feat: tool call audit log

Every orchestrator tool invocation is recorded to home/{user}/tool_audit/YYYY-MM-DD.jsonl.
Each entry captures: timestamp, user, tool, args (truncated), status (ok/error/denied),
result length, and a 300-char result snippet.

- tool_audit.py: JSONL writer with per-file asyncio locks; read_recent / read_recent_all_users helpers
- tools/__init__.py: hook in call_tool() — fire-and-forget record on every dispatch
- routers/audit.py: GET /api/audit/recent and /api/audit/stats (admin-only)
- tools/files.py: add home_root() to file_read allowed roots so agents can read audit JSONL

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/tools/files.py

@@ -16,12 +16,21 @@ logger = logging.getLogger(__name__)
 
 # Directories the orchestrator is allowed to read from.
 # Paths are resolved (symlinks followed, ~ expanded) at import time.
-_ALLOWED_ROOTS: list[Path] = [
-    Path.home() / "agents_sync",
-    Path.home() / "OSIT_dev",
-    Path.home() / "DgrZone_Nextcloud",
-    Path.home() / "OSIT_Nextcloud",
-]
+def _build_allowed_roots() -> list[Path]:
+    roots = [
+        Path.home() / "agents_sync",
+        Path.home() / "OSIT_dev",
+        Path.home() / "DgrZone_Nextcloud",
+        Path.home() / "OSIT_Nextcloud",
+    ]
+    try:
+        from config import settings
+        roots.append(settings.home_root())
+    except Exception:
+        pass
+    return roots
+
+_ALLOWED_ROOTS: list[Path] = _build_allowed_roots()
 
 # Hard cap on file size to prevent accidental context blowout
 _MAX_BYTES = 50_000   # ~50 KB
@@ -221,8 +230,10 @@ DECLARATIONS = [
         name="file_read",
         description=(
             "Read a local file and return its contents. "
-            "Allowed directories: ~/agents_sync/, ~/OSIT_dev/, ~/DgrZone_Nextcloud/, ~/OSIT_Nextcloud/. "
-            "Use this to read documentation, notes, CLAUDE.md files, or config references. "
+            "Allowed directories: ~/agents_sync/, ~/OSIT_dev/, ~/DgrZone_Nextcloud/, ~/OSIT_Nextcloud/, "
+            "and the Cortex home/ directory (persona memory, tool audit logs, etc.). "
+            "Use this to read documentation, notes, CLAUDE.md files, config references, "
+            "or tool audit logs at home/{user}/tool_audit/YYYY-MM-DD.jsonl. "
             "If given a directory path, returns a directory listing instead."
         ),
         parameters=types.Schema(