fix(mcp): audit approved ssh execution path

apps/api/src/services/approval_execution.py

@@ -685,10 +685,36 @@ class ApprovalExecutionService:
             )
 
         # 呼叫 SSH MCP Provider
+        # 2026-05-06 Codex: approved execution 是高風險「實際執行」路徑。
+        # 在 AwoooP MCP Gateway 完全接管前，至少必須經過 AuditedMCPToolProvider
+        # 寫入 durable mcp_audit_log，並標記這仍是 legacy direct provider path。
         from src.plugins.mcp.providers.ssh_provider import SSHProvider
-        provider = SSHProvider()
+        from src.plugins.mcp.registry import AuditedMCPToolProvider
+
+        provider = AuditedMCPToolProvider(SSHProvider())
+        params_with_audit = {
+            **params,
+            "_mcp_audit": {
+                "session_id": f"approval:{approval.id}",
+                "incident_id": approval.incident_id,
+                "agent_role": "approval_executor",
+                "flywheel_node": "execute",
+                "gateway_path": "legacy_direct_provider",
+            },
+        }
         try:
-            mcp_result = await provider.execute(tool_name=tool_name, parameters=params)
+            logger.warning(
+                "mcp_gateway_legacy_direct_provider_path",
+                approval_id=str(approval.id),
+                incident_id=approval.incident_id,
+                tool=tool_name,
+                host=host,
+                reason="awooop_gateway_not_enforced_for_legacy_approval_execution",
+            )
+            mcp_result = await provider.execute(
+                tool_name=tool_name,
+                parameters=params_with_audit,
+            )
             duration_ms = int((time.time() - start) * 1000)
             success = bool(mcp_result.success)
             return ExecutionResult(