Validate merged shared-gateway enclave integration

[lpcox]

Summary

Validate the now-merged shared-mcpg enclave implementation end to end in gh-aw-firewall, then prepare the first production cross-repository workflow migration.

The implementation work is now present across all three repositories:

• Isolate runtime access for multiple gateway agent IDs gh-aw-mcpg#12186 merged per-agent runtime, policy, guard, tool-surface, and session-close isolation.
• gh-aw-mcpg v0.4.15 contains that concurrent multi-agent support.
• Connect agent enclaves directly to shared GitHub MCP #7991 connects agent enclaves directly to compiler-owned shared mcpg, removes the enclave gh wrapper and dedicated REST bridge, stages the distinct enclave agent ID privately, and configures nested Copilot with only the GitHub MCP endpoint.
• Compile enclave GitHub access through shared multi-agent mcpg gh-aw#57973 emits gateway.agentIds and complete fail-closed gateway.agentPolicies, pins mcpg v0.4.15, supplies AWF_ENCLAVE_GITHUB_MCP_AGENT_ID, and removes the separate Start/Stop Enclave GitHub Proxy lifecycle.

The previous successful Issues-read smoke run, 33140623752, validated the bounded result and timing behavior but still used two mcpg processes. The final single-gateway topology has not yet been validated end to end.

Current integration boundary

gh-aw-firewall PR #7991 deliberately fails closed when the compiler does not provide the shared-gateway enclave identity. gh-aw PR #57973 now provides that contract, but the gh-aw release available when this issue was last updated (v0.87.10) predates the compiler merge.

The smoke workflow can be compiled against merge commit c8a24eeadacca9bc6fcf18a7d30905841844a423 or a subsequent gh-aw release containing it.

Remaining work

• Recompile .github/workflows/smoke-enclave-issues-read.md using a gh-aw compiler containing PR #57973.
• Preserve the repository's local-AWF smoke substitutions while updating generated locks and action/container pins.
• Update smoke post-processing scripts and assertions for the shared-gateway compiled shape.
• Assert that exactly one mcpg process/container starts.
• Assert that no Start Enclave GitHub Proxy or Stop Enclave GitHub Proxy step remains.
• Confirm generated mcpg JSON contains both primary and enclave identities with complete agentPolicies.
• Confirm the enclave policy exposes only the github server, list_issues, issue_read, and the configured trusted repository catalog.
• Confirm AWF_ENCLAVE_GITHUB_MCP_AGENT_ID is staged privately for enclave use and excluded from the primary agent environment.
• Run the Issues-read smoke and audit its workflow logs, MCP transcript, AWF diagnostics, network topology, and preserved artifacts.
• Add or exercise negative integration coverage showing that the primary identity cannot invoke enclave-only access and that an enclave cannot exceed its configured repository/tool surface.
• Exercise concurrent primary/enclave access and verify independent DIFC/session state and close behavior.
• Confirm existing script enclaves remain networkless and existing non-enclave workflows are unaffected.

Security and behavior checks

• The enclave image contains no gh executable.
• The GitHub PAT remains only in mcpg/the GitHub MCP backend.
• Nested Copilot discovers exactly list_issues and issue_read from the GitHub MCP server.
• No primary agent ID, enclave agent ID, capability material, token, private repository data, or gateway configuration appears in public logs or the primary agent environment.
• The enclave's job-lifetime identity is restricted to the union of repositories declared in the trusted enclave catalog.
• Per-invocation process, seed, admission, shared budget ledger, finite result schema, timeout, cleanup, and timing controls remain intact.
• Timing disclosure still uses the canonical buckets, 1-second wake tolerance, independent 0-1-second jitter, fail-closed overflow behavior, and configured gateway timeout.

Acceptance criteria

• The shared-gateway Issues-read smoke passes using exactly one mcpg process.
• All three authorized read-only Issues operations succeed and return only the bounded result schema.
• Primary-to-enclave and cross-policy access attempts fail closed.
• Concurrent access preserves independent identity, DIFC state, tool visibility, and session lifecycle.
• No protected identifier, token, private result, or policy configuration leaks to the primary agent or public artifacts.
• Existing non-enclave workflows and networkless script enclaves continue to pass.
• The resulting generated workflow no longer contains dedicated enclave proxy lifecycle or legacy REST bridge plumbing.

Follow-up

After this validation passes, migrate Firewall Issue Dispatcher as the first production workflow, then migrate the remaining cross-repository workflows individually with workflow-specific repository assignments, tool profiles, bounded result schemas, information budgets, and negative access tests.