feat(awooop): route sense mcp through gateway

apps/api/src/services/pre_decision_investigator.py

@@ -32,6 +32,9 @@ from typing import TYPE_CHECKING, Any
 
 import structlog
 
+from src.db.base import get_db_context
+from src.plugins.mcp.gateway import GatewayContext, McpGateway
+from src.plugins.mcp.registry import AuditedMCPToolProvider
 from src.services.evidence_snapshot import EvidenceSnapshot
 from src.services.mcp_audit_context import with_mcp_audit_context
 from src.services.mcp_tool_registry import RegisteredTool, SensorDimension, get_mcp_tool_registry
@@ -332,7 +335,7 @@ class PreDecisionInvestigator:
                 agent_role="pre_decision_investigator",
             )
             result = await asyncio.wait_for(
-                reg.provider.execute(tool_name, audited_params),
+                self._execute_tool(reg, tool_name, audited_params, snapshot.incident_id),
                 timeout=MCP_TOOL_TIMEOUT_SEC,
             )
 
@@ -376,6 +379,34 @@ class PreDecisionInvestigator:
             except Exception:
                 pass
 
+    async def _execute_tool(
+        self,
+        reg: RegisteredTool,
+        tool_name: str,
+        audited_params: dict[str, Any],
+        incident_id: str,
+    ):
+        """Route production audited providers through AwoooP MCP Gateway.
+
+        Tests and manual injections can still pass a raw provider; production
+        registry entries are `AuditedMCPToolProvider` and must now leave a
+        first-class gateway audit row instead of only a legacy bridge row.
+        """
+        if not isinstance(reg.provider, AuditedMCPToolProvider):
+            return await reg.provider.execute(tool_name, audited_params)
+
+        async with get_db_context("awoooi") as db:
+            ctx = GatewayContext(
+                project_id="awoooi",
+                agent_id="pre_decision_investigator",
+                tool_name=tool_name,
+                trace_id=incident_id,
+                is_shadow=True,
+                environment={"env": "prod"},
+                required_scope="read",
+            )
+            return await McpGateway(db).call(ctx, audited_params)
+
 
 async def _log_mcp_call_to_timeline(
     snapshot_incident_id: str | None,