fix(awooop): link auto approved execution evidence

apps/api/src/api/v1/webhooks.py

@@ -1636,6 +1636,10 @@ async def _process_new_alert_background(
             # 2026-04-27 ogt + Claude Sonnet 4.6: CS2 規則引擎自動執行
             # 設計：is_rule_based=True 確定性高，滿足條件直接執行，不等人工審核
             # 安全防線：CRITICAL / destructive patterns / NO_ACTION / 空 kubectl → 全部降級 PENDING
+            _cs2_auto_approval = None
+            _cs2_executor = None
+            _cs2_exec_success: bool | None = None
+            _cs2_exec_error: str | None = None
             try:
                 from src.models.approval import ApprovalRequest, ApprovalStatus
                 from src.services.approval_execution import ApprovalExecutionService
@@ -1659,6 +1663,7 @@ async def _process_new_alert_background(
                     )
                     # 使用 DB 中剛建立的 approval.id 讓 executor 可回寫
                     _auto_approval.id = approval.id
+                    _cs2_auto_approval = _auto_approval
 
                     _cs2_executor = ApprovalExecutionService()
                     _cs2_exec_success = await _cs2_executor.execute_approved_action(_auto_approval)
@@ -1681,6 +1686,8 @@ async def _process_new_alert_background(
                         exec_success=_cs2_exec_success,
                     )
             except Exception as _auto_err:
+                _cs2_exec_success = False if _cs2_auto_approval is not None else None
+                _cs2_exec_error = str(_auto_err)
                 logger.warning(
                     "cs2_auto_execute_failed_degraded_to_pending",
                     approval_id=str(approval.id),
@@ -1712,6 +1719,23 @@ async def _process_new_alert_background(
                     error=str(_meta_err),
                 )
 
+            if _cs2_auto_approval is not None and _cs2_exec_success is not None:
+                try:
+                    _cs2_auto_approval.incident_id = incident_id
+                    _cs2_executor = _cs2_executor or ApprovalExecutionService()
+                    await _cs2_executor.finalize_auto_approved_execution(
+                        _cs2_auto_approval,
+                        success=_cs2_exec_success,
+                        error_message=_cs2_exec_error,
+                    )
+                except Exception as _cs2_finalize_err:
+                    logger.warning(
+                        "cs2_auto_execute_finalize_failed",
+                        approval_id=str(approval.id),
+                        incident_id=incident_id,
+                        error=str(_cs2_finalize_err),
+                    )
+
             _is_heartbeat = is_heartbeat_alertname(alertname)
             if can_auto_repair and not _is_heartbeat:
                 await _try_auto_repair_background(
@@ -1875,8 +1899,15 @@ async def _process_new_alert_background(
                 and "NO_ACTION" not in (analysis_result.action_title or "")
                 and is_safe_kubectl_action(_cs3_kubectl)
             )
+            _cs3_auto_approval = None
+            _cs3_executor = None
+            _cs3_exec_success: bool | None = None
+            _cs3_exec_error: str | None = None
             if _cs3_can_auto:
                 try:
+                    from src.models.approval import ApprovalRequest, ApprovalStatus
+                    from src.services.approval_execution import ApprovalExecutionService
+
                     _cs3_auto_approval = ApprovalRequest(
                         action=approval_create.action,
                         description=approval_create.description,
@@ -1893,8 +1924,17 @@ async def _process_new_alert_background(
                             else "cs3_auto_confident_execution",
                         },
                     )
+                    _cs3_auto_approval.id = approval.id
                     _cs3_executor = ApprovalExecutionService()
                     _cs3_exec_success = await _cs3_executor.execute_approved_action(_cs3_auto_approval)
+                    try:
+                        await service.update_execution_status(approval.id, _cs3_exec_success)
+                    except Exception as _cs3_upd_err:
+                        logger.warning(
+                            "cs3_auto_execute_status_update_failed",
+                            approval_id=str(approval.id),
+                            error=str(_cs3_upd_err),
+                        )
                     logger.info(
                         "cs3_llm_auto_executed",
                         approval_id=str(approval.id),
@@ -1910,6 +1950,8 @@ async def _process_new_alert_background(
                         ),
                     )
                 except Exception as _cs3_exec_err:
+                    _cs3_exec_success = False if _cs3_auto_approval is not None else None
+                    _cs3_exec_error = str(_cs3_exec_err)
                     logger.warning("cs3_llm_auto_execute_failed", error=str(_cs3_exec_err))
 
             incident_id = await create_incident_for_approval(
@@ -1937,6 +1979,23 @@ async def _process_new_alert_background(
                     error=str(_meta_err),
                 )
 
+            if _cs3_auto_approval is not None and _cs3_exec_success is not None:
+                try:
+                    _cs3_auto_approval.incident_id = incident_id
+                    _cs3_executor = _cs3_executor or ApprovalExecutionService()
+                    await _cs3_executor.finalize_auto_approved_execution(
+                        _cs3_auto_approval,
+                        success=_cs3_exec_success,
+                        error_message=_cs3_exec_error,
+                    )
+                except Exception as _cs3_finalize_err:
+                    logger.warning(
+                        "cs3_auto_execute_finalize_failed",
+                        approval_id=str(approval.id),
+                        incident_id=incident_id,
+                        error=str(_cs3_finalize_err),
+                    )
+
             root_cause = analysis_result.description or message
             estimated_downtime = blast.estimated_downtime if blast else "~30s"
             primary_responsibility = analysis_result.primary_responsibility or "COLLAB"