feat(audit): audit human approval decisions

[topher-lo]

Summary

• emit one enriched agent_approval audit webhook event per accepted or rejected tool decision
• attribute authenticated Tracecat UI/API decisions with actor, request context, decision time, source, tool identifiers, and optional sanitized denial reason
• keep audit configuration, enrichment, deduplication, and webhook I/O outside the Temporal approval response path
• deduplicate concurrent/retried submissions with an opaque ID derived from the stable Temporal update identity
• deliver each batch through one HTTP client with four-request concurrency and a ten-second total deadline

Security and performance boundaries

• never include tool arguments, override values, prompts, credentials, or tool outputs
• omit Slack/service-originated decisions in this first PR; external actor attribution will follow separately
• preserve best-effort audit delivery semantics and shed work at bounded in-process queue limits
• expand the existing pending-approval query projection for audit-safe identifiers without adding a synchronous database query

Testing

• uv run ruff check ...
• uv run ruff format --check ...
• uv run basedpyright --warnings --threads 4
• uv run pytest tests/unit/test_agent_approval_audit.py -q --confcutdir=tests/unit (9 passed)
• focused batch delivery tests in tests/unit/test_audit_service.py (3 passed)
• signed commit hooks, including OpenAPI client generation and Python type checking

The normal database-backed suite could not run locally because Docker/PostgreSQL was unavailable; the DB-independent regression tests above passed.

---

Summary by cubic

Adds audit logging for human approval decisions in the agent and introduces batched webhook delivery to keep the approval path fast and reliable.

• New Features

  • Emit one agent_approval webhook event per accepted or rejected tool call from the UI/API; Slack/service-originated decisions are excluded for now.
  • Event data includes actor label, IP/UA, decision time, source, tool identifiers, and sanitized optional denial reason; never includes tool args, override values, prompts, credentials, or outputs.
  • Deduplicate with a stable per-update dedupe_id and Redis (24h TTL); fall back to best-effort if Redis is unavailable.
  • Run enrichment and delivery off the request path with a bounded in-process queue; batch delivery uses one httpx client, up to 4 concurrent posts, and a 10s batch deadline.

• Refactors

  • AuditService now supports batched enrichment via AuditEventInput and create_events, resolving webhook/actor/headers once and streaming through spawn_audit_batch.
  • Introduced tracecat/audit/batch.py for grouped delivery (AuditBatchDelivery, deliver_audit_batch) with pending limits.
  • Expanded the pending-approval query to include audit-safe identifiers (approval ID, tool name) and updated sanitization to allow safe keys (e.g., arguments_overridden, decision) while stripping secrets from denial_reason.

^{Written for commit 23f9281. Summary will update on new commits.}