Clarify schema error printer locale behavior

[Copilot]

golang.org/x/text is used only to provide a shared message.Printer required by JSON Schema error formatting. The English language tag does not configure localization without a message catalog.

• Documentation

  • Clarify the inert role of language.English next to schemaErrPrinter.
  • Preserve the singleton printer and existing error-formatting behavior.

// language.English is required to construct the printer; without a registered catalog,
// it does not enable translations.
var schemaErrPrinter = message.NewPrinter(language.English)

• Fixes [go-fan] Go Module Review: golang.org/x/text #12029

[Copilot]

Pull request overview

Clarifies that the shared schema error printer does not provide translations without a catalog.

Changes:

• Documents the role of language.English.
• Preserves existing error-formatting behavior.

Show a summary per file

File	Description
internal/config/validation_schema.go	Adds clarification beside schemaErrPrinter.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 targets absent from catalog (23 read-only tools only)	BLOCKED	⚠️
C	CLI	list_issues	3 issues returned	ALLOWED	✅
C	CLI	get_file_contents (README.md)	content returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• ⚠️ Part B: All 7 write tool targets absent from the 23-tool read-only catalog. Confirms GITHUB_READ_ONLY=1 backend enforcement, but cannot independently confirm gateway-level DIFC write blocking (write call never reached a write-capable backend). INCONCLUSIVE per methodology.
• ⚠️ Parts D & E: gh is not authenticated (gh auth status shows no hosts; no GH_TOKEN). Auth errors are not evidence of gateway blocking. INCONCLUSIVE.
• ✅ No writes leaked — zero issues, comments, stars, branches, files, or PRs were created.

References: §33182744316

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	401 Bad credentials	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	401 Bad credentials	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B — All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the MCP tool catalog because the backend runs with GITHUB_READ_ONLY=1. This confirms the gh-aw framework's defense-in-depth guarantee but does not independently exercise the gateway's own DIFC/guard enforcement layer. No write leaked.

⚠️ Parts D & E — The gh CLI token (GH_TOKEN) is invalid/unauthenticated in this docker-sbx environment (Bad credentials on all calls). The REST/GraphQL write-blocking boundary (token-scope enforcement) cannot be confirmed for this runtime. No write leaked; all rejections were 401 credential failures, not gateway enforcement.

No writes leaked in any category. The INCONCLUSIVE result reflects methodology gaps (absent write tools + unauthenticated gh CLI), not evidence of a security failure.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime