[log] Add debug logging to guard session lifecycle in guard_init.go

[github-actions]

Summary

Adds meaningful debug-level logging to internal/server/guard_init.go, reusing the file's existing logGuardInit logger (logger.ForFile()), which was declared but underused.

Changes

• validateSafeOutputsGuards: logs why validation was skipped (DIFC disabled / not strict mode / no non-noop source guard) and whether validation ultimately passed or failed.
• guardForSession: logs creation of a new isolated per-session guard instance in multi-agent mode, including the (hashed) session ID, server ID, and template guard name.
• closeSessionGuards: logs how many sessions' isolated guard instances are being closed on shutdown/cleanup.

These paths previously had no debug tracing despite managing non-trivial multi-agent guard state (per-session guard instantiation/teardown and a security-relevant validation gate), making them harder to troubleshoot.

Validation

• gofmt -l — clean
• go build -o awmg — succeeds
• go vet ./internal/server/... — clean
• go test ./internal/server/... — passes
• make agent-finished — all Go build/vet/gofmt/unit/integration tests pass. The only failing step is the Rust guard unit test stage, which fails solely due to a sandboxed-network crates.io registry connection error (HTTP 403 on CONNECT tunnel) unrelated to this change.

Notes

No side-effecting log arguments were added; all logged values (session ID hash, server ID, guard name, session count) are already computed by the surrounding code for other purposes.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• example.com
• index.crates.io
• nonexistent.local
• slow.example.com
• thishostdoesnotexist12345.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"
    - "index.crates.io"
    - "nonexistent.local"
    - "slow.example.com"
    - "thishostdoesnotexist12345.com"

See Network Configuration for more information.

Generated by Go Logger Enhancement · copilot · auto · 182.6 AIC · ⊞ 12.8K · ◷

[Copilot]

Copilot review overview

🟢 Approval recommended

The reviewed logging changes introduce no unresolved issues.

Review effort: Balanced
Findings: None

What changed in this PR

Adds debug logging for safe-output validation and per-session guard lifecycle management.

Changes:

• Logs validation skips, failures, and successes.
• Logs isolated guard creation with hashed session IDs.
• Logs session guard cleanup counts.

File	Description
internal/​server/​guard_init.go	Adds guard validation and lifecycle debug logging.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (add_issue_comment/star_repository/issue_write/create_branch/create_or_update_file/create_pull_request)	all 6 write tools absent from exposed catalog (only 23 read-only tools registered)	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned via gateway-backed github CLI on PATH	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated ("not logged into any GitHub hosts") — no probes attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — no probes attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked through any surface. The ⚠️ rows are gaps in this run's methodology, not confirmed enforcement:

• Part B: all 6 target write tools are absent from the tool catalog entirely (gh-aw's tools.github: always sets GITHUB_READ_ONLY=1 backend-side), so no gateway-level refusal could be exercised on this run.
• Parts D/E: gh CLI is not authenticated in this environment, so REST/GraphQL write probes against GitHub could not be attempted.

Part A and Part C (all reads) passed cleanly with data returned on every call.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gvisor

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• Part A/C: list_issues, list_pull_requests, get_file_contents, list_commits all returned data via the gateway-proxied github CLI. No read failures.
• Part B: the exposed MCP tool catalog contains only 23 read-only tools (list_*, get_*, search_*, issue_read, pull_request_read). None of issue_write, add_issue_comment, star_repository, create_branch, create_or_update_file, create_pull_request are present, so no write attempt could reach the gateway — this only confirms gh-aw's backend GITHUB_READ_ONLY=1 config, not mcpg's own DIFC/guard layer (as flagged in the task's architectural note).
• Part D/E: gh auth status reported no authenticated host, so REST/GraphQL write probes could not be executed to test the token-scope boundary.
• No write leaked on any surface in this run.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime