[log] Add debug logging to DIFC evaluator

[github-actions]

Summary

This PR adds debug logging to internal/difc/evaluator.go to improve troubleshooting of DIFC (Decentralized Information Flow Control) policy evaluation.

Changes Made

File Modified: internal/difc/evaluator.go (1 file, focused PR)

1. Added logger infrastructure:

   • Import: github.com/githubnext/gh-aw-mcpg/internal/logger
   • Logger declaration: var log = logger.New("difc:evaluator")

2. Added 9 logging calls:

   • Evaluate() - Log operation entry with operation type and resource description
   • evaluateRead() - Log read evaluation with agent secrecy/integrity labels
   • evaluateRead() - Log read denial for integrity check failures
   • evaluateRead() - Log read denial for secrecy check failures
   • evaluateRead() - Log read access allowed
   • evaluateWrite() - Log write evaluation with agent secrecy/integrity labels
   • evaluateWrite() - Log write denial for integrity check failures
   • evaluateWrite() - Log write denial for secrecy check failures
   • evaluateWrite() - Log write access allowed
   • FilterCollection() - Log collection filtering entry with operation and item count
   • FilterCollection() - Log filtering results with accessible/filtered/total counts

Why This File?

• Contains critical security logic for DIFC policy evaluation
• No existing logger (needed debug infrastructure)
• Complex decision-making logic that benefits from execution tracing
• Important for troubleshooting access control issues in production

Logging Guidelines Followed

✅ Logger naming convention: difc:evaluator follows pkg:filename pattern
✅ No side effects: All log arguments are simple variables, no function calls
✅ Meaningful context: Includes operation type, resource description, agent labels, and tags
✅ Both allow and deny: Logs successful and failed access decisions
✅ Project guidelines: Follows AGENTS.md debug logging standards

Testing

The changes preserve all existing behavior and only add debug logging:

• No functional changes to DIFC evaluation logic
• Logging is disabled by default (requires DEBUG=difc:* or DEBUG=*)
• All log arguments are pre-computed values with no side effects

Debug Output Example

# Enable DIFC evaluator debug logging
DEBUG=difc:evaluator ./awmg --config config.toml

# Example output (when DIFC is enabled):
difc:evaluator Evaluating access: operation=read, resource=github-repository
difc:evaluator Evaluating read access: resource=github-repository, agentSecrecy=[public], agentIntegrity=[trusted]
difc:evaluator Read access allowed: resource=github-repository

Related

• Part of ongoing effort to improve debug logging across the codebase
• Follows the same pattern as existing loggers in server:handlers, launcher:launcher, config:config

AI generated by Go Logger Enhancement