Policy execution audit trail: first-class policy on Action + ledger snapshot at decide

[susheem-k]

Summary

Detectors/policies currently lack structured per-policy execution logs inside Governor. Actions in controls.event_log persist via governance_events_payload with {kind, reason, policy?} where policy is inferred from reason text (policy_hint_from_reason), not a first-class field on Action. Ledger snapshot at decision time is not recorded on the action.

Area: Governor._enforce, ApplyControls.event_log, governance_events_payload

Desired behavior

• Every applied action records: policy/detector name, severity, action kind, reason, signal evidence, and a ledger snapshot (e.g. cost_micros, budget_left, step_count, halt flag).
• Optional debug logs per detect → decide → apply (level-gated).
• Dashboard / run record can answer: “who tripped, why, what did the books look like?”

Acceptance sketch

• Action (or event row) carries detector / policy explicitly; no regex-on-reason.
• Halted runs show ledger snapshot at HALT in Admin/Dashboard.

Reference: docs/notes/2026-07-23-design-fix-notes.md §14