feat(awooop): route post verify mcp through gateway

apps/api/tests/test_post_execution_verifier.py

@@ -23,6 +23,8 @@ import pytest
 from unittest.mock import AsyncMock, patch
 
 from src.plugins.mcp.interfaces import MCPTool, MCPToolProvider, MCPToolResult
+from src.plugins.mcp.registry import AuditedMCPToolProvider
+from src.services import post_execution_verifier as pev_module
 from src.services.post_execution_verifier import (
     PostExecutionVerifier,
     _assess_recovery,
@@ -341,6 +343,14 @@ class _FakeRegistry:
         ]
 
 
+class _DbContext:
+    async def __aenter__(self) -> object:
+        return object()
+
+    async def __aexit__(self, *_args: object) -> None:
+        return None
+
+
 class TestCollectPostStateAuditContext:
     @pytest.mark.asyncio
     async def test_collect_post_state_injects_mcp_audit_context(self):
@@ -357,3 +367,43 @@ class TestCollectPostStateAuditContext:
         assert audit_context["session_id"] == "incident:INC-TEST:post_execution"
         assert audit_context["flywheel_node"] == "verify"
         assert audit_context["agent_role"] == "post_execution_verifier"
+
+    @pytest.mark.asyncio
+    async def test_collect_post_state_routes_audited_provider_through_gateway(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+    ):
+        provider = _CaptureProvider()
+        verifier = PostExecutionVerifier()
+        audited_provider = AuditedMCPToolProvider(provider)
+        verifier._registry = _FakeRegistry(audited_provider)
+        calls: list[dict] = []
+
+        class FakeGateway:
+            def __init__(self, db: object) -> None:
+                self.db = db
+
+            async def call(self, ctx, parameters: dict) -> MCPToolResult:
+                calls.append({"ctx": ctx, "parameters": parameters, "db": self.db})
+                return MCPToolResult(
+                    success=True,
+                    execution_id="gw",
+                    output={"status": "Running"},
+                )
+
+        monkeypatch.setattr(pev_module, "get_db_context", lambda _project_id: _DbContext())
+        monkeypatch.setattr(pev_module, "McpGateway", FakeGateway)
+
+        state = await verifier._collect_post_state(_stub_incident())
+
+        assert state["kubectl_get"]["status"] == "Running"
+        assert provider.seen_parameters is None
+        assert calls
+        ctx = calls[0]["ctx"]
+        assert ctx.project_id == "awoooi"
+        assert ctx.agent_id == "post_execution_verifier"
+        assert ctx.tool_name == "kubectl_get"
+        assert ctx.trace_id == "INC-TEST"
+        assert ctx.required_scope == "read"
+        assert calls[0]["parameters"]["_mcp_audit"]["incident_id"] == "INC-TEST"
+        assert calls[0]["parameters"]["_mcp_audit"]["flywheel_node"] == "verify"