Add compiler support for dynamic repository enclave policies

.github/aw/actions-lock.json

@@ -500,6 +500,11 @@
       "digest": "sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e",
       "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.15@sha256:60cd97533e93d8e7be36b979c0f08a70846189bda6190f28bbd6d427bc0d9b6e"
     },
+    "ghcr.io/github/gh-aw-mcpg:v0.4.16": {
+      "image": "ghcr.io/github/gh-aw-mcpg:v0.4.16",
+      "digest": "sha256:d7ed4c9e923f3c8be6c7e8f568a2af937f397a4dd1d2030dcd28a01fb34e705f",
+      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.16@sha256:d7ed4c9e923f3c8be6c7e8f568a2af937f397a4dd1d2030dcd28a01fb34e705f"
+    },
     "ghcr.io/github/gh-aw-node": {
       "image": "ghcr.io/github/gh-aw-node",
       "digest": "sha256:bac2192f6374d6262116399b34fc5e143d576f82719e90a18261cae7480f4d4e",

.github/aw/enclaves.md

@@ -9,7 +9,7 @@ Use these instructions when a workflow needs bounded, auditable access to a priv
 ## What it is
 
 - The top-level `enclaves:` array (1-2 entries) enables finite-disclosure access to approved private repositories through the compiler-launched MCP gateway.
-- Each entry is either a **script enclave** (`script:` + `repos:`) registering `enclave_run_script`, or an **agent enclave** (`agent:` + `repos:`) registering `enclave_run_agent`.
+- Each entry is either a **script enclave** (`script:` + `repos:`) registering `enclave_run_script`, or an **agent enclave** (`agent:` + static `repos:` or dynamic `dynamic:`) registering `enclave_run_agent`.
 - Omit `enclaves:` entirely to disable the feature — this is the default.
 - This is a preview feature gated on `github/gh-aw-firewall#6992`; an older pinned AWF version will not provide the enclave server.
 
@@ -54,7 +54,7 @@ Prefer this configuration shape for new workflows:
 ```yaml
 sandbox:
   mcp:
-    version: v0.4.15
+    version: v0.4.16
 enclaves:
   - agent:
       model: gpt-5
@@ -75,6 +75,50 @@ enclaves:
 - GraphQL, search, writes, and all other GitHub tools remain denied.
 - Minimum versions are AWF `v0.28.9` and mcpg `v0.4.15`; trusted repositories additionally require AWF `v0.28.14`.
 
+## Dynamic agent repository policies
+
+Use `dynamic:` on agent entries when the primary agent should select one admitted repository at invocation time without enumerating every repository in frontmatter:
+
+```yaml
+sandbox:
+  agent:
+    id: awf
+    version: v0.28.14
+  mcp:
+    version: v0.4.16
+enclaves:
+  - agent:
+      model: gpt-5
+      max-task-bytes: 4096
+      max-model-requests: 8
+      max-model-tokens: 1024
+    dynamic:
+      allowed-owners: [octo-org]
+      sensitivity: confidential
+      github-policy: github-repository-read-v1
+      max-repositories: 4
+      quotas:
+        max-invocations: 8
+        max-output-bytes: 32768
+        max-execution-seconds: 900
+      audit-labels: [dynamic-enclave]
+      expires-at: "2026-09-06T00:32:00Z"
+    timeout: 120
+    memory-limit: 512m
+    cpu-limit: "1"
+    pids-limit: 128
+    tmpfs-limit: 64m
+    max-output-bytes: 8192
+    max-invocations: 8
+```
+
+- Dynamic mode is agent-only; scripts remain static seed-backed and must declare `repos`.
+- Each entry declares either non-empty static `repos` or `dynamic`, never both.
+- Declare `allowed-owners` or `allowed-repositories` using the ADR 0001 canonical lowercase ASCII selector form. The compiler does not trim, case-fold, URL-decode, or otherwise normalize dynamic selectors.
+- `github-policy` must be `github-repository-read-v1`, the closed policy containing only `list_issues` and `issue_read`.
+- Dynamic entries require fixed sensitivity, finite resource limits, total quotas, audit labels, an absolute `expires-at` no later than the enclave job lifetime, AWF `v0.28.14` or newer, and mcpg `v0.4.16` or newer.
+- The compiler emits the dynamic policy envelope and mcpg `github-repository-delegation-v1` controller. The delegation-control capability is AWF-only and is excluded from primary and enclave agent environments.
+
 ## Deprecated legacy profile
 
 The legacy profile remains supported during migration: