Support runtime-scoped repository delegation for dynamic enclaves #12604

Summary

Extend github-repository-delegation-v1 so gh-aw and AWF can safely create invocation-scoped GitHub MCP identities for repositories discovered at runtime.

This is the mcpg prerequisite for github/gh-aw-firewall#8195. The initial delegation implementation from #12554, released in v0.4.16, provides the private control API and exact-repository identity enforcement, but its startup envelope and recovery surface cannot yet represent the dynamic enclave contract from github/gh-aw-firewall#8194.

Current limitations

• Delegation is enabled only by the five all-or-none MCP_GATEWAY_DELEGATION_* environment variables on awmg proxy; gh-aw currently emits a strict-stdin gateway.delegationControllers object that mcpg does not recognize.
• The immutable envelope requires non-empty compile-time allowed_repositories and allowed_schema_hashes. Dynamic enclaves may allow an owner and select one exact repository and finite output schema only at invocation time.
• The control API exposes create-or-confirm, revoke, and revoke-by-labels, but no status or reconciliation operation. A recovery-incomplete store blocks new admissions without giving AWF a supported way to inspect and reconcile it.
• Different idempotency keys can create multiple identities for one invocation.
• Concurrent persistence snapshots can be published out of order.
• Restored expired or revoked entries can remain in the label index, allowing revoke-by-labels to dereference a missing handle.
• Delegated requests use the shared fallback proxy DIFC identity rather than a delegation-specific context.
• Debug and generic request logging can expose private repository selectors, paths, run/entry labels, or identity metadata.
• A post-start control-listener failure is logged but does not fail or stop the data plane.

Scope

Versioned envelope and bootstrap contract

• Define a supported gateway bootstrap contract that gh-aw can emit without relying on an unknown strict-config field. Either add a versioned delegationControllers schema or define the equivalent documented runtime handoff.
• Preserve all-or-none validation for control key, state path, generation, envelope, and dedicated control listener.
• Extend the immutable envelope with canonical owner allowlists while retaining optional exact repository allowlists.
• At create-or-confirm time, require the selected exact lowercase owner/repo to match the immutable owner/repository policy. One identity remains bound to exactly one repository.
• Define a bounded finite-schema policy that permits invocation-supplied schema hashes without accepting arbitrary or unbounded schemas. The identity must remain bound to the exact admitted schema hash.
• Keep github-repository-read-v1 closed to exactly list_issues and issue_read.
• Document the control listener and data-plane listener as separate interfaces; the control capability must never authenticate executor traffic.

Identity and recovery semantics

• Enforce one active or terminal identity binding per (run, enclave backend, enclave entry, invocation) even when callers vary the idempotency key.
• Preserve exact create-or-confirm matching for repository, policy, schema hash, admitted default-branch SHA, expiry, and all binding labels. A mismatch must revoke the original identity and leave a terminal tombstone.
• Add a status/reconciliation operation that allows AWF to enumerate or confirm labelled state, revoke stale identities, and explicitly mark recovery complete before new admissions resume.
• Keep create/revoke/reconcile operations idempotent across retries and mcpg restarts.
• Make persistence ordering monotonic so an older concurrent snapshot cannot replace newer state.
• Repair the restored label index so expired, revoked, or missing handles cannot panic revoke-by-labels.
• Preserve restrictive state-file permissions, checksum validation, generation/envelope matching, and fail-closed recovery.

Isolation, logging, and lifecycle

• Give delegated identities a delegation-specific DIFC context rather than sharing the fallback proxy identity.
• Redact repository selectors, paths, run/entry labels, handles, bearers, control keys, and authorization values from debug, error, and generic proxy logs.
• Ensure DEBUG=* does not reveal private repository metadata.
• Treat an unexpected control-listener failure as fatal or expose a reliable health signal that causes AWF to stop admitting and executing identities.
• Keep the control endpoint bounded: strict methods and paths, authenticated requests, request-size limits, timeouts, canonical errors, and no public/data-plane exposure.

Acceptance criteria

• A compiler-installed immutable envelope can authorize an owner-scoped runtime policy without enumerating the selected repository or every finite schema hash at compile time.
• Create-or-confirm admits one exact canonical repository and exact schema hash only when both fit the immutable envelope.
• Sibling owners, disallowed exact repositories, non-v1 tools, writes, search/discovery, schema broadening, argument/path tampering, and identity rebinding fail closed.
• Different idempotency keys cannot create multiple identities for one invocation.
• AWF can inspect recovery-incomplete state, revoke or confirm labelled identities, mark reconciliation complete, and then resume admissions.
• Concurrent save/revoke/create operations cannot roll state backward or panic after restart.
• Delegated traffic is isolated under a delegation-specific DIFC identity.
• Logs and errors contain no private selector or credential material.
• Control-plane failure is observable and prevents continued success-shaped delegated execution.
• Tests cover bootstrap compatibility, owner and exact-repository policy, bounded schema admission, idempotency mismatch, restart/recovery, persistence races, label cleanup, DIFC isolation, redaction, listener failure, and backward compatibility.
• Release the first compatible version and document the minimum gh-aw/AWF versions.

Dependencies and consumers

• Initial delegation API: Support invocation-scoped identity delegation for dynamic enclaves #12554 (complete in v0.4.16)
• Contract and threat model: github/gh-aw-firewall#8194
• Compiler/runtime handoff follow-up: required in github/gh-aw
• AWF remote-backed execution: github/gh-aw-firewall#8195 (blocked by this issue)
• Cross-component security coverage: github/gh-aw-firewall#8192