feat(bookkeeping): agent attribution into the immutable ledger layer (P0-1) (#678)

* feat(bookkeeping): agent attribution into the immutable ledger layer

Close the three attribution gaps left after 20260618120001 (which made
commit_method record 'api_key' for MCP-relayed approvals):

- journal_entries gains nullable committed_actor_type/committed_actor_label,
  stamped by commit_journal_entry in the same draft->posted UPDATE that
  writes commit_method. The RPC gains p_actor_type/p_actor_label
  (DEFAULT NULL; prior signature dropped first to avoid PostgREST overload
  ambiguity, same technique as 20260421140000).
- write_audit_log now populates audit_log.actor_type/actor_label from
  transaction-local gnubok.actor_* GUCs set by the RPC (the established
  gnubok.allow_delete pattern). Unset GUCs COALESCE to 'user' — byte-
  identical to the column's previous effective DEFAULT for every
  pre-existing write path.
- commitPendingOperation accepts opts.actor and runs the entire executor
  inside an AsyncLocalStorage runWithActor() scope read by commitEntry(),
  so EVERY journal commit an operation makes is attributed — closing the
  documented "commitMethod only reaches create_voucher" gap. MCP approve
  passes the api_key actor + key label; web single/bulk approve pass the
  user + email.

Known limitation (documented): reverseEntry posts reversal vouchers via
direct PostgREST writes, not the commit RPC — reversals keep NULL
attribution until that path is RPC-ified (follow-up).

pg-real coverage: lib/bookkeeping/__tests__/commit-actor.pg.test.ts
(RPC param stamping, audit GUC read, transaction-locality, CHECK
rejection, immutability of the new columns, single-signature guard).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(bookkeeping): split actor-context so client bundles never see node:async_hooks

CI core-only build failed: engine.ts is reachable from client component
bundles (invoices/[id] page), and the static node:async_hooks import in
actor-context.ts cannot be chunked for the browser. Split the module:

- actor-context.ts (isomorphic): CommitActor type + a storage registry +
  getActor(). In a client bundle the registry stays empty and getActor()
  returns undefined — identical to the server-side no-scope default.
- actor-context-node.ts (server-only): owns the AsyncLocalStorage, binds it
  into the registry on import, exports runWithActor(). Imported only by the
  approval paths (commit.ts), which are never client-reachable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

extensions/general/mcp-server/__tests__/pending-operations-tools.test.ts

@@ -109,7 +109,13 @@ describe('gnubok_approve_pending_operation', () => {
     // the resolution silently fails and we fall back to just commitMethod).
     // An api_key actor records 'api_key' in the immutable layer — MCP-relayed
     // acknowledgment, not a first-party human session (vision §8 P0-1).
-    expect(commitSpy.mock.calls[0][4]).toMatchObject({ commitMethod: 'api_key' })
+    // The actor option drives the runWithActor() scope inside
+    // commitPendingOperation so EVERY journal commit in the op is attributed
+    // (committed_actor_* + audit_log, migration 20260619120000).
+    expect(commitSpy.mock.calls[0][4]).toMatchObject({
+      commitMethod: 'api_key',
+      actor: { type: 'api_key' },
+    })
     expect(result.status).toBe('committed')
     expect(result.operation_id).toBe('op-1')
     expect(result.data?.invoice_id).toBe('inv-1')
@@ -137,7 +143,10 @@ describe('gnubok_approve_pending_operation', () => {
         { type: actorType }
       )
 
-      expect(commitSpy.mock.calls[0][4]).toMatchObject({ commitMethod: expected })
+      expect(commitSpy.mock.calls[0][4]).toMatchObject({
+        commitMethod: expected,
+        actor: { type: actorType },
+      })
     }
   )
 

extensions/general/mcp-server/server.ts

@@ -8615,10 +8615,11 @@ export const tools: McpTool[] = [
       // for first-party agent surfaces (e.g. in-app agent chat) once they
       // commit through this layer with a distinguishable actor type.
       //
-      // Note: commitPendingOperation currently threads commitMethod into the
-      // journal only for create_voucher ops (pre-existing); other operation
-      // types keep their per-handler defaults, with this approval's actor
-      // recorded in processing_history below either way.
+      // commitMethod reaches the journal only for create_voucher ops
+      // (pre-existing); the actor option below covers EVERY journal commit
+      // this operation makes via the runWithActor() scope inside
+      // commitPendingOperation, stamping journal_entries.committed_actor_*
+      // and the audit_log COMMIT row (migration 20260619120000).
       const commitMethod =
         actor?.type === 'api_key' ? ('api_key' as const) : ('user_accept' as const)
 
@@ -8627,7 +8628,14 @@ export const tools: McpTool[] = [
         userId,
         companyId,
         operation,
-        { commitMethod, ...(userEmail ? { userEmail } : {}) }
+        {
+          commitMethod,
+          actor: {
+            type: actor?.type === 'api_key' ? 'api_key' : 'user',
+            ...(actor?.label ? { label: actor.label } : {}),
+          },
+          ...(userEmail ? { userEmail } : {}),
+        }
       )
 
       // Audit the MCP-initiated approval. Failure must not break the user