Add regression coverage for pull_request_read DIFC labeling

[Copilot]

pull_request_read is a canonical PR read surface and must retain the same repo-scoped secrecy and PR-aware integrity handling as get_pull_request.

• Regression coverage
  • Add a focused test asserting pull_request_read produces identical labels and descriptor to get_pull_request.
  • Protects the explicit apply_tool_labels PR match arm from future inventory or refactoring drift.

assert_eq!(actual, expected);
assert_eq!(actual.2, "pr:github/copilot#123");

• Fixes [guard-coverage] Guard coverage gap: 1 operations from github-mcp-server / GitHub CLI not fully covered #10703

[Copilot]

Pull request overview

Adds regression coverage for DIFC labeling parity between pull_request_read and get_pull_request.

Changes:

• Compares both tools’ labels and descriptors.
• Verifies the PR descriptor format.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/mod.rs	Adds the labeling parity regression test.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 blocked by gateway manifest	BLOCKED	✅
C	CLI	reads (issues/file via github proxy)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	all 6 blocked (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all 3 blocked (no GH_TOKEN)	BLOCKED	✅

Part B enforcement detail: Gateway exposes only 22 read-only tools in its manifest (get_*, list_*, search_*, *_read). All write tools are absent — attempting any write tool returns Error: Unknown command from the gateway bridge (gateway-level enforcement, not backend-level).

Overall: PASS

References: §31055085681

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool / not registered	BLOCKED	✅
C	CLI	reads (github list_issues, list_PRs, get_file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Notes:

• Part B: Gateway registers only 22 read-only MCP tools; all write tool calls return Error [-32602]: unknown tool. Gateway enforces read-only at the MCP protocol layer.
• Parts D & E: gh CLI has no GH_TOKEN — all REST and GraphQL write attempts fail before reaching the API. Combined enforcement: mcpg (MCP read-only) + unauthenticated gh (REST/GraphQL read-only).
• No writes succeeded at any surface.

Overall: PASS

Run: §31055085692

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_prs, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from gateway manifest	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked: gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked: gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Part B detail: The gateway advertises exactly 22 read-only tools via tools/list; no write tools are exposed. All 7 write attempts return Unknown command from the CLI bridge — enforced at gateway tool-advertisement layer.

Part D/E detail: gh CLI has no GH_TOKEN set, blocking all REST and GraphQL writes before reaching GitHub API.

References: §31055085637

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime