Refactor DIFC pre-phase error handling into a shared guard helper

[Copilot]

RunPipelinePrePhases denial handling had drift-prone duplication in the unified MCP server and HTTP proxy. Both callers were separately unpacking *PipelineAccessDenied and formatting denial responses from the same guard contract.

• Centralize pre-phase error classification

  • Add guard.HandlePrePhaseError(err) in internal/guard/pipeline.go
  • Move shared PipelineAccessDenied detection and detailed DIFC violation formatting behind one helper
  • Use errors.As so wrapped denial errors still resolve consistently

• Keep caller-specific response behavior

  • internal/server/unified.go now uses the shared helper and continues returning the detailed formatted MCP error
  • internal/proxy/handler.go now uses the same helper while preserving the existing short HTTP 403 body

• Tighten the guard contract with focused tests

  • Add guard-level coverage for denied vs non-denied pre-phase errors
  • Ensure only denial errors are classified, while ordinary labeling failures still follow existing fallback paths

denied, detailedErr := guard.HandlePrePhaseError(err)
if denied != nil {
    tracing.RecordSpanError(span, detailedErr, "access denied: "+denied.EvalResult.Reason)
    // caller-specific response handling
}

[Copilot]

Pull request overview

This PR refactors DIFC pre-phase denial handling to eliminate duplicated *guard.PipelineAccessDenied unpacking/formatting logic across the unified MCP server and the HTTP proxy, by centralizing classification + detailed violation formatting in guard.HandlePrePhaseError.

Changes:

• Added guard.HandlePrePhaseError(err) to classify RunPipelinePrePhases errors via errors.As and produce a formatted DIFC violation error.
• Updated unified MCP server denial handling to use the shared helper while continuing to return the detailed MCP error payload.
• Updated proxy denial handling to use the shared helper while preserving the existing short 403 body, and added guard-level tests for denied vs non-denied pre-phase errors.

Show a summary per file

File	Description
internal/server/unified.go	Replaces inline PipelineAccessDenied handling with the shared guard helper for consistent denial formatting.
internal/proxy/handler.go	Uses the shared guard helper for denial classification while keeping the proxy’s short 403 response behavior.
internal/guard/pipeline.go	Introduces HandlePrePhaseError to centralize pre-phase denial detection and detailed violation formatting.
internal/guard/pipeline_test.go	Adds unit tests covering denied vs non-denied behavior for the new helper, including wrapped denial errors.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 1

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Fixed in the latest commit. The proxy span now records the short deniedErr ("DIFC policy violation: <reason>") instead of detailedErr, so DIFC tag state is no longer exported to OTEL backends. The detailedErr return value from HandlePrePhaseError is discarded in the proxy path (blank identifier _) since it's only needed by the unified MCP server which intentionally includes the full violation detail in its error response.