[spdd] Daily spec work plan - 2026-08-03

[github-actions]

Summary

Daily SPDD review covering rotation slots 6–10 of 18 (index resumed from prior run's last_index: 1): specs/awf-config-sources-spec.md, specs/compiler-threat-detection-spec.md, specs/forecast-compliance-fixtures/README.md, specs/github-mcp-access-control-compliance/README.md, specs/intent-attribution-agent-governance.md. Overall these specs are mature (formal predicates, RFC 2119 norms, drift/audit protocols already in place). The main gaps found are: (1) a self-documented test coverage gap for optimizer failure safeguards in the threat-detection spec, (2) missing automated coverage-verification tooling for compliance fixture directories (forecast + GitHub MCP access control), and (3) no automated freshness check ensuring the awf-config-sources-spec.md drift-detection safeguard section stays reconciled with the referenced snapshot cache paths.

Priority Work Queue

• P0: Add unit/integration tests for the three Optimizer failure modes (OPTIMIZER_DEGRADED, OPTIMIZER_TIMEOUT, OPTIMIZER_RATE_LIMITED) documented in specs/compiler-threat-detection-spec.md §6, currently flagged in the spec's own 2026-07-31 audit as an untested coverage gap.
• P1: Add a compliance-fixture-count consistency check so the fixture tables in specs/forecast-compliance-fixtures/README.md and specs/github-mcp-access-control-compliance/README.md cannot silently drift from the actual files on disk.
• P1: Verify the AWF config drift-detection snapshot safeguard path (~/.cache/gh-aw/schema-consistency/last-known-snapshot/ / /tmp/gh-aw/agent/schema-consistency/last-known-snapshot/) in specs/awf-config-sources-spec.md §8 is implemented in the scheduled schema-consistency-checker workflow, or file a sync task if not.
• P2: Tighten specs/intent-attribution-agent-governance.md cross-references between the ambiguous/unlinked attribution states (§"Attribution states") and the compliance fixture list, to make the fixture-to-norm mapping explicit like the GitHub MCP access control spec does.
• P2: Add a changelog/version bump note convention check so compiler-threat-detection-spec.md §7.2 "Mapping Audit" entries (currently free-text prose, growing unbounded) get archived/rotated periodically instead of appended indefinitely.

SPDD Checklist

• /spdd-generate: Add Go tests in pkg/workflow/ (or a dedicated integration harness) exercising OPTIMIZER_DEGRADED, OPTIMIZER_TIMEOUT, and OPTIMIZER_RATE_LIMITED diagnostic paths per specs/compiler-threat-detection-spec.md §6.4–§6.6. Done when: new test file(s) exist and pass with go test -run "TestOptimizer" ./pkg/workflow/..., and the spec's audit log at §7.2 records the gap as closed.
• /spdd-sync: Cross-check specs/forecast-compliance-fixtures/README.md's "Available Additional Fixtures" table against actual files in specs/forecast-compliance-fixtures/ (currently 4 additional fixtures listed, 4 present — verify test IDs T-FC-022/035/036 and T-ET-006 still resolve in pkg/cli/forecast_montecarlo_test.go). Done when: a comment or CI step confirms 1:1 mapping, or discrepancies are filed as follow-up issues.
• /spdd-sync: Cross-check specs/github-mcp-access-control-compliance/README.md fixture table (10 fixtures) against files in specs/github-mcp-access-control-compliance/ and against pkg/workflow/github_mcp_access_control_formal_test.go. Done when: go test -v -run "TestFormal_FixtureRunner" ./pkg/workflow/ passes and confirms all 10 YAML fixtures load without drift.
• /spdd-analysis: Determine whether .github/workflows/schema-consistency-checker.md (referenced in specs/awf-config-sources-spec.md §7.4) currently implements the §8 snapshot-based degraded-mode safeguard (7-day expiry, 14-day cleanup). Done when: an analysis note or PR confirms implementation status, filed against .github/workflows/schema-consistency-checker.md.
• /spdd-generate: Add explicit fixture-to-attribution-state cross-reference table in specs/intent-attribution-agent-governance.md (near "Compliance Fixtures" §, line 74) mirroring the "Behavioral Coverage Map" style used in specs/github-mcp-access-control-compliance/README.md. Done when: the new table lists each fixture under specs/intent-attribution-compliance/ and its corresponding attribution state/test ID.
• /spdd-sync: Archive specs/compiler-threat-detection-spec.md §7.2 "Mapping Audit" entries older than 90 days into specs/compiler-threat-detection-spec.md's Change Log (§10) or a separate audit-history file, to bound section growth. Done when: entries prior to 2026-07-01 are moved and §7.2 retains only the most recent audit.
• /spdd-analysis: Confirm CTR-022/CTR-023 rule additions (added per Change Log entries around 2026-08-03) have corresponding .lock.yml manifest schema notes reconciled per §7.3 Sync Protocol — verify no manifest field changes were required. Done when: a short note is added to §7.2 confirming Sync Protocol compliance for CTR-022/023.
• /spdd-sync: Verify docs/awf-config-spec.md CLI mapping table (external repo github/gh-aw-firewall) still covers all fields listed in specs/awf-config-sources-spec.md §5 "Known drift example" — this table is a point-in-time snapshot and may go stale. Done when: a drift-check run (per §7.3 example script) is executed and results are attached to a tracking comment.

