approval-labels cannot promote issue_read resource classified as unknown #70961

Summary

With gh-aw v0.92.0, approval-labels is correctly propagated to the GitHub MCP guard, but issue_read for a specifically numbered issue is classified as issue:jbarnesweb/melisma#unknown.

Because the resource identity loses the issue number, an issue carrying the configured approval label remains none:public and is rejected by min-integrity: approved.

Environment
gh-aw v0.92.0
GitHub MCP Server v2.0.2
GitHub.com public repository
Copilot engine
pull_request workflow trigger
Configuration

The workflow configures:

tools:
github:
min-integrity: approved
approval-labels:
- acceptance-approved

The target issue has the acceptance-approved label.

Runtime logs confirm:

GH_AW_APPROVAL_LABELS_EXTRA: acceptance-approved

and:

approval-labels: ["acceptance-approved"]

Reproduction

The agent calls:

issue_read(
method: get,
owner: jbarnesweb,
repo: melisma,
issue_number: 12
)

The MCP tools/call request correctly contains:

issue_number: 12

However, DIFC reports:

issue:jbarnesweb/melisma#unknown

and assigns:

integrity_tags: ["none:public"]

The request is therefore rejected because the verifier requires approved integrity.

Expected behavior

The resource should retain the requested issue number:

issue:jbarnesweb/melisma#12

The integrity classifier should then inspect issue #12's labels and recognize acceptance-approved as an approval label.

Observed behavior

The configured approval label reaches the guard correctly, and the agent supplies the correct issue number, but the DIFC resource identity becomes #unknown before integrity evaluation.

This prevents approval-labels from promoting the explicitly approved issue.