Downscope internal Rust guard tool helpers and centralize GitHub test scope usage

[Copilot]

This trims unnecessary public surface in the Rust guard by restricting five crate-internal tool classification helpers to pub(crate). It also removes three test-only "github" string outliers in favor of the shared scope_names::GITHUB constant.

• API surface

  • Downscoped internal helper functions in guards/github-guard/rust-guard/src/tools.rs:
    • is_write_operation
    • is_read_write_operation
    • is_merge_operation
    • is_delete_operation
    • is_blocked_tool
  • Keeps these helpers aligned with existing crate-internal visibility used by is_lock_operation and is_unlock_operation.

• Test constant consistency

  • Replaced three raw "github" literals in guards/github-guard/rust-guard/src/lib.rs tests with scope_names::GITHUB.
  • Removes scope-name duplication in assertions around writer-integrity behavior.

• Illustrative change

  // before
  pub fn is_write_operation(tool_name: &str) -> bool { ... }
  labels::writer_integrity("github", &ctx)
  
  // after
  pub(crate) fn is_write_operation(tool_name: &str) -> bool { ... }
  labels::writer_integrity(scope_names::GITHUB, &ctx)

• Fixes [rust-guard] Rust Guard: Downscope 5 pub functions in tools.rs to pub(crate) #9777

[Copilot]

Pull request overview

Restricts internal Rust guard helpers and standardizes GitHub scope references without changing behavior.

Changes:

• Downscopes five tool-classification helpers to pub(crate).
• Replaces three test literals with scope_names::GITHUB.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/tools.rs	Restricts helper visibility to the crate.
guards/github-guard/rust-guard/src/lib.rs	Uses the shared GitHub scope constant in tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/README/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	✅
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated — GH_TOKEN not set	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated — GH_TOKEN not set	BLOCKED	✅

Notes:

• Part B: Gateway returns MCP error [-32602] unknown tool for all 7 write attempts — 22 read-only tools exposed, zero write tools
• Part D/E: gh CLI unauthenticated; all REST/GraphQL writes rejected pre-flight
• Run ID: §29830718875

Overall: PASS

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (issues/file via github bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	all refused (gh unauthenticated — no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all refused (gh unauthenticated — no GH_TOKEN)	BLOCKED	✅

Notes:

• Part B: Gateway enforces read-only by exposing only 22 read tools; all write tool calls return MCP-level Error [-32602]: unknown tool — gateway enforcement (write tools stripped from exposed list).
• Parts D/E: gh CLI has no GH_TOKEN, so all REST/GraphQL write attempts fail at auth.

Overall: PASS

Run: §29830718685

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx\n\nSurface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations\nIsolation runtime: docker-sbx (KVM-isolated microVM)\n\n| Part | Surface | Op | Result | Expected | Status |\n|------|---------|----|--------|----------|--------|\n| A | MCP | reads (list_issues/list_prs/get_file/list_commits) | data returned | ALLOWED | ✅ |\n| B | MCP | writes (reaction/star/issue/comment/branch/file/PR) | Error[-32602]: unknown tool | BLOCKED | ✅ |\n| C | CLI | reads (list_issues/get_file_contents) | data returned | ALLOWED | ✅ |\n| D | CLI | REST writes (reaction/star/issue/comment/file) | rejected (gh unauthenticated) | BLOCKED | ✅ |\n| E | CLI | GraphQL mutations (addReaction/addStar/createIssue) | rejected (gh unauthenticated) | BLOCKED | ✅ |\n\nOverall: PASS\n\n> Run §29830718744

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime