feat(vault-mcp): add audit log, command allowlist, and MCP tool defs

- Zig FFI: audit ring buffer (128 entries), command allowlist with
  prefix matching, enforcement toggle. All thread-safe via mutex.
- V adapter: /vault/audit and /vault/audit/raw endpoints for PanLL
  panel log-stream widget. Allowlist add/enforce/status endpoints.
- MCP tools: 5 tool definitions (execute, list, status, verify, audit)
  for BoJ's MCP SSE transport surface.
- Idris2 ABI: AuditEntry record, AllowlistEntry type, C-ABI exports.
- Tests: audit ring buffer, allowlist enforcement, blocked commands.

The zero-knowledge invariant is preserved: audit entries record hints
and action types only — never actual credential values.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

cartridges/vault-mcp/abi/VaultMcp/SafeSecrets.idr

@@ -233,3 +233,47 @@ toolRequiresUnlock ToolVaultVerify  = True
 export
 toolCount : Nat
 toolCount = 5
+
+-- ---------------------------------------------------------------------------
+-- Audit log types
+-- ---------------------------------------------------------------------------
+
+||| An audit log entry records a vault operation with its outcome.
+||| The audit ring buffer retains the most recent MAX_AUDIT_ENTRIES entries.
+||| Credential values are NEVER recorded — only hints and action types.
+public export
+record AuditEntry where
+  constructor MkAuditEntry
+  timestamp      : Int
+  action         : VaultAction
+  credentialHint : CredentialHint
+  resultCode     : Int
+  agentId        : String
+
+-- ---------------------------------------------------------------------------
+-- Command allowlist
+-- ---------------------------------------------------------------------------
+
+||| A command prefix pattern in the AI agent allowlist.
+||| When enforcement is enabled, vault/execute rejects commands not matching
+||| any registered prefix. This prevents AI agents from running arbitrary
+||| commands with vault-injected credentials.
+public export
+data AllowlistEntry = MkAllowlistEntry String
+
+||| Extract the pattern string for FFI serialisation.
+export
+allowlistPattern : AllowlistEntry -> String
+allowlistPattern (MkAllowlistEntry s) = s
+
+||| C-ABI export for audit entry count query.
+export
+vault_mcp_audit_count : Int
+
+||| C-ABI export for allowlist add.
+export
+vault_mcp_allowlist_add : String -> Int -> Int
+
+||| C-ABI export for allowlist enforcement toggle.
+export
+vault_mcp_allowlist_enforce : Int -> ()

cartridges/vault-mcp/adapter/vault_mcp_adapter.v

@@ -28,6 +28,12 @@ fn C.vault_mcp_rotate(hint_ptr &u8, hint_len int) int
 fn C.vault_mcp_read_result(out_ptr &u8, max_len int) int
 fn C.vault_mcp_read_error(out_ptr &u8, max_len int) int
 fn C.vault_mcp_reset()
+fn C.vault_mcp_audit_count() int
+fn C.vault_mcp_audit_entry(index int) int
+fn C.vault_mcp_allowlist_add(pattern_ptr &u8, pattern_len int) int
+fn C.vault_mcp_allowlist_enforce(enabled int)
+fn C.vault_mcp_allowlist_status() int
+fn C.vault_mcp_allowlist_count() int
 
 // ---------------------------------------------------------------------------
 // Type definitions (matching Zig/Idris2 exactly)
@@ -245,3 +251,103 @@ pub fn can_transition(from int, to int) TransitionResponse {
 pub fn reset() {
 	C.vault_mcp_reset()
 }
+
+// ---------------------------------------------------------------------------
+// Audit log
+// ---------------------------------------------------------------------------
+
+/// Audit log entry returned from the ring buffer.
+struct AuditEntry {
+	timestamp       i64
+	action          string
+	credential_hint string
+	result          string
+	agent           string
+}
+
+/// GET /vault/audit — query recent vault operations from the audit ring buffer.
+/// Returns up to `max_entries` most recent entries (0 = most recent first).
+pub fn vault_audit(max_entries int) []AuditEntry {
+	count := C.vault_mcp_audit_count()
+	limit := if max_entries > 0 && max_entries < count { max_entries } else { count }
+
+	mut entries := []AuditEntry{cap: limit}
+	for i in 0 .. limit {
+		n := C.vault_mcp_audit_entry(i)
+		if n > 0 {
+			raw := read_result()
+			// Parse the JSON line from the result buffer
+			// The FFI returns JSON like: {"timestamp":..., "action":..., ...}
+			entries << AuditEntry{
+				timestamp: 0
+				action: ''
+				credential_hint: ''
+				result: ''
+				agent: ''
+			}
+			// For now, store raw JSON; structured parse deferred to V json.decode
+			if entries.len > 0 {
+				entries[entries.len - 1] = AuditEntry{
+					timestamp: 0
+					action: raw
+					credential_hint: ''
+					result: ''
+					agent: ''
+				}
+			}
+		}
+	}
+	return entries
+}
+
+/// GET /vault/audit/raw — return audit entries as raw JSON lines.
+/// This is the preferred endpoint for the PanLL panel log-stream widget.
+pub fn vault_audit_raw(max_entries int) string {
+	count := C.vault_mcp_audit_count()
+	limit := if max_entries > 0 && max_entries < count { max_entries } else { count }
+
+	mut lines := []string{cap: limit}
+	for i in 0 .. limit {
+		n := C.vault_mcp_audit_entry(i)
+		if n > 0 {
+			lines << read_result()
+		}
+	}
+	return lines.join('\n')
+}
+
+// ---------------------------------------------------------------------------
+// Command allowlist (AI agent safety)
+// ---------------------------------------------------------------------------
+
+/// POST /vault/allowlist/add — add a command prefix to the AI agent allowlist.
+/// Commands matching this prefix will be permitted by vault/execute.
+/// Example: "git push" allows "git push origin main" etc.
+pub fn vault_allowlist_add(pattern string) !string {
+	result := C.vault_mcp_allowlist_add(pattern.str, pattern.len)
+	return match result {
+		0 { 'added: ${pattern}' }
+		-1 { return error('allowlist is full') }
+		-3 { return error('invalid pattern') }
+		else { return error('unknown error (code ${result})') }
+	}
+}
+
+/// POST /vault/allowlist/enforce — enable or disable allowlist enforcement.
+/// When enabled, vault/execute rejects commands not matching any allowlist prefix.
+pub fn vault_allowlist_enforce(enabled bool) {
+	C.vault_mcp_allowlist_enforce(if enabled { 1 } else { 0 })
+}
+
+/// GET /vault/allowlist/status — query allowlist enforcement state.
+struct AllowlistStatus {
+	enforced bool
+	count    int
+}
+
+pub fn vault_allowlist_status() AllowlistStatus {
+	return AllowlistStatus{
+		enforced: C.vault_mcp_allowlist_status() == 1
+		count: C.vault_mcp_allowlist_count()
+	}
+}