RunPipelinePrePhases denial handling had drift-prone duplication in the unified MCP server and HTTP proxy. Both callers were separately unpacking *PipelineAccessDenied and formatting denial responses from the same guard contract.

• Centralize pre-phase error classification

  • Add guard.HandlePrePhaseError(err) in internal/guard/pipeline.go
  • Move shared PipelineAccessDenied detection and detailed DIFC violation formatting behind one helper
  • Use errors.As so wrapped denial errors still resolve consistently

• Keep caller-specific response behavior

  • internal/server/unified.go now uses the shared helper and continues returning the detailed formatted MCP error
  • internal/proxy/handler.go now uses the same helper while preserving the existing short HTTP 403 body

• Tighten the guard contract with focused tests

  • Add guard-level coverage for denied vs non-denied pre-phase errors
  • Ensure only denial errors are classified, while ordinary labeling failures still follow existing fallback paths

denied, detailedErr := guard.HandlePrePhaseError(err)
if denied != nil {
    tracing.RecordSpanError(span, detailedErr, "access denied: "+denied.EvalResult.Reason)
    // caller-specific response handling
}