Per-Spec Findings

specs/awf-config-sources-spec.md — Analysis / REASONS / Generate

• Goals: Ensure gh-aw stays reconciled with canonical AWF config sources in github/gh-aw-firewall; defines DriftRecord schema, CR-01...CR-06a conformance rules, and a degraded-mode safeguard for source unavailability.
• Risks: The §5 "Known drift example" table is a static snapshot that can silently go stale as gh-aw-firewall evolves; no automated re-verification cadence is defined beyond "weekly/daily" RECOMMENDED wording (not MUST).
• REASONS gaps: Operations — the snapshot cache path safeguard (§8) lacks a stated owner/verification step confirming it's actually wired into the scheduled workflow. Safeguards — otherwise well specified (7-day expiry, 14-day cleanup, degraded marking).
• Generate targets: .github/workflows/schema-consistency-checker.md (verify snapshot implementation); potential new test asserting snapshot expiry logic if implemented in Go.

specs/compiler-threat-detection-spec.md — Analysis / REASONS / Generate

• Goals: Normative catalog of CTR-001...CTR-023 compiler-side threat detection rules with implementation mapping (§7.1) and a daily optimizer maintenance protocol (§6).
• Risks: Self-identified test gap for Optimizer failure modes (§6, flagged in the spec's own audit log at §7.2) — safeguards specified but unverified by tests. §7.2 audit log is accumulating unbounded free-text entries across many merge dates, making the section harder to scan over time.
• REASONS gaps: Safeguards — good (systematic degraded/timeout/rate-limit handling); Operations — audit log format/rotation cadence unspecified.
• Generate targets: pkg/workflow/ new optimizer failure-mode tests; audit log archival mechanism (Change Log §10 or new file).

specs/forecast-compliance-fixtures/README.md — Analysis / REASONS / Generate

• Goals: Fixture catalog bootstrapping Section 12 compliance tests of the Forecast Specification; documents RunSummary schema mapping and Monte Carlo test entry points.
• Risks: Fixture table (test IDs T-FC-022/035/036, T-ET-006) is manually maintained prose with no automated cross-check against actual fixture files or the compliance spec's Section 12 test ID list — same class of drift risk as the AWF config spec.
• REASONS gaps: Structure — good (clear "Adding New Fixtures" process); Sync — no automated verification step exists.
• Generate targets: CI step or Go test asserting fixture file existence matches README table; verify against pkg/cli/forecast_montecarlo_test.go.

specs/github-mcp-access-control-compliance/README.md — Analysis / REASONS / Generate

• Goals: Formal predicate model (P1–P6, ALLOW(r,c)) and fixture-to-test-ID mapping for GitHub MCP access control compliance, backed by pkg/workflow/github_mcp_access_control_formal_test.go.
• Risks: Well-structured overall (best of the batch — formal model, evaluation order, error code reference all present). Minor risk: no explicit versioning/changelog for fixture additions, unlike the threat-detection spec's Change Log discipline.
• REASONS gaps: Norms — excellent (RFC-2119-style predicate ordering, explicit safety invariants SAFETY_BlockedUserAlwaysDenied/SAFETY_NoSpuriousAllow). Sync — could adopt a Change Log section like the threat-detection spec.
• Generate targets: TestFormal_FixtureRunner re-verification; optional Change Log addition.

specs/intent-attribution-agent-governance.md — Analysis / REASONS / Generate

• Goals: Defines deterministic intent attribution (mapped/unmapped/unlinked/ambiguous/suggested states), fail-closed execution policy, and risk classification for agent governance; large spec (1429 lines) with strong "Design principles" section (deterministic authority, unknown-is-not-zero, fail-closed, provenance-required).
• Risks: The "Compliance Fixtures" subsection (line 74) references fixture files under specs/intent-attribution-compliance/ but does not include an explicit fixture-to-predicate/state coverage table like the GitHub MCP access control README does — harder to audit fixture completeness at a glance.
• REASONS gaps: Entities — well modeled (Intent/Attribution/Policy/Outcome/Evidence, §"Core model"). Structure — could benefit from a compact coverage-map table mirroring the MCP access control spec's approach.
• Generate targets: New coverage-map table near line 74; potential Go test cross-referencing fixture files against attribution states enum (AttributionAmbiguous, etc. around line 521).

Sync Follow-ups

• File/track: verify .github/workflows/schema-consistency-checker.md implements the AWF config snapshot degraded-mode safeguard (§8 of awf-config-sources-spec.md); update spec or workflow to close any gap.
• File/track: add optimizer failure-mode tests referenced in compiler-threat-detection-spec.md §6/§7.2, then update the spec's audit log to mark the gap resolved.
• File/track: add fixture-count consistency checks for both compliance fixture READMEs (forecast + GitHub MCP access control) so future spec edits can't silently desync from pkg/cli/ and pkg/workflow/ test suites.
• Next rotation (index 11 of 18) should continue with specs/otel-observability-spec.md, specs/replace-label-compliance/README.md, specs/replace-label-spec.md, specs/safe-output-outcome-evaluation.md, specs/security-architecture-spec-summary.md.

Context

• Files reviewed this run (rotation slots 6–10 of 18): specs/awf-config-sources-spec.md, specs/compiler-threat-detection-spec.md, specs/forecast-compliance-fixtures/README.md, specs/github-mcp-access-control-compliance/README.md, specs/intent-attribution-agent-governance.md
• Rotation state persisted to /tmp/gh-aw/cache-memory/spdd-daily/rotation.json (last_index: 6, last_run: 2026-08-03T16:42:27Z, total_files: 18)
• Workflow run: §30833176830

Generated by 📋 Daily SPDD Spec Planner · auto · 48.2 AIC · ⌖ 2.78 AIC · ⊞ 6.9K · ◷

• expires on Aug 6, 2026, 8:46 AM UTC-08:00