Add unauthenticated /reflect endpoint for live DIFC label snapshots in gateway and proxy modes#7168
Merged
Merged
Conversation
Copilot
AI
changed the title
[WIP] Add /reflect endpoint to expose agent-id to label mappings
Add unauthenticated Jun 7, 2026
/reflect endpoint for live DIFC label snapshots in gateway and proxy modes
Collaborator
|
@copilot make sure that the endpoint and its schema is clearly documented |
Contributor
Author
Addressed in |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a new runtime introspection endpoint (GET /reflect) that returns a snapshot of current DIFC agent label state (secrecy/integrity), enforcement mode, and a timestamp, and wires it up in both gateway and proxy modes.
Changes:
- Added a shared
difc.BuildReflectResponse(...)builder and response types to produce a consistent/reflectpayload with sorted tag arrays. - Registered
/reflectin gateway common endpoint wiring and implemented proxy handling (including/api/v3/reflectvia GH_HOST prefix stripping). - Added focused tests for gateway/proxy
/reflectbehavior and defensive handling of nil registry entries.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents the new /reflect endpoint and its JSON schema, including a security note. |
| internal/server/reflect.go | Implements the gateway /reflect handler. |
| internal/server/reflect_test.go | Tests gateway /reflect availability in routed + unified modes and unauthenticated access. |
| internal/server/handlers.go | Registers /reflect as a common gateway endpoint. |
| internal/proxy/handler.go | Adds proxy-mode handling for /reflect after GH_HOST prefix normalization. |
| internal/proxy/handler_test.go | Tests proxy-mode /reflect for both /reflect and /api/v3/reflect. |
| internal/difc/reflect.go | Adds shared response types and snapshot builder (BuildReflectResponse). |
| internal/difc/reflect_test.go | Adds unit tests for the reflect response builder, including nil-entry handling. |
| docs/PROXY_MODE.md | Documents proxy-mode /reflect behavior and schema. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 9/9 changed files
- Comments generated: 3
Comment on lines
+11
to
+14
| func HandleReflect(unifiedServer *UnifiedServer) http.HandlerFunc { | ||
| return func(w http.ResponseWriter, _ *http.Request) { | ||
| httputil.WriteJSONResponse(w, http.StatusOK, difc.BuildReflectResponse(unifiedServer.DIFCComponents)) | ||
| } |
Comment on lines
+115
to
+117
| // Reflect endpoint exposes a live DIFC label snapshot. | ||
| reflectHandler := HandleReflect(unifiedServer) | ||
| mux.Handle("/reflect", withResponseLogging(reflectHandler)) |
Comment on lines
+56
to
+60
| // Reflect endpoint exposes a live DIFC label snapshot. | ||
| if r.Method == http.MethodGet && rawPath == "/reflect" { | ||
| httputil.WriteJSONResponse(w, http.StatusOK, difc.BuildReflectResponse(h.server.DIFCComponents)) | ||
| return | ||
| } |
This was referenced Jun 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change adds a runtime reflection endpoint to inspect current DIFC agent label state, which was previously not exposed.
GET /reflectnow returns all known agent IDs with their secrecy/integrity labels, plus current enforcement mode and a timestamp.Shared reflect payload builder
difc.BuildReflectResponse(...)to produce a consistent snapshot shape:agentsmap (agentID -> {secrecy, integrity})mode(strict/filter/propagate)timestamp(RFC3339 UTC)Gateway support (routed + unified)
server.HandleReflect(...)./reflectin common endpoint wiring, so it is available in both gateway HTTP modes.Proxy support
GET /reflecthandling in proxy HTTP handler./api/v3/reflect).Focused coverage for reflect behavior
/reflectand/api/v3/reflect{ "agents": { "proxy": { "secrecy": ["repo:github/private-repo"], "integrity": ["approved"] }, "abc123def456": { "secrecy": [], "integrity": ["unapproved"] } }, "mode": "propagate", "timestamp": "2026-06-07T13:40:00Z" }