Wire dynamic enclave delegation controller into the workflow runtime

[lpcox]

Summary

Complete the gh-aw runtime handoff for dynamic GitHub-MCP-backed enclaves by starting mcpg's github-repository-delegation-v1 controller and giving AWF an explicit private control endpoint.

Compiler policy support from #58842 is merged, but the generated runtime currently emits a provisional gateway.delegationControllers object that mcpg v0.4.16 does not accept, does not start the real controller, and does not hand AWF its listener. AWF therefore intentionally rejects every dynamic policy.

github/gh-aw-mcpg#12604 is addressed by merged PR github/gh-aw-mcpg#12605. A new mcpg release containing that PR is being created; use that released version rather than v0.4.16 once its tag is available.

Scope

Version and capability gating

• Pin the first mcpg release containing github/gh-aw-mcpg#12605 and raise MCPGatewayDynamicRepositoryEnclaveMinVersion accordingly.
• Reject dynamic enclave compilation/runtime setup when the selected mcpg version lacks the compatible owner-scoped envelope, bounded dynamic schema admission, transactional reconciliation, persisted TTL binding, durability, DIFC isolation, and redaction behavior.
• Remove or replace the provisional strict-stdin gateway.delegationControllers object. Do not emit a config field the selected mcpg schema rejects.
• Continue minting a cryptographically random AWF-only delegation capability, but translate it only to mcpg's control key and the AWF private handoff. Never expose it to the primary agent, an enclave, generated logs, or the executor data plane.

Controller bootstrap

• Start mcpg delegation with all five required settings as one atomic configuration:
  • MCP_GATEWAY_DELEGATION_ENVELOPE
  • MCP_GATEWAY_DELEGATION_CONTROL_KEY
  • MCP_GATEWAY_DELEGATION_STATE_PATH
  • MCP_GATEWAY_DELEGATION_GENERATION
  • MCP_GATEWAY_DELEGATION_CONTROL_LISTEN
• Generate the immutable envelope from the compiled dynamic policy, including run ID, enclave backend, canonical allowed owners and exact repositories, github-repository-read-v1, bounded dynamic schema-hash capacity, maximum identity TTL, and runtime expiry.
• Ensure the envelope remains closed to exactly list_issues and issue_read and cannot grant writes, search/discovery, sibling owners, or broader GitHub access.
• Create a protected persistent state path/mount for mcpg delegation state. Preserve it for restart recovery within the workflow run, restrict permissions, and assign deterministic cleanup ownership.
• Supply a monotonic policy generation and preserve it consistently across controller restart/recovery for the active envelope.
• Treat partial controller configuration, state corruption, listener failure, or recovery-incomplete status as a startup/runtime failure with no fallback.

Private endpoint handoff and topology

• Bind the delegation control listener separately from mcpg's executor-facing data-plane listener.
• Expose the control listener only through a host-private or dedicated AWF-only transport. Do not publish it to the primary-agent network, enclave executor network, general MCP route, or public runner interface.
• Add an explicit AWF handoff variable such as AWF_ENCLAVE_GITHUB_DELEGATION_CONTROL_ENDPOINT; do not reuse AWF_ENCLAVE_MCP_GATEWAY_ENDPOINT, which identifies the executor-facing /mcp/awf-enclave data plane.
• Pass the endpoint and control capability only to the AWF host process. Add both to primary-agent environment exclusions and masking/redaction paths.
• Supervise the controller listener so an unexpected failure stops or invalidates dynamic execution rather than leaving the data plane success-shaped.
• Keep the executor data plane reachable only through the intended enclave topology and authenticated with invocation-scoped executor bearers.

Primary-agent isolation

• Keep the GitHub backend registered so delegated identities can use it, but remove it from the primary agent's policy unless the workflow separately enables top-level tools.github.
• Verify that enabling a dynamic enclave alone does not give the primary agent any GitHub MCP tools or access to repository content.
• Keep AWF_ENCLAVE_GITHUB_DELEGATION_CONTROL_CAPABILITY, controller endpoint, envelope, state path, generation, identity handles, and executor bearers out of the primary agent environment, mounts, MCP configuration, summaries, and logs.

Runtime expiry and schema compatibility

• Replace the compile-time absolute expires-at <= time.Now() + timeout rule with a runtime/job-relative expiry contract suitable for checked-in workflows.
• Resolve the concrete RFC3339 envelope expiry during workflow setup and ensure it cannot exceed the job or invocation lifetime.
• Emit the bounded dynamic schema policy required by the post-Bump documentation dependencies: astro, @astrojs/starlight, @playwright/test #12605 mcpg envelope while allowing AWF to bind each invocation to its exact finite schema hash.
• Align compiler limits with AWF's accepted envelope: at most 256 allowed owners, 256 allowed repositories, and 32 audit labels, plus the established numeric resource/quota ceilings.
• Preserve canonical lowercase owner/repository validation with no trimming, case folding, Unicode normalization, URL decoding, or alternate syntax.

Release coordination

• Keep the provisional AWFDynamicRepositoryEnclaveMinVersion fail-closed until github/gh-aw-firewall#8195 ships.
• After the AWF implementation is released, raise AWFDynamicRepositoryEnclaveMinVersion from provisional v0.28.14 to the actual compatible AWF release and update DefaultFirewallVersion.
• Document the minimum compatible gh-aw, mcpg, AWF, and GitHub MCP versions.

Acceptance criteria

• Generated mcpg configuration is accepted by the pinned post-Bump documentation dependencies: astro, @astrojs/starlight, @playwright/test #12605 release and starts both data and private control listeners successfully.
• The immutable envelope represents owner-scoped runtime discovery, optional exact repository allowlists, bounded runtime schema hashes, exact v1 tools, TTL, expiry, and generation without broadening authority.
• AWF receives a distinct authenticated private control endpoint and capability; the primary agent and enclave executor cannot route to it or read its credentials.
• Dynamic enclave configuration alone does not expose the GitHub backend or tools to the primary agent.
• Controller state survives an in-run restart and remains recovery-incomplete until AWF reconciles it through the supported API.
• Listener failure, partial configuration, version mismatch, corrupt state, or failed reconciliation blocks dynamic execution with no static, union-scope, job-token, or legacy fallback.
• Checked-in workflows do not require a short-lived absolute compile-time timestamp.
• Compiler schema bounds cannot produce a policy rejected by the compatible AWF version.
• Tests cover rendered workflow/config output, environment forwarding and exclusion, secret masking, topology, state mounts, controller startup/failure, primary policy isolation, restart/recovery, expiry, version gates, and unsupported combinations.

Dependencies and consumers

• Compiler policy envelope: Add compiler support for dynamic repository enclave policies #58842 (complete)
• mcpg delegation contract: github/gh-aw-mcpg#12604, implemented by merged PR github/gh-aw-mcpg#12605; compatible release is being created
• AWF runtime registry: github/gh-aw-firewall#8193 (complete)
• AWF remote-backed execution: github/gh-aw-firewall#8195 (blocked by this issue)
• Cross-component security coverage: github/gh-aw-firewall#8192