Formalize §4.6 effective-integrity model with executable compliance tests

[Copilot]

specs/github-mcp-access-control-compliance/README.md documented guard-level formal tests (P1–P6), but the §4.6 effective-integrity computation (blocked-users / trusted-users / approval-labels + min-integrity) had no executable coverage. This PR adds a dedicated formal suite to close that gap and records the new coverage in the compliance README.

• Effective integrity formal model (new test suite)

  • Added pkg/workflow/github_mcp_effective_integrity_formal_test.go with self-contained model types and evaluator helpers.
  • Encodes precedence and elevation semantics:
    • blocked-users short-circuits to blocked (cannot be overridden)
    • trusted-users and approval-labels elevate via max(base, approved)
    • effective integrity feeds access decision against min-integrity
  • Adds explicit edge-case coverage:
    • empty trusted/label lists behave like omitted
    • case-insensitive matching for users and labels
    • unset min-integrity allows non-blocked content
    • invalid min-integrity denies fail-safe
    • unknown base integrity normalizes to none for decisioning

• Spec fixture documentation alignment

  • Updated specs/github-mcp-access-control-compliance/README.md to include an Effective Integrity Model Coverage (§4.6) table and reference the new formal suite in usage/generated-suite sections.

func formalEffectiveIntegrity(item formalIntegrityItem, cfg formalIntegrityGuardConfig) string {
	if formalContainsFold(cfg.BlockedUsers, item.AuthorLogin) {
		return "blocked"
	}
	rank := formalEffectiveIntegrityRank(item.BaseIntegrity)
	if rank < 0 { rank = formalEffectiveIntegrityRank("none") }

	if formalContainsFold(cfg.TrustedUsers, item.AuthorLogin) {
		rank = max(rank, formalEffectiveIntegrityRank("approved"))
	}
	if formalIntersectsFold(cfg.ApprovalLabels, item.Labels) {
		rank = max(rank, formalEffectiveIntegrityRank("approved"))
	}
	return formalIntegrityLevelFromRank(rank)
}

• Fixes [formal-spec] github-mcp-access-control-compliance/README.md — Formal model & test suite — 2026-08-14 #52750

[github-actions]

PR Triage

• Category: test
• Risk: low
• Priority: medium (score: 35/100)
• Score breakdown: impact 15/50, urgency 5/30, quality 15/20
• Recommended action: batch_review
• Batch: small-features-tests-cluster

Automated triage by PR Triage Agent.

Generated by 🔧 PR Triage Agent · auto · 64.3 AIC · ⌖ 2.94 AIC · ⊞ 7.8K · ◷

[github-actions]

PR Triage

Category: test  |  Risk: low  |  Score: 24/100

Score breakdown

• Impact: 12/50
• Urgency: 6/30
• Quality: 6/20

Recommended action: defer

Draft, no reviews, spec/test formalization work.

Generated by 🔧 PR Triage Agent · auto · 68.2 AIC · ⌖ 10.7 AIC · ⊞ 7.8K · ◷