[log] Add debug logging to mount policy validation paths

[github-actions]

Summary

Adds targeted debug logging to internal/launcher/mount_policy.go in the security-critical mount validation code paths (ValidateMount and ValidateContainerArgs). Previously these functions had no logging on their reject/allow decisions, making it hard to troubleshoot why a container-backed MCP server's mount request was denied.

Changes

• Reuses the existing logMountPolicy logger (logger.ForFile(), namespace launcher:mount_policy) — no new logger declared.
• ValidateMount:
  • Logs when a host source cannot be canonicalized.
  • Logs when a mount is rejected due to read-write access not permitted under a matched root.
  • Logs when a mount is allowed, including the matched root and writable flag.
  • Logs when a mount is rejected because the source falls outside all allowed roots.
• ValidateContainerArgs:
  • Logs when a bypass-prone container option (e.g. --privileged, --mount) is rejected.

No log arguments compute anything or cause side effects; all values are already-computed local variables.

Validation

• go build ./... — succeeds
• go vet ./internal/launcher/... — clean
• go test ./internal/launcher/... — passes (ok)

(Note: local Go toolchain was 1.24.13 vs go.mod's required 1.26.4; used GOTOOLCHAIN=auto to let Go auto-fetch the required toolchain for validation.)

Generated by Go Logger Enhancement · auto · 35.3 AIC · ⊞ 13K · ◷

[Copilot]

🟢 Approval recommended

The logging is correctly scoped, uses the existing logger, and does not alter validation behavior.

Pull request overview

Adds targeted debug logging for mount-policy validation decisions.

Changes:

• Logs mount allow/reject decisions and matched roots.
• Logs rejected container options that could bypass mount policy.

File summaries

File	Description
internal/launcher/mount_policy.go	Adds debug logs to mount and container-argument validation paths.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 6 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the exposed MCP tool catalog (23 read-only tools only). This confirms gh-aw's GITHUB_READ_ONLY=1 backend defense-in-depth, but does NOT independently exercise mcpg's own DIFC/guard enforcement layer — the write calls never reached a write-capable backend. Per methodology: INCONCLUSIVE, not PASS.

⚠️ Parts D & E: gh is not authenticated in this environment (You are not logged into any GitHub hosts). All REST write and GraphQL mutation attempts are structurally unauthenticated — 401s would not confirm token-scope boundary enforcement. All D/E rows INCONCLUSIVE.

No writes succeeded or leaked. No artifact was created.

References: §33220361567

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor (runsc)

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pulls, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool not found (absent from catalog)	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Notes:

• Part B: All 7 write tools absent from MCP catalog (backend runs with GITHUB_READ_ONLY=1). This confirms gh-aw's defense-in-depth guarantee. Gateway-level DIFC/guard enforcement could not be independently confirmed via this surface (structural limitation of this test harness — write tools never registered). No writes leaked.
• Parts D & E: gh CLI is not authenticated in this environment (GH_TOKEN not set). Token-scope boundary cannot be validated in this run. No writes attempted.
• No write succeeded; the overall result is INCONCLUSIVE (not FAIL) because the gaps are methodology limitations, not enforcement failures.

References: §33220361569

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues	3 issues returned	ALLOWED	✅
A2	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A3	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A4	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 tools absent from catalog	BLOCKED	⚠️
C1	CLI	list_issues	data returned	ALLOWED	✅
C2	CLI	get_file_contents	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated (401)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated (401)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 6 targeted write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the MCP tool catalog (backend runs with GITHUB_READ_ONLY=1). This confirms the backend read-only defense-in-depth, but does not independently confirm gateway-level DIFC/guard enforcement — per test methodology, recorded as INCONCLUSIVE.

⚠️ Parts D & E: gh is not authenticated in this docker-sbx environment (GH_TOKEN is invalid — 401 Bad credentials). All REST and GraphQL write attempts would receive 401 regardless of gateway policy. Cannot validate the token-scope boundary in this run — all D/E rows are INCONCLUSIVE due to authentication gap.

No writes leaked. No FAIL condition.

🔒 Read-only stress test by workflow run 33220361568

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime