[log] Add debug logging to registerCoreFlags in internal/cmd/flags_core.go

[github-actions]

Adds debug logging to registerCoreFlags in internal/cmd/flags_core.go.

Changes

• Reused the existing shared debugLog logger in the cmd package (namespace cmd:root), no new logger declaration needed.
• Logged entry into registerCoreFlags.
• Logged completion after flag registration and mutual-exclusivity/required-flag validation setup.

Validation

• go build -o awmg . — succeeds
• go vet ./internal/cmd/... — clean
• go test ./internal/cmd/... — passes
• Manually verified with DEBUG=cmd:* ./awmg --config nonexistent.toml --listen :0 that both new log lines are emitted.

Single-file, focused change per task constraints.

Generated by Go Logger Enhancement · auto · 86.8 AIC · ⊞ 12.8K · ◷

[Copilot]

Pull request overview

Adds debug visibility around core CLI flag registration.

Changes:

• Logs entry into registerCoreFlags.
• Logs completion after validation groups are configured.

Show a summary per file

File	Description
internal/cmd/flags_core.go	Adds start and completion debug logs for core flag registration.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes	gh unauthenticated (Bad credentials)	BLOCKED	⚠️
E	CLI	GraphQL mutations	gh unauthenticated (Bad credentials)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 6 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the MCP tool catalog (23 read-only tools only). This confirms the gh-aw framework's GITHUB_READ_ONLY=1 defense-in-depth — write tools were never registered. Gateway-level DIFC/guard enforcement could not be independently confirmed for this surface since no write call ever reached a write-capable backend.

⚠️ Parts D/E: gh CLI reports Failed to log in to github.com using token (GH_TOKEN) — token invalid/unauthenticated. All REST write attempts and GraphQL mutations return Bad credentials. Cannot distinguish gateway enforcement from token-scope rejection. No writes succeeded.

No writes leaked. Run ID: 32197597360

🔒 Read-only stress test — §32197597360

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime