feat(guard): add DIFC labeling for GitHub Projects tools

[Copilot]

The four GitHub Projects read tools (list_projects, get_project, list_project_fields, list_project_items) fell through to the default case in tool_rules.rs, causing two independent failures: (1) bare "none" integrity vs. scoped "none:github" on the agent — exact-match comparison always fails, blocking all project access even with min-integrity: none; (2) even with scope fixed, projects got none integrity rather than the approved level warranted by org-membership requirements.

Changes

tool_rules.rs

• Add explicit match arm for all four project read tools
• Extract owner from tool args; set baseline_scope = owner so ensure_integrity_baseline uses the correct scope token
• Use writer_integrity(&baseline_scope, ctx) → approved:<owner> (creating/managing projects requires org membership)

response_paths.rs

• Add per-item path labeling for list_project_items (heterogeneous collection)
  • ISSUE / PULL_REQUEST: secrecy from repo visibility via repository_url; integrity from author_association
  • DRAFT_ISSUE / unknown: empty secrecy; org-scoped approved integrity

Reproduction matrix (from upstream)

repos	min-integrity	Before	After
"all"	none	✅	✅
["github/*"]	none	❌ "none" ≠ "none:github"	✅ "none:github"
"all"	approved	❌ resource only has "none"	✅ resource has "approved"

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build1091184930/b332/launcher.test /tmp/go-build1091184930/b332/launcher.test -test.testlogfile=/tmp/go-build1091184930/b332/testlog.txt -test.paniconexit0 -test.timeout=10m0s stup�� g_.a stup/toolchains/stable-x86_64-un/tmp/go-build3339158387/b269/ x_amd64/compile (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build1091184930/b317/config.test /tmp/go-build1091184930/b317/config.test -test.testlogfile=/tmp/go-build1091184930/b317/testlog.txt -test.paniconexit0 -test.timeout=10m0s c4d6�� ternal/engine/wazevo/wazevoapi/debug_options.go ternal/engine/wazevo/wazevoapi/exitcode.go x_amd64/compile (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build1091184930/b332/launcher.test /tmp/go-build1091184930/b332/launcher.test -test.testlogfile=/tmp/go-build1091184930/b332/testlog.txt -test.paniconexit0 -test.timeout=10m0s stup�� g_.a stup/toolchains/stable-x86_64-un/tmp/go-build3339158387/b269/ x_amd64/compile (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build1091184930/b332/launcher.test /tmp/go-build1091184930/b332/launcher.test -test.testlogfile=/tmp/go-build1091184930/b332/testlog.txt -test.paniconexit0 -test.timeout=10m0s stup�� g_.a stup/toolchains/stable-x86_64-un/tmp/go-build3339158387/b269/ x_amd64/compile (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build1091184930/b341/mcp.test /tmp/go-build1091184930/b341/mcp.test -test.testlogfile=/tmp/go-build1091184930/b341/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1091184930/b268/vet.cfg ypass.go ommon.go x_amd64/compile erive-f8a9da973e/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet g/x/net/dns/dnsm-unsafeptr=false erive-f8a9da973e-unreachable=false x_amd64/compile 9158�� 9158387/b093/_pkgo1.25.8 J6jg/M1uOXhMTrsT-c=4 x_amd64/vet erive-f8a9da973e/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet erive-f8a9da973e-atomic -Wl,-Bstatic x_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR updates the GitHub guard’s DIFC labeling rules to properly scope and elevate integrity for GitHub Projects read tools, and adds fine-grained (per-item) response labeling for heterogeneous project items to avoid integrity-scope mismatches and incorrect integrity floors.

Changes:

• Add explicit tool_rules match arm for GitHub Projects read tools to scope integrity to the org owner and set an approved-level baseline.
• Add response_paths handler for list_project_items to label items differently based on whether they represent repo-backed issues/PRs vs draft/unknown item types.
• Add unit tests covering scope alignment and integrity level expectations for Projects tools and list_project_items path labeling.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Adds explicit Projects tool labeling to fix scope alignment and raise integrity to org-approved.
guards/github-guard/rust-guard/src/labels/response_paths.rs	Introduces per-item path labeling for list_project_items to handle mixed item types.
guards/github-guard/rust-guard/src/labels/mod.rs	Adds tests validating Projects tool integrity/scope behavior and list_project_items path labeling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[lpcox]

@copilot I'm worried that the remnants of the old integrity hierarchy are still around. Make sure that "writer" has been replaced with "approved" and "reader" with "unapproved" when referring to integrity levels

[Copilot]

@copilot I'm worried that the remnants of the old integrity hierarchy are still around. Make sure that "writer" has been replaced with "approved" and "reader" with "unapproved" when referring to integ...

Done in e415f2f. All uses of "writer" and "reader" when referring to integrity levels in comments have been updated to "approved" and "unapproved" respectively — including function docstrings in helpers.rs, inline comments in tool_rules.rs, module-level docs in mod.rs, and the new test comments. The function names (writer_integrity, reader_integrity) are unchanged since renaming them is out of scope for this PR.