[Copilot]

control_handler.go duplicated the same run/enclave-entry request shape across control operations and repeated create-or-confirm log hash computation across success and denial paths. This PR centralizes those small patterns without changing handler behavior.

• Shared request shape

  • Adds a package-local runEntryRequest for operations keyed by run_id and enclave_entry_id.
  • Reuses it in revoke-by-labels and status.

• Single hash computation path

  • Computes create-or-confirm log hashes once after request normalization.
  • Reuses the same values in both denied and succeeded log lines.

runHash := util.HashForLog(request.RunID, 16, "")
entryHash := util.HashForLog(request.EnclaveEntryID, 16, "")
invocationHash := util.HashForLog(request.InvocationID, 16, "")

• Fixes [duplicate-code] Duplicate Code Pattern: Repeated Request Structs and Hash Calls in control_handler.go #12945

[Copilot]

🟢 Approval recommended

No unresolved review issues were identified, and the refactor preserves existing behavior.

Pull request overview

Refactors delegation control handling to remove duplicated request definitions and repeated log-hash calculations without changing behavior.

Changes:

• Adds shared runEntryRequest type.
• Reuses precomputed hashes across create-or-confirm outcomes.

File summaries

File	Summary
internal/delegation/control_handler.go	Centralizes request shape and logging hash computation.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal AWF container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request)	all 6 absent from 23-tool catalog; probed add_issue_comment → Error [-32602]: unknown tool	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents via github proxy)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	not attempted — gh auth status shows unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	not attempted — gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked through mcpg or the GitHub API in this run. Part B is ⚠️ because none of the 6 targeted write tools appear in the backend's tool catalog at all (gh-aw's tools.github: always sets GITHUB_READ_ONLY=1), so the observed "unknown tool" refusal only proves backend/toolset configuration, not the gateway's own DIFC/guard enforcement layer — that independent boundary is covered separately by internal/guard/internal/difc unit tests. Parts D/E are ⚠️ because the gh CLI is not authenticated in this environment, so the REST/GraphQL token-scope boundary could not be exercised this run.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gvisor

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned (issues, PRs, README.md, commits)	ALLOWED	✅
B	MCP	writes (issue_write/star_repository/add_issue_comment/create_branch)	unknown tool (-32602) — absent from 23-tool read-only catalog	BLOCKED	⚠️
C	CLI	reads (gateway-backed github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes	not attempted — gh unauthenticated (gh auth status failed)	BLOCKED	⚠️
E	CLI	GraphQL mutations	not attempted — gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write, reaction, star, comment, branch, file, or PR leaked in this run. Part B is
inconclusive because all targeted write tools were absent from the exposed catalog
(the backend GitHub MCP server always runs with GITHUB_READ_ONLY=1 under gh-aw's
tools.github: wrapper), so this proves backend/toolset configuration rather than
mcpg's independent gateway-level DIFC enforcement. Parts D/E are inconclusive because
gh was not authenticated in this environment. Reads (Parts A and C) fully passed on
the gvisor isolation runtime, matching default-runtime behavior.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime