fix(mcp): tag legacy provider calls with audit context

apps/api/tests/test_post_execution_verifier.py

@@ -22,6 +22,7 @@ import asyncio
 import pytest
 from unittest.mock import AsyncMock, patch
 
+from src.plugins.mcp.interfaces import MCPTool, MCPToolProvider, MCPToolResult
 from src.services.post_execution_verifier import (
     PostExecutionVerifier,
     _assess_recovery,
@@ -29,6 +30,7 @@ from src.services.post_execution_verifier import (
     _get_labels,
 )
 from src.services.evidence_snapshot import EvidenceSnapshot
+from src.services.mcp_tool_registry import RegisteredTool, SensorDimension
 
 
 # ─────────────────────────────────────────────────────────────────────────────
@@ -306,3 +308,52 @@ class TestCapturePreState:
             await verifier.capture_pre_execution_state(incident, snapshot)
 
         assert snapshot.pre_execution_state == {}
+
+
+class _CaptureProvider(MCPToolProvider):
+    name = "capture"
+    seen_parameters: dict | None = None
+
+    async def list_tools(self) -> list[MCPTool]:
+        return []
+
+    async def execute(self, tool_name: str, parameters: dict) -> MCPToolResult:
+        self.seen_parameters = dict(parameters)
+        return MCPToolResult(success=True, output={"status": "Running"})
+
+
+class _FakeRegistry:
+    def __init__(self, provider: _CaptureProvider) -> None:
+        self.provider = provider
+
+    def suggest_tools(self, alertname: str = "", incident_labels: dict | None = None) -> list[RegisteredTool]:
+        return [
+            RegisteredTool(
+                tool=MCPTool(
+                    name="kubectl_get",
+                    description="",
+                    input_schema={},
+                    server_name="capture",
+                ),
+                provider=self.provider,
+                dimensions=[SensorDimension.D1_K8S_STATE],
+            )
+        ]
+
+
+class TestCollectPostStateAuditContext:
+    @pytest.mark.asyncio
+    async def test_collect_post_state_injects_mcp_audit_context(self):
+        provider = _CaptureProvider()
+        verifier = PostExecutionVerifier()
+        verifier._registry = _FakeRegistry(provider)
+
+        state = await verifier._collect_post_state(_stub_incident())
+
+        assert state["kubectl_get"]["status"] == "Running"
+        assert provider.seen_parameters is not None
+        audit_context = provider.seen_parameters["_mcp_audit"]
+        assert audit_context["incident_id"] == "INC-TEST"
+        assert audit_context["session_id"] == "incident:INC-TEST:post_execution"
+        assert audit_context["flywheel_node"] == "verify"
+        assert audit_context["agent_role"] == "post_execution_verifier"