Method RecordMemoryWriteRejected

internal/memory/decision.go:424–462

RecordMemoryWriteRejected emits an audit event for denied direct write attempts.

(ctx context.Context, event WriteRejectedEvent)

// RecordMemoryWriteRejected emits an audit event for denied direct write attempts.
func (s *Store) RecordMemoryWriteRejected(ctx context.Context, event WriteRejectedEvent) error {
	if ctx == nil {
		return errors.New("memory: write rejection context is required")
	}
	if s == nil || s.catalog == nil {
		return nil
	}
	metadata := map[string]string{
		decisionMetadataReasonKey: strings.TrimSpace(event.Reason),
		"tool_id":                 strings.TrimSpace(event.ToolID),
	}
	payload, err := json.Marshal(metadata)
	if err != nil {
		return fmt.Errorf("memory: encode write rejection event metadata: %w", err)
	}
	return s.catalog.withCatalogWriteTx(ctx, "memory write rejection event insert", func(tx *storepkg.WriteTx) error {
		if _, err := tx.ExecContext(
			ctx,
			`INSERT INTO memory_events (
				op, scope, agent_name, agent_tier, workspace_id, session_id,
				actor_kind, decision_id, target_id, metadata, ts_ms
			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
			memoryEventWriteRejected,
			nullStringForEmpty(event.Scope.Normalize()),
			nullStringForEmpty(event.AgentName),
			nullStringForEmpty(string(event.AgentTier.Normalize())),
			nullStringForEmpty(event.WorkspaceID),
			nullStringForEmpty(event.SessionID),
			nullStringForEmpty(event.ActorKind),
			nil,
			nullStringForEmpty(event.TargetID),
			string(payload),
			timeToUnixMillis(time.Now().UTC()),
		); err != nil {
			return fmt.Errorf("memory: insert write rejection event: %w", err)
		}
		return nil
	})
}

func (d storedDecision) record() DecisionRecord {
	return DecisionRecord{