[log] Add debug logging to proxy config resolvers in cmd/proxy.go

[github-actions]

Adds 6 debug log calls using the existing logProxyCmd logger in internal/cmd/proxy.go:

• resolveDelegationProxyConfig: disabled path, store loading (path/generation/listen addr), success.
• resolveEnclaveProxyConfig: disabled path, resolution start (booleans/counts only), success.

No secrets are logged (envelope, capability key, and policy contents are omitted) and no log arguments have side effects.

Validation: go vet ./internal/cmd, go test ./internal/cmd, and go build all pass.

Generated by Go Logger Enhancement · copilot · auto · 38.1 AIC · ⊞ 12.9K · ◷

[Copilot]

🟢 Approval recommended

The changes are limited to straightforward logging calls with side-effect-free arguments and no identified blocking issues.

0 open findings

What changed in this PR

Adds debug visibility to delegation and enclave proxy configuration resolution using the existing logProxyCmd logger.

Changes:

• Adds six logs covering disabled modes, resolution progress, and success.
• Leaves configuration behavior unchanged and omits envelope, capability key, and policy contents.

File	Description
internal/​cmd/​proxy.go	Adds diagnostic logging to both proxy configuration resolvers.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal AWF container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_pull_requests/get_file_contents/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (add_issue_comment/star_repository/issue_write/create_branch/create_or_update_file/create_pull_request)	all 6 tools absent from the 23-tool catalog — never reached call-time	BLOCKED	⚠️
C	CLI	reads (github CLI via gateway)	data returned	ALLOWED	✅
D	CLI	REST writes (gh api)	gh not authenticated — failed before reaching GitHub	BLOCKED	⚠️
E	CLI	GraphQL mutations (gh api graphql)	gh not authenticated — failed before reaching GitHub	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write leaked in any part. Gaps:

• Part B: the gateway's backend GitHub MCP server only exposed 23 read-only tools (get_file_contents, list_issues, list_pull_requests, list_commits, search_*, etc.) — no write tool (issue_write, add_issue_comment, star_repository, create_branch, create_or_update_file, create_pull_request) appeared in the catalog at all, so no call-time gateway refusal could be exercised. This confirms backend GITHUB_READ_ONLY=1 config per gh-aw's tools.github: wrapper, not independently mcpg's own DIFC/guard write-blocking layer.
• Part D/E: gh CLI is unauthenticated in this environment (gh auth status → not logged in; gh api calls fail with "set the GH_TOKEN environment variable" before any request reaches GitHub), so the token-scope write boundary could not be exercised.

Independent evidence of mcpg's own write-blocking (DIFC/guard layer) remains covered by internal/guard/internal/difc unit tests, not this probe.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime