[spdd] Daily spec work plan - 2026-05-30

[github-actions]

Summary

SPDD review of five specs today: Model Alias Format (v1.1.0 Draft), Repository Package Manifest (v0.1.0 Draft), Safe Outputs MCP Gateway (v1.21.0 Working Draft), GitHub MCP Access Control (v1.1.0 Draft), Guard Policies (scratchpad proposal). Key gaps: missing compliance tests, unresolved open questions, no lifecycle operations in package manifest, and runtime enforcement still pending in access control specs.

Run: §26688640522 · Rotation 5–9 of 20

---

Priority Work Queue

P	Task	Spec	Stage
P0	Add integration tests for guard policy end-to-end compilation	scratchpad/guard-policies-specification.md	/spdd-generate
P0	Audit §10 Execution Guarantees MUST clauses vs test coverage	docs/.../safe-outputs-specification.md	/spdd-analysis
P1	Add max-version field to §4.3	docs/.../repository-package-manifest-specification.md	/spdd-generate
P1	Flesh out §12 Compliance Testing matrix (≥20 rows)	docs/.../model-alias-specification.md	/spdd-generate
P1	Resolve 4 open questions (negative patterns, AND/OR, lockdown conflicts, dry-run)	scratchpad/guard-policies-specification.md	/spdd-reasons-canvas
P2	Add license, tags, categories fields to §4	docs/.../repository-package-manifest-specification.md	/spdd-generate
P2	Add §10 Package Lifecycle (install/update/uninstall norms)	docs/.../repository-package-manifest-specification.md	/spdd-sync
P2	Add §9.x config-reload safeguards	scratchpad/github-mcp-access-control-specification.md	/spdd-reasons-canvas

---

SPDD Checklist

• [/spdd-analysis] safe-outputs-specification.md §10: audit every MUST/MUST NOT clause; confirm test coverage in pkg/workflow/ — done: gap list added as spec comments
• [/spdd-generate] guard-policies-specification.md: add pkg/workflow/tools_guard_policy_integration_test.go — done: go test -run TestGuardPolicy passes
• [/spdd-generate] model-alias-specification.md §12: write compliance test matrix (≥20 rows, one per MUST rule §4–§8) — done: table committed
• [/spdd-reasons-canvas] guard-policies-specification.md: replace Open Questions with Decisions (Accepted/Deferred/Out-of-scope for each Q1–Q4) — done: section renamed
• [/spdd-generate] repository-package-manifest-specification.md §4.3: add max-version field + §7 validation rule; update pkg/workflow/manifest_parser.go — done: parser rejects incompatible version
• [/spdd-generate] repository-package-manifest-specification.md §4: add license (SPDX), tags (array≤10, each≤32 chars), categories enum — done: schema in pkg/parser/schemas/aw-manifest.schema.json updated
• [/spdd-sync] repository-package-manifest-specification.md: add §10 Package Lifecycle covering gh aw add, gh aw update, gh aw remove — done: ≥3 MUST rules per operation
• [/spdd-reasons-canvas] github-mcp-access-control-specification.md §9: add subsection on config-reload behavior and stale-config detection — done: ≥2 MUST rules added
• [/spdd-analysis] guard-policies-specification.md §5: verify deriveSafeOutputsGuardPolicyFromGitHub() in mcp_github_config.go matches spec derivation rules — done: divergences filed as bug
• [/spdd-sync] model-alias-specification.md §15 Change Log: add entries for ?effort= and ?temperature= aligning with model_alias_parser.go — done: log reflects actual behavior

---

Per-Spec Findings

model-alias-specification.md — v1.1.0 Draft

• Risks: Fallback resolution complexity may drift from impl; no circular-alias depth limit ❌
• Gaps (REASONS): Operations — test oracles missing ⚠️; Safeguards — no circular-alias guard ❌
• Tasks: §12 compliance matrix; §4.x recursion depth limit; cross-ref model_alias_parser.go; update §15 Change Log

repository-package-manifest-specification.md — v0.1.0 Draft

• Risks: v0.1 missing lifecycle ops; no max-version, license, tags; §5 auto-discovery tie-breaking undefined ❌
• Gaps (REASONS): Operations — no update/uninstall ❌; Safeguards — no signature verification for remote installs ❌
• Tasks: Add max-version, license, tags, categories; add §10 Package Lifecycle; clarify §5 tie-breaking; link §8 to manifest_validation.go

safe-outputs-specification.md — v1.21.0 Working Draft (186 KB)

• Risks: 186 KB working draft at v1.21 — high implementation drift risk in §10 and §11
• Gaps (REASONS): Operations §8 — impl verification pending ⚠️; Safeguards §9/§11 — test coverage unknown ⚠️
• Tasks: Audit §10 MUST clauses; verify §11 Bell-LaPadula rules match JS cache handler; add version-to-impl mapping table

github-mcp-access-control-specification.md — v1.1.0 Draft (92.9 KB)

• Risks: Runtime enforcement explicitly deferred; §6 role + blocked-user conflict unresolved ⚠️
• Gaps (REASONS): Operations §10 — gateway enforcement pending ⚠️; Safeguards — config-reload absent ❌
• Tasks: Add §9.x config-reload safeguards; add §6 conflict-resolution rule; link §11 to test files post-runtime

guard-policies-specification.md — Scratchpad Proposal

• Risks: Integration tests pending; runtime enforcement out of scope; 4 open questions unresolved ❌
• Gaps (REASONS): Norms — no RFC 2119 language ❌; Safeguards — 4 open gaps ❌; Structure — proposal not formal spec ⚠️
• Tasks: Add integration tests; resolve Q1–Q4; convert to formal spec with RFC 2119 language

---

Sync Follow-ups

• model-alias-specification.md ↔ pkg/workflow/model_alias_parser.go: verify ?effort= / ?temperature= range validation matches §6
• repository-package-manifest-specification.md ↔ pkg/workflow/manifest_validation.go: confirm error keys manifest_warning/manifest_error match §7
• guard-policies-specification.md ↔ pkg/workflow/mcp_github_config.go: verify owner/* → private:owner derivation rule in §5
• safe-outputs-specification.md ↔ pkg/workflow/js/*.cjs: verify every handler has a matching §7 Safe Output Type entry

---

Context

Files reviewed	model-alias-spec, repository-package-manifest-spec, safe-outputs-spec, github-mcp-access-control-spec, guard-policies-spec
Rotation	5–9 of 20 files; next: specs/awf-config-sources-spec.md (index 10)
Run	§26688640522

Generated by 📋 Daily SPDD Spec Planner · sonnet46 1.9M · ◷

• expires on Jun 2, 2026, 4:20 PM UTC