Model gh codespace stop as a guarded write operation

[Copilot]

The GitHub guard had a CLI-only coverage gap: gh codespace stop could reach a write endpoint without a modeled guard entry. This change closes that gap by classifying the operation explicitly in the Rust guard’s write-operation set.

• What changed

  • Added stop_codespace to WRITE_OPERATIONS in guards/github-guard/rust-guard/src/tools.rs
  • Kept the list ordering intact for binary_search-based classification

• Regression coverage

  • Extended the existing CLI gap regression test to assert that stop_codespace is treated as a write operation
  • Reuses the current pattern for other CLI-only modeled operations rather than introducing new test structure

• Example

  pub const WRITE_OPERATIONS: &[&str] = &[
      // ...
      "stop_codespace", // gh codespace stop — POST /user|/orgs/.../codespaces/.../stop
      // ...
  ];

[Copilot]

Pull request overview

This PR closes a GitHub guard classification gap by explicitly modeling gh codespace stop as a write operation in the Rust GitHub guard, ensuring the gateway’s DIFC enforcement treats it as a guarded write.

Changes:

• Added stop_codespace to the WRITE_OPERATIONS set used for binary_search-based write classification.
• Extended the existing CLI-coverage regression test to assert stop_codespace is recognized as a write operation.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/tools.rs	Adds stop_codespace to the sorted write-operation list and updates the CLI gap regression test accordingly.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Low