Wire intent policy enforcement and OTel Level 1 contract coverage

[Copilot]

Daily SPDD review found intent policies were compiled but advisory-only, and OTel Level 1 compliance still had unimplemented T-OT-008–011 coverage. This change adds feature-flagged runtime enforcement and closes the OTel/spec sync gaps.

• Intent policy enforcement
  • Added pkg/intent/authz.Authorizer.
  • Wired MCP tool-call authorization behind GH_AW_INTENT_POLICY_ENFORCEMENT=true.
  • Enforces allowed/denied tools, write scope, human approval, required checks, auto-merge, and max attempts.
  • Fails closed when enforcement is enabled but policy loading fails.

GH_AW_INTENT_POLICY_ENFORCEMENT=true \
GH_AW_INTENT_POLICY_PATH=.github/intent-policy.json \
GH_AW_INTENT_LABELS=documentation \
gh aw mcp-server

• Runtime regression coverage

  • Added tests proving denied tools are rejected.
  • Added tests proving MaxAttempts and AutoMergeAllowed are read from the compiled policy at execution time.

• OTel compliance

  • Added contract coverage for T-OT-008 through T-OT-011.
  • Aligned outcome-evaluation span naming with the spec: gh-aw.outcome.evaluate.
  • Updated validate-otel-contract to include/report the new Level 1 IDs.

• Spec sync

  • Updated intent governance audit status for feature-flagged enforcement.
  • Added OTel safeguard text: stubbed tests cannot count toward Level 1 conformance.
  • Added replace-label bidirectional sync notes between spec and compliance fixtures.
  • Added objective-mapping → intent-policy migration tracking notes.

• Fixes [spdd] Daily spec work plan - 2026-08-12 #52328

[github-actions]

PR Triage

• Category: feature
• Risk: high
• Score: 75/100 (impact 50 + urgency 15 + quality 10)
• Recommended action: fast_track
• OTel-related: assigning to @mnkeifer per triage policy
• Note: OTel-related: security/intent enforcement + otel contract; feature-flagged

Generated by 🔧 PR Triage Agent · auto · 39.1 AIC · ⌖ 2.59 AIC · ⊞ 7.8K · ◷

[github-actions]

Thanks for working on intent policy enforcement and OTel compliance! 🎯 Here's feedback to help refine this contribution:

Mixing concerns across systems
This PR bundles three distinct areas:

1. Intent policy enforcement — new pkg/intent/authz/ module and CLI wiring
2. OTel compliance — span naming updates and Level 1 contract tests
3. Specification updates — docs/specs covering governance, compliance, and migration notes

While these are related, reviewers will find it easier to evaluate, merge, and iterate on each system independently. Consider splitting into:

• A core policy authorization PR (Go code + policy enforcement tests)
• An OTel compliance PR (span naming, formal tests)
• A spec sync PR (documentation updates and migration notes)

This keeps each review focused on a single system, reduces risk per merge, and makes rollback simpler if issues emerge.

What looks good:
✅ Comprehensive test coverage (5 test files, multiple scenarios)
✅ Clear description with examples and issue reference (#52328)
✅ Properly scoped for an agentic workflow per CONTRIBUTING.md
✅ High-priority, high-risk label placement is appropriate

If you'd like help structuring the split, you can assign this prompt to your agent:

Split PR #52329 into three focused PRs:

1. Intent Policy Authorization PR
2. OTel Compliance PR
3. Specification and Governance Sync PR

Each PR will be tighter, easier to review, and faster to merge.

Generated by ✅ Contribution Check · auto · 64.6 AIC · ⌖ 3.82 AIC · ⊞ 8.8K · ◷