pdp: send invocation_id so the platform verdict attributes to the turn

[initializ-mk]

Issue 2 of 2 (forge half)

The platform-written tool_call_decided event (security-next) landed in the console's "unattributed events" bucket, because it had no invocation_id — while this agent's own pdp_decision for the same call was attributed.

Root cause: the PDP resolver's decide request didn't carry the turn's correlation id, so security-next had nothing to stamp.

Fix

Send InvocationID = hctx.CorrelationID in the decide request — the same source emitPDPDecision uses for the agent-side pdp_decision event — so the platform verdict and the agent-side record carry an identical invocation_id and group together in the console's invocation timeline.

Pairs with

• security-next#30: PDPDecideRequest.invocation_id + writePDPAudit stamps it on the event.
• console-next#88: renders the subtext for these event types (Issue 1).

Test

TestPDPResolver_Allow now asserts the decide request carries invocation_id (corr-1, the hook correlation id) + session (task-1). go build / vet / runtime tests green.

[initializ-mk]

Review — send invocation_id so the platform verdict attributes to the turn

Correct, minimal, test-backed. CI all green (Build ×6, Integration, Lint, Test).

• Same-source attribution verified. The new InvocationID: hctx.CorrelationID in the decide request is the identical source emitPDPDecision uses for the agent-side pdp_decision event (CorrelationID: hctx.CorrelationID), so the platform tool_call_decided and this agent's record carry the same invocation_id and group in the console timeline — fixing the "unattributed events" bucket.
• No enforcement change. Purely additive to the request body; the fail-closed logic, deny/defer paths, and single-retry from #399/#401 are untouched. Wire field is invocation_id,omitempty (matches security-next#30), and the test now asserts invocation_id=corr-1 + session=task-1.

Non-blocking note: the go.work.sum additions are unrelated to the 2-line resolver change — all 18 are /go.mod checksum lines (no h1: content hashes), i.e. plain go work sync housekeeping that doesn't select or change any module version. Harmless, just noise here; ideally it'd be a separate housekeeping commit (or a line in the PR body noting it's sync output) so it doesn't read as a dependency change.

LGTM from my side.

[initializ-mk]

Verified this is the same source emitPDPDecision stamps on the agent-side pdp_decision (CorrelationID: hctx.CorrelationID), so the platform verdict and the agent record share an identical invocation_id and group together — exactly the attribution fix intended. No change to the fail-closed enforcement path. 👍

[initializ-mk]

Dropped the unrelated go.work.sum changes (352d21f) — the PR is now just the 2-line resolver change + its test. Confirmed all 18 were /go.mod checksum lines with zero h1: content hashes, i.e. go work sync housekeeping that selects no module version; they get regenerated on any in-workspace go build/go test (per-module CI doesn't touch go.work.sum, which is why main is clean), so they don't belong in this change. Thanks for the LGTM.

[initializ-mk]

Re-review — amended to 352d21f. The go.work.sum note is addressed; CI all green (Build ×6, Integration, Lint, Test).

The unrelated go work sync churn is dropped — the PR is now exactly the two files that matter (pdp_resolver.go + pdp_resolver_test.go), and the workspace-level Build across all six platforms stays green, confirming those checksum lines weren't needed.

The core attribution fix is unchanged and intact: InvocationID: hctx.CorrelationID on the decide request (same source as emitPDPDecision's pdp_decision), wire field invocation_id,omitempty, with the test asserting invocation_id=corr-1 + session=task-1.

LGTM — good to merge from my side.