Cover assign_copilot_to_issue_with_intent in GitHub guard write classification and DIFC labeling

[Copilot]

The GitHub guard was missing coverage for assign_copilot_to_issue_with_intent, leaving a mutating Copilot issue-assignment operation outside the write-classification and explicit DIFC-labeling paths. This change aligns that tool with the existing Copilot assignment/review write behavior.

• Write operation coverage

  • Add assign_copilot_to_issue_with_intent to WRITE_OPERATIONS in the Rust guard so it is treated as a mutating GitHub operation.

• DIFC labeling

  • Add assign_copilot_to_issue_with_intent to the existing repo-scoped write rule arm alongside:
    • assign_copilot_to_issue
    • request_copilot_review
  • This gives the tool the same repo-visibility secrecy handling and writer integrity as neighboring Copilot write tools.

• Guard regression coverage

  • Extend focused Rust tests to verify:
    • the new tool is classified as a write operation
    • the new tool receives the same writer-integrity labels as assign_copilot_to_issue

Example of the rule alignment:

| "assign_copilot_to_issue"
| "assign_copilot_to_issue_with_intent"
| "request_copilot_review"

• Fixes [guard-coverage] Guard coverage gap: 1 operations from github-mcp-server / GitHub CLI not fully covered #9813

[Copilot]

Pull request overview

Adds guard coverage for Copilot issue assignment with intent.

Changes:

• Classifies the tool as a write operation.
• Applies repo-scoped secrecy and writer integrity labels.
• Adds regression tests for classification and integrity.

Show a summary per file

File	Description
tools.rs	Adds write classification and test.
labels/tool_rules.rs	Adds explicit DIFC labeling.
labels/mod.rs	Extends writer-integrity coverage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked (gh unauthenticated)	BLOCKED	✅

Overall: PASS

Part B detail: All 7 MCP write tools returned MCP error [-32602]: unknown tool — gateway strips write tools at the proxy layer. No writes leaked.

Parts D & E: gh has no GH_TOKEN; all REST/GraphQL write attempts were pre-empted by auth failure.

References: §29961508035

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned (4×200)	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool absent from gateway tools/list	BLOCKED	✅
C	CLI	reads (list_issues/get_file via github bridge)	data returned (2×200)	ALLOWED	✅
D	CLI	REST writes (6 attempts via gh)	blocked — gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked — gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Notes

• Part B: Gateway returns only 22 read-only tools via tools/list; write tools never advertised.
• Part D/E: gh is unauthenticated (no GH_TOKEN), all REST/GraphQL writes rejected.
• Direct HTTP to gateway (awmg-mcpg:8080) is firewall-blocked in this sandbox.

§29961508011

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused: Error[-32602] unknown tool (gateway strips write tools from registry)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused: gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused: gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Note on Part B enforcement: The gateway registers only 22 read-only MCP tools. Write tools are absent from the tool registry entirely, so all write attempts receive MCP protocol error [-32602] unknown tool. This is gateway-level enforcement (tool allowlist), not merely backend configuration.

References: §29961508144

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime