fix(automation): align provider contract with runtime IDs

apps/api/src/services/controlled_alert_target_router.py

@@ -17,6 +17,7 @@ import re
 from collections.abc import Mapping
 from typing import Any
 
+from src.services.ai_provider_policy import PRODUCTION_OLLAMA_ORDER
 from src.services.service_registry import (
     ServiceRegistryClient,
     StatefulLevel,
@@ -196,7 +197,7 @@ def _typed_route(
         },
         "reasoning_contract": {
             "rca": "ollama_provider_chain",
-            "provider_order": ["ollama_gcp_a", "ollama_gcp_b", "ollama_local_111"],
+            "provider_order": list(PRODUCTION_OLLAMA_ORDER),
             "critic": "gemini_final_fallback_explicit_cost_gate",
             "paid_call_allowed": False,
         },

apps/api/src/services/sre_k3s_controlled_automation_work_items.py

@@ -6,6 +6,7 @@ import json
 from pathlib import Path
 from typing import Any
 
+from src.services.ai_provider_policy import PRODUCTION_PROVIDER_ORDER
 from src.services.snapshot_paths import default_operations_dir
 
 _DEFAULT_OPERATIONS_DIR = default_operations_dir(Path(__file__))
@@ -23,12 +24,7 @@ _PIPELINE = [
     "Independent Verifier",
     "Incident Closure + KM/RAG/MCP/PlayBook",
 ]
-_PROVIDER_ORDER = [
-    "ollama_gcp_a",
-    "ollama_gcp_b",
-    "ollama_local_111",
-    "gemini_api",
-]
+_PROVIDER_ORDER = list(PRODUCTION_PROVIDER_ORDER)
 _REQUIRED_DOMAINS = {
     "kubernetes_workload",
     "host_systemd",
@@ -94,6 +90,15 @@ def load_sre_k3s_controlled_automation_work_items(
     provider = _dict(payload, "provider_policy", path)
     if provider.get("ordered_route") != _PROVIDER_ORDER:
         raise ValueError(f"{path}: provider order changed")
+    provider_hops = provider.get("hops")
+    if not isinstance(provider_hops, list) or [
+        hop.get("provider") for hop in provider_hops if isinstance(hop, dict)
+    ] != _PROVIDER_ORDER:
+        raise ValueError(f"{path}: provider hops do not match executable IDs")
+    if len(provider_hops) != len(_PROVIDER_ORDER) or (
+        provider_hops[2].get("identity") != "host111"
+    ):
+        raise ValueError(f"{path}: third provider hop must be host111 Ollama")
     if provider.get("gemini_paid_call_allowed") is not False:
         raise ValueError(f"{path}: Gemini paid calls require an explicit cost cap")
     if provider.get("production_provider_route_switch_allowed") is not False:

apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py

@@ -42,10 +42,18 @@ def test_loader_returns_fixed_architecture_provider_order_and_agent99_bridge() -
     assert payload["provider_policy"]["ordered_route"] == [
         "ollama_gcp_a",
         "ollama_gcp_b",
-        "ollama_local_111",
-        "gemini_api",
+        "ollama_local",
+        "gemini",
     ]
     assert payload["provider_policy"]["gemini_paid_call_allowed"] is False
+    assert payload["provider_policy"]["route_label"] == (
+        "GCP-A -> GCP-B -> host111 Ollama -> Gemini API"
+    )
+    assert payload["provider_policy"]["hops"][2] == {
+        "position": 3,
+        "provider": "ollama_local",
+        "identity": "host111",
+    }
     assert payload["agent99_host_operations_bridge"]["single_executor_domains"] == [
         "windows_vmware",
         "control_plane_recovery",

apps/api/tests/test_sre_typed_domain_router.py

@@ -105,7 +105,7 @@ def test_sentry_container_resolves_to_exact_host110_domain_route() -> None:
     assert route["reasoning_contract"]["provider_order"] == [
         "ollama_gcp_a",
         "ollama_gcp_b",
-        "ollama_local_111",
+        "ollama_local",
     ]
     assert route["reasoning_contract"]["paid_call_allowed"] is False
 

docs/operations/sre-k3s-controlled-automation-work-items.snapshot.json

@@ -36,8 +36,31 @@
     "ordered_route": [
       "ollama_gcp_a",
       "ollama_gcp_b",
-      "ollama_local_111",
-      "gemini_api"
+      "ollama_local",
+      "gemini"
+    ],
+    "route_label": "GCP-A -> GCP-B -> host111 Ollama -> Gemini API",
+    "hops": [
+      {
+        "position": 1,
+        "provider": "ollama_gcp_a",
+        "identity": "GCP-A"
+      },
+      {
+        "position": 2,
+        "provider": "ollama_gcp_b",
+        "identity": "GCP-B"
+      },
+      {
+        "position": 3,
+        "provider": "ollama_local",
+        "identity": "host111"
+      },
+      {
+        "position": 4,
+        "provider": "gemini",
+        "identity": "Gemini API"
+      }
     ],
     "ollama_role": "primary_rca_and_action_planning",
     "gemini_role": "final_fallback_and_optional_critic_only",