Merge remote-tracking branch 'origin/main' into codex/agent99-alert-control-20260710

apps/api/tests/test_awooop_truth_chain_service.py

@@ -18,6 +18,7 @@ from src.services.awooop_ansible_check_mode_service import (
     _automation_operation_log_incident_id,
     _build_auto_repair_execution_receipt,
     _claim_from_apply_operation_row,
+    _claim_from_stale_check_mode_row,
     _post_apply_km_path_type,
     _post_apply_verification_result,
     _record_auto_repair_execution_receipt,
@@ -28,9 +29,12 @@ from src.services.awooop_ansible_check_mode_service import (
     build_ansible_check_mode_claim_input,
     build_ansible_check_mode_command,
     claim_pending_check_modes,
+    claim_stale_pending_check_modes,
     detect_ansible_transport_blockers,
+    finalize_check_mode_claim,
     recent_ansible_transport_blockers,
     run_controlled_apply_for_claim,
+    run_pending_check_modes_once,
 )
 from src.services.awooop_truth_chain_service import (
     _ansible_playbook_roots,
@@ -1639,6 +1643,46 @@ def test_ansible_apply_operation_row_reconstructs_from_input_without_physical_co
     assert result.returncode == 0
 
 
+def test_stale_check_mode_row_is_revalidated_with_canonical_run_id() -> None:
+    source_candidate_op_id = "00000000-0000-0000-0000-000000000091"
+    claim = _claim_from_stale_check_mode_row({
+        "op_id": "00000000-0000-0000-0000-000000000092",
+        "parent_op_id": source_candidate_op_id,
+        "incident_id": "INC-20260709-46478E",
+        "input": {
+            "automation_run_id": "untrusted-old-run-id",
+            "incident_id": "INC-20260709-46478E",
+            "source_candidate_op_id": source_candidate_op_id,
+            "catalog_id": "ansible:188-momo-backup-user",
+            "catalog_playbook_path": (
+                "infra/ansible/playbooks/188-momo-backup-user.yml"
+            ),
+            "inventory_hosts": ["host_188"],
+            "risk_level": "low",
+        },
+    })
+
+    assert claim is not None
+    assert claim.op_id == "00000000-0000-0000-0000-000000000092"
+    assert claim.source_candidate_op_id == source_candidate_op_id
+    assert claim.input_payload["automation_run_id"] == source_candidate_op_id
+    assert claim.input_payload["controlled_apply_allowed"] is True
+    assert claim.playbook_path == "infra/ansible/playbooks/188-momo-backup-user.yml"
+
+
+def test_stale_check_mode_reclaim_uses_lease_lock_and_current_policy() -> None:
+    source = inspect.getsource(claim_stale_pending_check_modes)
+    run_source = inspect.getsource(run_pending_check_modes_once)
+
+    assert "FOR UPDATE SKIP LOCKED" in source
+    assert "reclaimed_at" in source
+    assert "ORDER BY check_mode.created_at DESC" in source
+    assert "stale_pending_reclaim_rejected_by_current_policy" in source
+    assert "_claim_from_stale_check_mode_row" in source
+    assert "claim_stale_pending_check_modes" in run_source
+    assert "effective_timeout_seconds + 120" in run_source
+
+
 def test_ansible_apply_receipt_backfill_queries_existing_apply_rows() -> None:
     source = inspect.getsource(backfill_missing_auto_repair_execution_receipts_once)
 
@@ -1733,6 +1777,14 @@ def test_ansible_live_controlled_apply_sends_telegram_receipt_but_backfill_does_
     assert inspect.iscoroutinefunction(_send_controlled_apply_telegram_receipt)
 
 
+def test_ansible_check_and_apply_rows_persist_canonical_automation_run_id() -> None:
+    finalize_source = inspect.getsource(finalize_check_mode_claim)
+    apply_source = inspect.getsource(run_controlled_apply_for_claim)
+
+    assert "'{automation_run_id}'" in finalize_source
+    assert '"automation_run_id": str(' in apply_source
+
+
 def test_ansible_post_apply_verifier_helpers_are_deterministic() -> None:
     assert _post_apply_km_path_type("03ca6836-1b76-4da2-8e3e-6d3b6df9254a") == (
         "ansible_apply_receipt:03ca6836"