fix(agent): bind pre-decision evidence to runtime

apps/api/tests/test_agent_loop_foundation.py

@@ -139,6 +139,38 @@ async def test_audited_provider_strips_internal_audit_context(monkeypatch):
     assert audit_calls[0]["incident_id"] == "INC-1"
 
 
+@pytest.mark.asyncio
+async def test_audited_provider_does_not_duplicate_first_class_gateway_audit(monkeypatch):
+    audit_calls = []
+
+    async def fake_record_mcp_call(**kwargs):
+        audit_calls.append(kwargs)
+
+    monkeypatch.setattr(
+        "src.services.mcp_audit_service.record_mcp_call",
+        fake_record_mcp_call,
+    )
+
+    provider = FakeProvider()
+    audited = AuditedMCPToolProvider(provider)
+
+    result = await audited.execute(
+        "kubectl_get",
+        {
+            "resource": "pods",
+            "_mcp_audit": {
+                "gateway_path": "awooop_mcp_gateway",
+                "agent_role": "pre_decision_investigator",
+                "incident_id": "INC-GW-1",
+            },
+        },
+    )
+
+    assert result.success is True
+    assert provider.calls == [("kubectl_get", {"resource": "pods"})]
+    assert audit_calls == []
+
+
 @pytest.mark.asyncio
 async def test_agent_tool_executor_blocks_disallowed_tool():
     restart_tool = _tool("kubernetes", "kubectl_restart")