mrhid6
cbf929fe2d
Every early return from a write-tool handler skipped both the tool's own LogCall and transport.go's gated LogCall (which only fires for reads), so a blocked mutation attempt left no audit trail. registerSDKTool now routes every write-tool error through LogDenied (fan-out and tag-scope refusals, by gate name) or LogFailure (everything else), keeping the successful-write path logging its own resolved server count exactly as before. Also close a live scope gap surfaced while reviewing this: POST /api/keys/:id/assign called services.AssignKey with an unscoped GetServer lookup, so a tag-restricted token could assign a key to a server outside its restriction. The handler now resolves the target through GetServerScoped first, matching its sibling revoke route, and the route is recorded in serverScopedRoutes.