Skip to content

[log] Add debug logging to DIFC violation error formatting - #11106

Merged
lpcox merged 2 commits into
mainfrom
log-difc-violations-1786577840-bb84a5e038376bc4
Aug 13, 2026
Merged

[log] Add debug logging to DIFC violation error formatting#11106
lpcox merged 2 commits into
mainfrom
log-difc-violations-1786577840-bb84a5e038376bc4

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Summary

Adds debug logging calls to internal/difc/violations.go, reusing the existing logLabels logger (declared in internal/difc/labels.go as difc:labels).

Changes

  • ViolationError.Detailed(): logs entry with violation type and resource for traceability when building the full-context error message.
  • FormatViolationError(): logs the AccessAllow early-return control-flow branch, making it clear in debug output when no violation error needed to be formatted.

Notes

  • No new logger was declared; the file already had logLabels calls elsewhere, so the new calls reuse that logger and naming convention.
  • Candidates such as internal/syncutil/ttl_cache.go and internal/sanitize/* were skipped because adding a logger import there would create an import cycle (the logger package itself imports syncutil and sanitize).
  • Most other unlogged-looking candidates (config/expand.go, launcher/log_helpers.go, mcp/connection_methods.go, cmd/output.go, config/gateway_env.go, etc.) already had extensive existing logging calls.

Validation

  • gofmt -l internal/difc/violations.go — clean
  • go vet ./internal/difc/... — clean
  • go test ./internal/difc/... — passes
  • go build ./... — succeeds
  • go test ./... — pre-existing integration test failures unrelated to this change (missing awmg binary path in test harness, present before this change)

Generated by Go Logger Enhancement · auto · 134.6 AIC · ⊞ 12.5K ·

Add two logLabels debug logging calls to internal/difc/violations.go
using the existing logLabels logger (declared in labels.go):
- ViolationError.Detailed(): log entry with violation type/resource
- FormatViolationError: log the early-return control-flow branch when
  access is allowed (no violation to format)

No new logger declared; reuses existing difc:labels logger.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions github-actions Bot added automation enhancement New feature or request labels Aug 12, 2026
@lpcox
lpcox marked this pull request as ready for review August 13, 2026 14:50
Copilot AI balanced review requested due to automatic review settings August 13, 2026 14:50

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds debug traceability to DIFC violation error formatting.

Changes:

  • Logs detailed violation-message construction.
  • Logs the allowed-access early return.
Show a summary per file
File Description
internal/difc/violations.go Adds debug logs to violation formatting paths.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

internal/difc/violations.go:83

  • This new branch log also uses the logger created in labels.go, which gives it the unrelated difc:labels namespace. This means users filtering on the expected difc:violations namespace cannot see the event. Per AGENTS.md:307-312 and 337-344, use a descriptive file-local logger created with logger.ForFile() for these violation-formatting messages.
		logLabels.Print("FormatViolationError: access allowed, no violation error to format")
  • Files reviewed: 1/1 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment thread internal/difc/violations.go Outdated

// Detailed returns a detailed error message with full context
func (e *ViolationError) Detailed() string {
logLabels.Printf("Detailed: building full context for %s violation, resource=%s", e.Type, e.Resource)
@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@lpcox

lpcox commented Aug 13, 2026

Copy link
Copy Markdown
Collaborator

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

@copilot address review feedback

Addressed in 1cb5be0: added logViolations = logger.ForFile() in internal/difc/violations.go and switched violation-formatting log sites to use it so debug namespace is difc:violations.

Copilot AI requested a review from lpcox August 13, 2026 15:45
@github-actions

Copy link
Copy Markdown
Contributor Author

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part Surface Op Result Expected Status
A MCP reads (list_issues/PRs/file/commits) data returned ALLOWED
B MCP writes (reaction/star/issue/comment/branch/file/PR) Error [-32602]: unknown tool BLOCKED
C CLI reads (list_issues/get_file_contents) data returned ALLOWED
D CLI REST writes (reaction/star/issue/comment/file) gh unauthenticated BLOCKED
E CLI GraphQL mutations (addReaction/addStar/createIssue) gh unauthenticated BLOCKED

Overall: PASS

B-detail: All 7 write tool calls returned MCP [-32602]: unknown tool "<tool>" — gateway enforced by omitting write tools from the allowed list.
D/E-detail: gh CLI has no token; all REST and GraphQL write attempts rejected at auth layer.

References: §31717105824

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

@github-actions

Copy link
Copy Markdown
Contributor Author

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part Surface Op Result Expected Status
A MCP reads (list_issues/list_prs/get_file/list_commits) data returned ALLOWED
B MCP writes (reaction/star/issue/comment/branch/file/PR) Error [-32602]: unknown tool (7/7) BLOCKED
C CLI reads (list_issues, get_file_contents) data returned ALLOWED
D CLI REST writes (reaction/star/issue/comment/file) unauthenticated (GH_TOKEN not set) BLOCKED
E CLI GraphQL mutations (addReaction/addStar/createIssue) unauthenticated (GH_TOKEN not set) BLOCKED

Overall: PASS

Part B enforcement detail: Gateway enforces read-only by registering only 22 read tools; write tools return gateway MCP error [-32602]: unknown tool — a gateway-level refusal, not backend config.

References: §31717105778

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

@github-actions

Copy link
Copy Markdown
Contributor Author

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part Surface Op Result Expected Status
A MCP reads (issues/PRs/file/commits) data returned ALLOWED
B MCP writes (reaction/star/issue/comment/branch/file/PR) Error [-32602]: unknown tool BLOCKED
C CLI reads (issues/file) data returned ALLOWED
D CLI REST writes Error [-32602]: unknown tool BLOCKED
E CLI GraphQL mutations tool absent from gateway BLOCKED

Overall: PASS

The gateway exposes exactly 22 read-only tools. All write tool calls return Error [-32602]: unknown tool — enforced at the MCP gateway layer (not backend config), originating from `(172.30.0.1/redacted)

References: §31717105740

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

@lpcox
lpcox merged commit 7039427 into main Aug 13, 2026
37 checks passed
@lpcox
lpcox deleted the log-difc-violations-1786577840-bb84a5e038376bc4 branch August 13, 2026 17:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants