fix: propagate config fields to all layers

[github-actions]

Summary

Config consistency audit of merged PRs from the last 7 days (#8074, #8119, #8196, #8217, #8276, #8292, #8305) found one gap: enclaves[].dynamic (introduced by #8196/#8217 as the ADR-0001 dynamic repository-policy envelope) was present in the JSON schema, TypeScript types, and runtime validation/rejection logic, but missing from Section 5's CLI Mapping table in docs/awf-config-spec.md.

Findings by PR

PR	Field(s) introduced	Schema (src)	Schema (docs)	Spec §14 prose	Spec §5 CLI mapping	TS types	Runtime wiring	Gap fixed
#8074	enclaves[].repos[].sensitivity: trusted	✅	✅	✅	n/a (existing row covers it)	✅	✅	—
#8119	enclaves[].agent.tools.github (+ deprecate agent.github.cli)	✅	✅	✅	✅	✅	✅	—
#8196	docs/adr/0001-agent-enclaves.md (design doc only)	n/a	n/a	✅	n/a	n/a	n/a	—
#8217	enclaves[].dynamic (agent-only dynamic policy envelope)	✅	✅	✅ (§14.1a)	❌ missing	✅	✅ (validated + rejected pre-execution)	Added row
#8276	Dynamic delegation channel/service internals (no new config surface)	n/a	n/a	n/a	n/a	n/a	✅	—
#8292	limits.timeoutSeconds unit clarified (seconds, not ns) — doc/description-only	✅	✅	✅	n/a (existing row covers it)	✅	✅	—
#8305	mcpg v0.4.18 floor + network membership fix (docs/runtime only, no new field)	n/a	n/a	✅	n/a	n/a	✅	—

src/awf-config-schema.json and docs/awf-config.schema.json were verified byte-identical (no drift).

Fix

Added the missing row to Section 5 of docs/awf-config-spec.md:

- `enclaves[].dynamic` → *(config-only; no CLI equivalent; accepted but not executable in this release, see §14.1a)*

Verification

• npx tsc --noEmit — passes
• npx jest src/schema.test.ts src/config-file*.test.ts src/enclave/preflight.test.ts src/parsers/enclave-parser.test.ts — 300/300 passed
• diff src/awf-config-schema.json docs/awf-config.schema.json — identical

Generated by Config Consistency Auditor · copilot · auto · 95.7 AIC · ⊞ 9.2K · ◷

[Copilot]

🟡 Changes recommended

The newly added mapping row introduces an internal contradiction with §14.1a by claiming enclaves[].dynamic is “not executable in this release” despite later runtime/prerequisite details describing how it runs when the compiler handoff is present.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the AWF configuration specification to include the missing Section 5 CLI-mapping entry for the enclaves[].dynamic config field, closing a documentation gap identified by a recent config consistency audit.

Changes:

• Add a Section 5 “CLI mapping” table row for enclaves[].dynamic in docs/awf-config-spec.md.

File summaries

File	Description
docs/awf-config-spec.md	Adds the missing CLI-mapping row for enclaves[].dynamic in the config spec.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

1. Download the docs-preview-pr-8385 artifact from the workflow run
2. Unzip and open index.html in your browser

Built from commit 9d0d491

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed in afdcdd8 by changing the enclaves[].dynamic mapping to say it requires compiler handoff and points to §14.1a.

[lpcox]

@copilot rebase to main and resolve any merge conflicts

[Copilot]

@copilot rebase to main and resolve any merge conflicts

Merged origin/main into the branch in 74957b8 (merge commit used instead of rebasing so the update can be published without rewriting history). No conflicts were present.