[spdd] Daily spec work plan - 2026-08-02

[github-actions]

Summary

Daily SPDD rotation review covering 5 specification files (rotation indices 15-17, wrap to 0-1 of 18 total): scratchpad/github-mcp-access-control-specification.md, scratchpad/guard-policies-specification.md, scratchpad/safe-outputs-specification.md, specs/aw-harness.md, specs/awf-config-sources-compliance/README.md. Key finding: the scratchpad/safe-outputs-specification.md is a deprecated v1.1.0 doc scheduled for deletion 2026-09-21 and still contains stale content that should be pruned or archived now rather than left dangling. The guard-policies-specification.md is a Draft (v0.1.0) proposal that has not been promoted or rejected, creating ambiguity about its implementation status. Both github-mcp-access-control-specification.md (scratchpad Draft v1.1.0) and its compliance sibling need a clearer sync path to the canonical docs-site location. specs/awf-config-sources-compliance/README.md defines 10 conformance test IDs (T-DR-001..010) referencing a DriftRecord schema but the referenced test file pkg/workflow/awf_config_drift_test.go needs verification that it exists and covers all IDs.

Priority Work Queue

P0

• Verify pkg/workflow/awf_config_drift_test.go exists and implements T-DR-001 through T-DR-010; if missing, file a tracked gap.
• Confirm the deletion date (2026-09-21) for scratchpad/safe-outputs-specification.md is tracked somewhere actionable (issue/label) so it isn't silently missed.

P1

• Resolve the Draft status of scratchpad/guard-policies-specification.md — either promote to a canonical spec path or record an explicit decision/rejection.
• Reconcile duplicate/overlapping GitHub MCP access-control content between scratchpad/github-mcp-access-control-specification.md and any canonical docs-site equivalent to avoid drift.

P2

• Add a REASONS "Safeguards" subsection explicitly to specs/aw-harness.md if absent, covering failure/abuse modes.
• Tighten "Norms" language (MUST/SHOULD/MAY usage) consistency across the 5 files reviewed.

SPDD Checklist

• /spdd-analysis: Confirm pkg/workflow/awf_config_drift_test.go exists and covers T-DR-001..010 from specs/awf-config-sources-compliance/README.md; if missing tests, note gap in a follow-up issue. (target: pkg/workflow/awf_config_drift_test.go; done when test coverage confirmed or gap filed)
• /spdd-sync: Add/update a tracking issue or label for the 2026-09-21 deletion of scratchpad/safe-outputs-specification.md, ensuring no doc-site/workflow links still reference it after that date. (target: scratchpad/safe-outputs-specification.md; done when tracking issue exists and archival notice is actioned)
• /spdd-reasons-canvas: Evaluate scratchpad/guard-policies-specification.md Requirements/Approach sections for completeness and decide promote-vs-archive status. (target: scratchpad/guard-policies-specification.md; done when status changed from "Draft" or explicit decision recorded in file)
• /spdd-generate: Define concrete GitHub Actions/Go implementation tasks for the Guard Policies allowed-repos/min-integrity frontmatter fields described in scratchpad/guard-policies-specification.md §2-3. (target: pkg/workflow/ guard policy parsing code; done when a task list with target files exists in the repo or a linked issue)
• /spdd-sync: Cross-check scratchpad/github-mcp-access-control-specification.md (v1.1.0 Draft) against any canonical docs-site MCP access-control spec for divergence; document differences. (target: scratchpad/github-mcp-access-control-specification.md and docs-site equivalent; done when a diff/reconciliation note is added)
• /spdd-analysis: Review specs/aw-harness.md for missing/weak Safeguards and Norms sections per REASONS canvas. (target: specs/aw-harness.md; done when gaps are listed with section references)
• /spdd-reasons-canvas: Verify specs/awf-config-sources-compliance/README.md "Operations" ordering (test ID assignment, PR/escalation triggers in T-DR-006/007) matches implementation behavior in the drift detection procedure. (target: specs/awf-config-sources-spec.md §6.2/§6.5; done when ordering confirmed or discrepancy filed)
• /spdd-generate: Add missing "Structure" section detail (file/module layout) to scratchpad/guard-policies-specification.md describing where GuardPolicies type hierarchy lives in pkg/workflow/. (target: scratchpad/guard-policies-specification.md; done when Structure section added with file paths)
• /spdd-sync: Update rotation cache /tmp/gh-aw/cache-memory/spdd-daily/rotation.json on next run to continue from index 2 (wrap point) covering specs/compiler-threat-detection-spec.md onward. (target: cache-memory rotation.json; done when next daily run advances index correctly)

