[log] Add debug logging to guard/guard.go

internal/guard/guard.go

@@ -5,8 +5,11 @@ import (
 	"fmt"
 
 	"github.com/github/gh-aw-mcpg/internal/difc"
+	"github.com/github/gh-aw-mcpg/internal/logger"
 )
 
+var logGuard = logger.New("guard:guard")
+
 // BackendCaller provides a way for guards to make read-only calls to the backend
 // to gather information needed for labeling (e.g., fetching issue author)
 type BackendCaller interface {
@@ -67,6 +70,7 @@ type RequestState interface{}
 // emptyAgentLabelsResult returns a LabelAgentResult with empty agent labels for the given DIFC mode.
 // Used by guards that do not contribute agent labels (e.g. NoopGuard, WriteSinkGuard).
 func emptyAgentLabelsResult(mode string) *LabelAgentResult {
+	logGuard.Printf("Creating empty agent labels result: mode=%q", mode)
 	return &LabelAgentResult{
 		Agent: AgentLabelsPayload{
 			Secrecy:   []string{},
@@ -81,20 +85,30 @@ func emptyAgentLabelsResult(mode string) *LabelAgentResult {
 // effective enforcement mode. If result.DIFCMode is empty, defaultMode is returned
 // unchanged. If result.DIFCMode is non-empty but cannot be parsed, an error is returned.
 func ApplyLabelAgentResult(result *LabelAgentResult, agentLabels *difc.AgentLabels, defaultMode difc.EnforcementMode) (difc.EnforcementMode, error) {
+	logGuard.Printf("Applying label agent result: difc_mode=%q, secrecy_tags=%d, integrity_tags=%d, defaultMode=%s",
+		result.DIFCMode, len(result.Agent.Secrecy), len(result.Agent.Integrity), defaultMode)
+
 	// Validate/parse mode first so that tag mutation is skipped when mode is invalid.
 	// This keeps the operation atomic: either both the mode and the tags are applied,
 	// or neither is.
 	mode := defaultMode
 	if result.DIFCMode != "" {
 		parsedMode, err := difc.ParseEnforcementMode(result.DIFCMode)
 		if err != nil {
+			logGuard.Printf("Invalid difc_mode from label_agent: %q, error=%v", result.DIFCMode, err)
 			return defaultMode, fmt.Errorf("invalid difc_mode from label_agent: %w", err)
 		}
+		if parsedMode != defaultMode {
+			logGuard.Printf("Enforcement mode overridden: default=%s, override=%s", defaultMode, parsedMode)
+		} else {
+			logGuard.Printf("Enforcement mode provided matches default: mode=%s", parsedMode)
+		}
 		mode = parsedMode
 	}
 
 	agentLabels.AddSecrecyTags(difc.StringsToTags(result.Agent.Secrecy))
 	agentLabels.AddIntegrityTags(difc.StringsToTags(result.Agent.Integrity))
 
+	logGuard.Printf("Label agent result applied: effective_mode=%s", mode)
 	return mode, nil
 }