feat(policy,claude_sdk,cli,config_loader): pretooluse policy rules per agent, tool call audit, sibling imports for config

src/beaver_gateway/cli.py

@@ -59,7 +59,13 @@ from beaver_gateway.frontends.base import GatewayRuntime
 from beaver_gateway.frontends.root import build_root_app
 from beaver_gateway.mcp.internal_app import build_internal_app
 from beaver_gateway.settings import Settings
-from beaver_gateway.storage import Database, PostgresSessionStore, Usage, append_usage
+from beaver_gateway.storage import (
+    Database,
+    PostgresSessionStore,
+    Usage,
+    append_audit,
+    append_usage,
+)
 
 if TYPE_CHECKING:
     from claude_agent_sdk import McpSdkServerConfig
@@ -70,6 +76,7 @@ if TYPE_CHECKING:
     from starlette.types import ASGIApp
 
     from beaver_gateway.backends.base import Backend
+    from beaver_gateway.core.policy import ToolAudit
     from beaver_gateway.mcp.types import McpServerT
 
 
@@ -432,6 +439,27 @@ async def _build_backends(
         except Exception:  # noqa: BLE001
             _log.exception("usage write failed for %s", event.agent_name)
 
+    async def record_tool(event: ToolAudit) -> None:
+        detail = {
+            "conversation": event.conversation,
+            "kind": event.kind,
+            "tool": event.tool,
+            "decision": event.decision,
+            "reason": event.reason,
+            "brief": event.brief,
+        }
+        try:
+            async with db.session() as session:
+                await append_audit(
+                    session,
+                    actor=f"agent:{event.agent}",
+                    kind="tool_call",
+                    agent_name=event.agent,
+                    detail=detail,
+                )
+        except Exception:  # noqa: BLE001
+            _log.exception("tool audit write failed for %s", event.agent)
+
     for a in agents:
         if isinstance(a, ClaudeAgent):
             adapter = ClaudeSdkBackend(
@@ -444,6 +472,7 @@ async def _build_backends(
                 pool=pool,
                 tool_server=functools.partial(late.server, names=a.gateway_tools),
                 asker=late.ask,
+                audit_sink=record_tool,
             )
             await stack.enter_async_context(adapter)
             backends[a.name] = adapter