Prevent private secrecy taint for public-scope repo reads when visibility lookup is unknown

guards/github-guard/rust-guard/src/labels/mod.rs

@@ -2563,6 +2563,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_apply_tool_labels_actions_list_unknown_visibility_under_public_scope_preserves_existing(
+    ) {
+        let ctx = PolicyContext {
+            scopes: vec![PolicyScopeEntry {
+                scope_kind: ScopeKind::Public,
+                scope_owner: None,
+                scope_repo: None,
+                scope_label: "public".to_string(),
+            }],
+            ..Default::default()
+        };
+        let tool_args = json!({
+            "owner": "github",
+            "repo": "copilot"
+        });
+        let initial_secrecy = vec!["private:github/copilot".to_string()];
+
+        let (secrecy, integrity, _desc) = apply_tool_labels(
+            "actions_list",
+            &tool_args,
+            "github/copilot",
+            initial_secrecy.clone(),
+            vec![],
+            String::new(),
+            &ctx,
+        );
+
+        assert_eq!(
+            secrecy, initial_secrecy,
+            "public scope must not erase existing secrecy when visibility is unknown"
+        );
+        assert_eq!(
+            integrity,
+            writer_integrity("github/copilot", &ctx),
+            "actions_list must have writer-level integrity"
+        );
+    }
+
     // -------------------------------------------------------------------------
     // Context: get_me
     // -------------------------------------------------------------------------