[6a] QueryLog write path — append-only audit records

[andrmaz]

What to build

Every completed MCP query produces an immutable, append-only QueryLog record written to the database. The record captures: actor (user id), organization, department, policy decision trace, Context Bundle references (chunk/document ids used), and response metadata (latency, token counts if available). Deletion and mutation of existing log rows is not permitted.

Acceptance criteria

• Every MCP query (including denied ones) writes a QueryLog entry.
• Log entry includes actor, org, department, policy decision trace, and Context Bundle chunk/doc references.
• QueryLog rows have no update/delete paths in the application layer.
• Integration test verifies a log entry is created on every query path (allow and deny).

Blocked by

• [5b] Policy runtime evaluator #14 [5b] Policy runtime evaluator