[Copilot]

issue_read labeled the outer {method, issue} envelope instead of the nested issue, assigning none:public despite trusted bot authorship. This filtered issue titles and bodies at min-integrity: approved.

• Runtime: Extract the nested issue for issue_read/get before evaluating author trust; retain flat-response support.
• Regression coverage: Add a sanitized affected-run fixture and real-WASM labeling/filtering tests for trusted authors, blocked-user and demotion precedence, and comment-author isolation.
• Documentation: Clarify bot-login support and per-author trust boundaries.

• Fixes DIFC: issue_read filters github-actions[bot] issue bodies despite approved trust policy #15291

[Copilot]

🔵 Needs a closer look

Human security sign-off is needed because the change affects trust labels controlling which issue content agents may read.

No open issues 🎉

What changed in this PR

Updates the GitHub guard so wrapped issue_read/get responses honor the nested issue author’s trust.

Changes:

• Extracts nested issues while retaining flat-response support.
• Adds regression coverage for trust precedence and comment-author isolation.
• Clarifies bot trust and per-author boundaries.

File	Description
internal/​proxy/​testdata/​issue_read_trusted_bot.json	Adds a sanitized wrapped-response fixture.
internal/​proxy/​issue_read_guard_test.go	Tests labeling and filtering through real WASM.
guards/​github-guard/​rust-guard/​src/​labels/​response_items.rs	Extracts nested issues before labeling.
guards/​github-guard/​rust-guard/​src/​labels/​mod.rs	Tests flat and wrapped trusted-bot responses.
docs/​CONFIGURATION.md	Clarifies trust scope and precedence.

_{Review effort: Max}