostKeyChecking=yes -o IdentitiesOnly=yes "
+    "-o BatchMode=yes -o ConnectTimeout=10 "
+    f"-W %h:%p {EXPECTED_PROXY_JUMP}"
+)
 
 
 def _flatten_tasks(tasks: list[dict]) -> list[dict]:
@@ -150,7 +157,12 @@ def test_host111_playbook_is_launchagent_bounded_and_check_mode_safe() -> None:
     assert play["vars"]["proxy_label"] == "com.momo.ollama111-allow-proxy"
     assert play["vars"]["allowed_cidrs"] == EXPECTED_ALLOWLIST
     assert "192.168.0.110/32" not in play["vars"]["allowed_cidrs"].split(",")
-    assert "launchctl bootstrap" in source
+    assert source.count("launchctl bootout") == 2
+    assert source.count("launchctl bootstrap") == 2
+    assert source.count("launchctl kickstart -k") == 2
+    assert source.count('test "$stopped" -eq 1') == 2
+    assert source.count('test "$loaded" -eq 1') == 2
+    assert source.count('test "$running" -eq 1') == 2
     assert "systemctl" not in source
     assert "docker restart" not in source
 
@@ -203,9 +215,10 @@ def test_host111_broker_transport_preserves_fixed_proxyjump_and_strict_safety(
     host111 = inventory["all"]["children"]["ollama_fallback"]["hosts"][
         "host_111"
     ]
-    assert host111["ansible_ssh_common_args"] == (
-        f"-o ProxyJump={EXPECTED_PROXY_JUMP} -o StrictHostKeyChecking=yes"
+    assert f'-o ProxyCommand="{EXPECTED_PROXY_COMMAND}"' in (
+        host111["ansible_ssh_common_args"]
     )
+    assert "ProxyJump" not in host111["ansible_ssh_common_args"]
     assert "accept-new" not in host111["ansible_ssh_common_args"]
 
     key = tmp_path / "ssh_mcp_key"
@@ -227,7 +240,7 @@ def test_host111_broker_transport_preserves_fixed_proxyjump_and_strict_safety(
         assert "ProxyJump" not in spec.env["ANSIBLE_SSH_ARGS"]
 
 
-def test_host111_independent_verifier_uses_same_fixed_proxyjump(
+def test_host111_independent_verifier_uses_same_pinned_proxy_command(
     tmp_path: Path,
 ) -> None:
     condition = next(
@@ -245,7 +258,13 @@ def test_host111_independent_verifier_uses_same_fixed_proxyjump(
         known_hosts_path=known_hosts,
     )
 
-    assert f"ProxyJump={EXPECTED_PROXY_JUMP}" in command
+    expected_verifier_proxy_command = (
+        f"ssh -i {key} -o UserKnownHostsFile={known_hosts} "
+        "-o StrictHostKeyChecking=yes -o IdentitiesOnly=yes "
+        "-o BatchMode=yes -o ConnectTimeout=10 "
+        f"-W %h:%p {EXPECTED_PROXY_JUMP}"
+    )
+    assert f"ProxyCommand={expected_verifier_proxy_command}" in command
     assert "StrictHostKeyChecking=yes" in command
     assert "BatchMode=yes" in command
     assert "ooo@192.168.0.111" in command