W-1: Detect direct API bypass in integrity audit + add reusable MCP routing constraint

[Copilot]

The 2026-04-03 integrity audit flagged the AI Moderator workflow making 3 direct network calls to api.github.com, github.com, and chatgpt.com, bypassing the MCP Gateway entirely — breaking DIFC enforcement and making data access unauditable.

integrity-filtering-audit.md

• Background: adds "direct API bypass attempts" as an explicit problem category (firewall blocks = signal)
• Step 3.6: new detection step with targeted bash patterns to surface bypass attempts from logs:

  grep -iE 'api\.github\.com|chatgpt\.com|openai\.com|curl.*https?://[^ ]*github|fetch.*https?://[^ ]*github' \
    "$TMPDIR"/*/mcp-logs/*.log 2>/dev/null | head -30

• Step 4: extends W-1 Warning classification to cover direct API bypass with likely causes (difc-proxy: true missing, weak prompt, misconfigured network.allowed) and fix pointer
• Issue template: Runs Analyzed table gains "Agent Invoked" + "Firewall Blocks" columns (matching the actual report format); Recommendations section now requires bypass investigation checklist
• Front matter: imports shared/mcp-api-routing.md so the audit agent itself is subject to the same constraint

shared/mcp-api-routing.md (new)

Reusable prompt constraint importable by any workflow (imports: - shared/mcp-api-routing.md). Covers:

• Hard prohibition on curl/gh api/fetch to api.github.com or external AI services
• ✅/❌ usage examples
• Why bypassing breaks DIFC (no integrity labels → no scope enforcement)
• Pre-call checklist (MCP tool, allowed-repos, difc-proxy, no external AI)

[Copilot]

Pull request overview

Adds integrity-audit guidance and reusable workflow prompt constraints to detect and prevent agent attempts to bypass the MCP Gateway (direct GitHub/external network calls), improving DIFC enforceability and auditability.

Changes:

• Introduces a reusable imported constraint (shared/mcp-api-routing.md) to prohibit direct GitHub/external API calls and reinforce MCP-tool-only routing.
• Extends the Integrity Filtering Audit workflow to explicitly detect and classify direct API bypass attempts using log-grep heuristics and updated reporting templates.

Show a summary per file

File	Description
.github/workflows/shared/mcp-api-routing.md	New importable constraint text to discourage direct network/API calls and explain DIFC implications.
.github/workflows/integrity-filtering-audit.md	Imports the new constraint and expands the audit procedure + issue template to detect/classify direct API bypass attempts.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 3

[Copilot]

The statement that direct access to api.github.com/github.com "will be blocked by the network firewall" isn’t consistently true in this repo (some workflows explicitly allow these domains, e.g. shared/gh.md allows api.github.com). Suggest rewording to reflect policy/constraint (e.g., "not permitted / will be flagged") rather than guaranteeing a firewall block, so the guidance stays accurate across workflows.

Suggested change

	any external service is not permitted and will be blocked by the network firewall.
	any external service is not permitted; attempts to bypass MCP routing may be
	flagged or blocked depending on workflow policy.

[Copilot]

Importing shared/mcp-api-routing.md makes this workflow explicitly require MCP tools for GitHub API access, but the procedure in this same document instructs using gh run list / gh run download (direct GitHub API calls). This creates conflicting guidance for the agent. Consider updating the procedure to use the GitHub MCP server tools for listing runs/downloading artifacts, or adjust the imported constraint to explicitly allow the needed gh usage for this audit workflow.

Suggested change

	imports:
	- shared/mcp-api-routing.md

[Copilot]

The firewall-block summarization command extracts "domains" using a very broad regex ([a-z0-9.-]+\.[a-z]{2,}) which will also match non-domains commonly present in logs (e.g., file names like mcp-gateway.log, rpc-messages.jsonl, etc.), producing noisy/misleading counts. Suggest tightening extraction to hostnames from URLs (e.g., extract after https?://) or matching the firewall log’s structured destination field if available.

Suggested change

	grep -iE 'BLOCK|DENY|firewall' "$TMPDIR"/*/mcp-logs/*.log 2>/dev/null \
	| grep -oE '(api\.github\.com|github\.com|chatgpt\.com|openai\.com|[a-z0-9.-]+\.[a-z]{2,})' \
	# Extract only URL hostnames to avoid counting filenames or other dotted log tokens as domains
	grep -iE 'BLOCK|DENY|firewall' "$TMPDIR"/*/mcp-logs/*.log 2>/dev/null \
	| grep -oE 'https?://[^/[:space:]]+' \
	| sed -E 's#^https?://##; s#:[0-9]+$##' \