Skip to content

[log] Add debug logging to DIFC evaluator #430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 1 commit into from
Jan 22, 2026
Merged

[log] Add debug logging to DIFC evaluator #430

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions internal/difc/evaluator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,12 @@ package difc
import (
"fmt"
"strings"

"github.com/githubnext/gh-aw-mcpg/internal/logger"
)

var log = logger.New("difc:evaluator")

// OperationType indicates the nature of the resource access
type OperationType int

Expand Down Expand Up @@ -74,6 +78,8 @@ func (e *Evaluator) Evaluate(
resource *LabeledResource,
operation OperationType,
) *EvaluationResult {
log.Printf("Evaluating access: operation=%s, resource=%s", operation, resource.Description)

result := &EvaluationResult{
Decision: AccessAllow,
SecrecyToAdd: []Tag{},
Expand Down Expand Up @@ -109,6 +115,9 @@ func (e *Evaluator) evaluateRead(
agentIntegrity *IntegrityLabel,
resource *LabeledResource,
) *EvaluationResult {
log.Printf("Evaluating read access: resource=%s, agentSecrecy=%v, agentIntegrity=%v",
resource.Description, agentSecrecy.Label.GetTags(), agentIntegrity.Label.GetTags())

result := &EvaluationResult{
Decision: AccessAllow,
SecrecyToAdd: []Tag{},
Expand All @@ -119,6 +128,7 @@ func (e *Evaluator) evaluateRead(
// Agent must trust the resource (resource has all integrity tags agent requires)
ok, missingTags := resource.Integrity.CheckFlow(agentIntegrity)
if !ok {
log.Printf("Read denied: integrity check failed, missingTags=%v", missingTags)
result.Decision = AccessDeny
result.IntegrityToDrop = missingTags
result.Reason = fmt.Sprintf("Resource '%s' has lower integrity than agent requires. "+
Expand All @@ -131,6 +141,7 @@ func (e *Evaluator) evaluateRead(
// All resource secrecy tags must be present in agent secrecy
ok, extraTags := resource.Secrecy.CheckFlow(agentSecrecy)
if !ok {
log.Printf("Read denied: secrecy check failed, extraTags=%v", extraTags)
result.Decision = AccessDeny
result.SecrecyToAdd = extraTags
result.Reason = fmt.Sprintf("Resource '%s' has secrecy requirements that agent doesn't meet. "+
Expand All @@ -139,6 +150,7 @@ func (e *Evaluator) evaluateRead(
return result
}

log.Printf("Read access allowed: resource=%s", resource.Description)
return result
}

Expand All @@ -148,6 +160,9 @@ func (e *Evaluator) evaluateWrite(
agentIntegrity *IntegrityLabel,
resource *LabeledResource,
) *EvaluationResult {
log.Printf("Evaluating write access: resource=%s, agentSecrecy=%v, agentIntegrity=%v",
resource.Description, agentSecrecy.Label.GetTags(), agentIntegrity.Label.GetTags())

result := &EvaluationResult{
Decision: AccessAllow,
SecrecyToAdd: []Tag{},
Expand All @@ -158,6 +173,7 @@ func (e *Evaluator) evaluateWrite(
// Agent must be trustworthy enough (agent has all integrity tags resource requires)
ok, missingTags := agentIntegrity.CheckFlow(&resource.Integrity)
if !ok {
log.Printf("Write denied: integrity check failed, missingTags=%v", missingTags)
result.Decision = AccessDeny
result.IntegrityToDrop = missingTags
result.Reason = fmt.Sprintf("Agent lacks required integrity to write to '%s'. "+
Expand All @@ -170,6 +186,7 @@ func (e *Evaluator) evaluateWrite(
// All agent secrecy tags must be present in resource secrecy
ok, extraTags := agentSecrecy.CheckFlow(&resource.Secrecy)
if !ok {
log.Printf("Write denied: secrecy check failed, extraTags=%v", extraTags)
result.Decision = AccessDeny
result.SecrecyToAdd = extraTags
result.Reason = fmt.Sprintf("Agent has secrecy tags %v that cannot flow to '%s'. "+
Expand All @@ -178,6 +195,7 @@ func (e *Evaluator) evaluateWrite(
return result
}

log.Printf("Write access allowed: resource=%s", resource.Description)
return result
}

Expand Down Expand Up @@ -227,6 +245,8 @@ func (e *Evaluator) FilterCollection(
collection *CollectionLabeledData,
operation OperationType,
) *FilteredCollectionLabeledData {
log.Printf("Filtering collection: operation=%s, totalItems=%d", operation, len(collection.Items))

filtered := &FilteredCollectionLabeledData{
Accessible: []LabeledItem{},
Filtered: []LabeledItem{},
Expand All @@ -244,5 +264,7 @@ func (e *Evaluator) FilterCollection(
}
}

log.Printf("Collection filtered: accessible=%d, filtered=%d, total=%d",
len(filtered.Accessible), len(filtered.Filtered), filtered.TotalCount)
return filtered
}