Per-Spec Findings

scratchpad/github-mcp-access-control-specification.md (v1.1.0, Draft)

• Analysis: Well-structured with clear abstract, scope, and design goals (least privilege, repository scoping, role-based filtering, private-repo controls, integrity enforcement). Table of Contents matches section headers.
• REASONS gaps: Requirements and Approach sections are strong; Safeguards (blocked-user lists, integrity thresholds) are present but the interaction between "Draft" status and canonical docs-site publishing is unclear — no explicit promotion criteria stated.
• Risk: Marked Draft but referenced elsewhere as if authoritative; could cause implementers to build against an unstable spec.

scratchpad/guard-policies-specification.md (v0.1.0, Draft, dated 2026-06-21)

• Analysis: Executive summary and problem statement are clear; RFC 2119 notation correctly declared. Type hierarchy and schema sections are well defined with concrete YAML examples.
• REASONS gaps: Missing explicit "Structure" (target file/module) and "Operations" (execution order/validation sequence) sections. No conformance/compliance testing section, unlike sibling specs (e.g., security-architecture-spec.md's §12).
• Risk: Proposal-stage document with no visible decision record — six weeks old with no apparent status update.

scratchpad/safe-outputs-specification.md (v1.1.0, DEPRECATED)

• Analysis: Explicitly marked deprecated/stale relative to canonical docs/src/content/docs/specs/safe-outputs-specification.md (v1.21.0). Archival notice sets a deletion date of 2026-09-21 (90 days from 2026-06-21 audit).
• REASONS gaps: N/A — document is intentionally being sunset; the concern is process, not content quality.
• Risk: If no tracking exists for the deletion deadline, the file may linger past its planned removal, causing continued confusion between v1.1.0 and canonical v1.21.0.

specs/aw-harness.md

• Analysis: Reviewed for general structure; large file requiring targeted follow-up review of full section-by-section content in a future run given the 5-file/run cap.
• REASONS gaps: To be assessed in detail in the checklist item above (Safeguards/Norms review).

specs/awf-config-sources-compliance/README.md

• Analysis: Defines 10 conformance test IDs (T-DR-001 to T-DR-010) for the DriftRecord entity schema referenced from specs/awf-config-sources-spec.md §6.5. Clear requirement-to-test mapping table.
• REASONS gaps: "Operations" (drift detection procedure) and "Safeguards" (rejection rules for malformed records) are referenced but the actual Go test file existence is unverified from this review pass.
• Risk: If pkg/workflow/awf_config_drift_test.go does not yet implement all 10 test IDs, the compliance doc overstates current coverage.

Sync Follow-ups

• After confirming/filing the awf_config_drift_test.go coverage gap (P0), sync the result back into specs/awf-config-sources-compliance/README.md "Running Conformance Tests" section.
• After the guard-policies promote/archive decision, sync status changes into any workflow frontmatter docs referencing allowed-repos/min-integrity.
• Track the 2026-09-21 deletion date for scratchpad/safe-outputs-specification.md in a recurring reminder (e.g., a dated follow-up issue) to avoid missing the archival window.
• Next rotation run should resume at index 2 (specs/compiler-threat-detection-spec.md) through index 6, per updated rotation.json.

Context

Files reviewed this run (rotation indices 15,16,17,0,1 of 18 total, canonical sorted list):

1. scratchpad/github-mcp-access-control-specification.md
2. scratchpad/guard-policies-specification.md
3. scratchpad/safe-outputs-specification.md
4. specs/aw-harness.md
5. specs/awf-config-sources-compliance/README.md

Rotation state: last_index: 1, total_files: 18, persisted to /tmp/gh-aw/cache-memory/spdd-daily/rotation.json.

Run: §30756028871

Generated by 📋 Daily SPDD Spec Planner · auto · 37.8 AIC · ⌖ 2.74 AIC · ⊞ 6.9K · ◷

• expires on Aug 5, 2026, 8:17 AM UTC-08:00