feat: write-sink guard for DIFC-compatible output servers

[lpcox]

Problem

When the GitHub guard is active, the agent acquires integrity tags (e.g., none:github/gh-aw* unapproved:github/gh-aw* approved:github/gh-aw*). Output servers like safeoutputs use noop guards, which return empty labels and OperationReadWrite. The DIFC read evaluation then fails because the resource integrity (empty) is lower than the agent's integrity (non-empty).

Solution

Add a write-sink guard that:

1. Mirrors agent secrecy tags from context onto the resource — prevents secrecy violations for private repos
2. Leaves resource integrity empty — no integrity requirements for writes
3. Returns OperationWrite — skips the failing read check entirely

After DIFC auto-detection, all noop guards are automatically upgraded to write-sink guards via UpgradeNoopToWriteSink().

DIFC Evaluation

Check	Noop Guard	Write-Sink Guard
Read integrity	❌ empty < agent tags	(skipped — OperationWrite)
Write integrity	✅ empty → no requirements	✅ empty → no requirements
Write secrecy	❌ agent tags ⊄ empty	✅ agent tags = resource tags

Changes

• internal/guard/write_sink.go — WriteSinkGuard implementation
• internal/guard/write_sink_test.go — 8 tests including e2e DIFC evaluation
• internal/guard/registry.go — UpgradeNoopToWriteSink() method
• internal/difc/agent.go — AddIntegrityTags() for merge semantics
• internal/mcp/connection.go — Public GetAgentTagsSnapshotFromContext
• internal/server/unified.go — Merge labels instead of replace; auto-upgrade after DIFC detection

Testing

• 8 new unit tests including noop-fails-but-write-sink-passes comparison
• All existing tests pass (make agent-finished ✅)

[Copilot]

Pull request overview

This PR introduces a DIFC “write-sink” guard intended for write-only output backends (e.g., safeoutputs) so that agents labeled by other guards (like the GitHub WASM guard) can write without triggering DIFC read-integrity violations.

Changes:

• Add WriteSinkGuard that mirrors agent secrecy tags onto the resource, leaves resource integrity empty, and forces OperationWrite.
• Auto-upgrade registered noop guards to write-sink guards when DIFC is enabled.
• Make agent labeling additive (union semantics) and expose a public context helper for reading agent tag snapshots.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/server/unified.go	Auto-upgrades noop guards when DIFC is enabled; changes agent label handling to merge instead of replace.
internal/mcp/connection.go	Exposes GetAgentTagsSnapshotFromContext publicly for guard use.
internal/guard/write_sink.go	Implements the write-sink guard (write-only classification + secrecy mirroring).
internal/guard/registry.go	Adds UpgradeNoopToWriteSink() to swap noop guards to write-sink.
internal/difc/agent.go	Adds AddIntegrityTags() to support additive/merge semantics.
internal/guard/write_sink_test.go	Adds unit/e2e-style DIFC evaluation tests for write-sink behavior and registry upgrade.

Comments suppressed due to low confidence (1)

internal/guard/write_sink.go:51

• LabelAgent sets DIFCMode to "filter", which will override the gateway’s configured enforcement mode for any server upgraded from noop → write-sink (noop previously returned "strict"). If write-sink shouldn’t change enforcement behavior, consider leaving DIFCMode empty (so NewUnified’s configured mode applies) or matching noop’s default (strict).

func (g *WriteSinkGuard) LabelAgent(_ context.Context, _ interface{}, _ BackendCaller, _ *difc.Capabilities) (*LabelAgentResult, error) {
	logWriteSink.Print("LabelAgent: returning empty labels (write-sink does not label agents)")
	return &LabelAgentResult{
		Agent: AgentLabelsPayload{
			Secrecy:   []string{},
			Integrity: []string{},
		},
		DIFCMode: difc.ModeFilter,
	}, nil

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.