feat(awooop): route sense mcp through gateway

apps/api/src/plugins/mcp/gateway.py

@@ -388,10 +388,7 @@ class McpGateway:
         parameters: dict[str, Any],
     ) -> MCPToolResult:
         """呼叫底層 MCP provider 執行工具"""
-        registry = get_provider_registry()
-        provider = registry.get(ctx.tool_name) or registry.get(
-            tool_row.tool_name if tool_row else ctx.tool_name
-        )
+        provider = await self._resolve_provider(ctx, tool_row)
 
         # 找不到 provider → 回傳 shadow no-op
         if provider is None:
@@ -407,15 +404,57 @@ class McpGateway:
             )
 
         audit_params = dict(parameters)
+        existing_audit = (
+            parameters.get("_mcp_audit")
+            if isinstance(parameters, dict) and isinstance(parameters.get("_mcp_audit"), dict)
+            else {}
+        )
         audit_params["_mcp_audit"] = {
             "project_id": ctx.project_id,
             "agent_id": ctx.agent_id,
             "run_id": str(ctx.run_id) if ctx.run_id else None,
             "trace_id": ctx.trace_id,
+            "incident_id": existing_audit.get("incident_id") or ctx.trace_id,
+            "session_id": existing_audit.get("session_id"),
+            "flywheel_node": existing_audit.get("flywheel_node"),
+            "agent_role": existing_audit.get("agent_role") or ctx.agent_id,
             "gateway_path": "awooop_mcp_gateway",
         }
         return await provider.execute(ctx.tool_name, audit_params)
 
+    async def _resolve_provider(
+        self,
+        ctx: GatewayContext,
+        tool_row: AwoooPMcpToolRegistry | None,
+    ):
+        """Find the provider that owns ctx.tool_name.
+
+        ProviderRegistry is keyed by provider name (`kubernetes`, `ssh_host`, ...),
+        while GatewayContext intentionally uses the governed tool name
+        (`kubectl_get`, `ssh_diagnose`, ...).  Scan provider tool manifests as the
+        compatibility bridge until registry exposes a first-class tool index.
+        """
+        registry = get_provider_registry()
+        direct = registry.get(ctx.tool_name)
+        if direct is not None:
+            return direct
+
+        lookup_name = tool_row.tool_name if tool_row else ctx.tool_name
+        for provider in registry.all():
+            try:
+                tools = await provider.list_tools()
+            except Exception as exc:
+                logger.debug(
+                    "mcp_gateway_provider_manifest_skipped",
+                    provider=getattr(provider, "name", None),
+                    tool_name=lookup_name,
+                    error=str(exc),
+                )
+                continue
+            if any(tool.name == lookup_name for tool in tools):
+                return provider
+        return None
+
     # ── Audit log ─────────────────────────────────────────────────────────────
 
     async def _write_audit(
@@ -443,6 +482,15 @@ class McpGateway:
                     json.dumps(result.output, sort_keys=True, default=str).encode()
                 ).hexdigest()
 
+            gate_payload = {
+                **gate_result.as_dict(),
+                "schema_version": "awooop_mcp_gateway_audit_v1",
+                "gateway_path": "awooop_mcp_gateway",
+                "policy_enforced": True,
+                "is_shadow": ctx.is_shadow,
+                "required_scope": ctx.required_scope,
+            }
+
             audit = AwoooPMcpGatewayAudit(
                 project_id=ctx.project_id,
                 run_id=ctx.run_id,
@@ -452,7 +500,7 @@ class McpGateway:
                 tool_name=ctx.tool_name,
                 input_hash=input_hash,
                 output_hash=output_hash,
-                gate_result=gate_result.as_dict(),
+                gate_result=gate_payload,
                 result_status=result_status,
                 block_gate=block_gate,
                 block_reason=block_reason,