[spdd] Daily spec work plan - 2026-09-02

[github-actions]

Summary

Daily SPDD review of 5 files (rotation index 2→7 of 19): specs/compiler-threat-detection-compliance/README.md, specs/compiler-threat-detection-spec.md, specs/forecast-compliance-fixtures/README.md, specs/github-mcp-access-control-compliance/README.md, specs/intent-attribution-agent-governance.md. The threat-detection spec/compliance pair is well-synced with an explicit audit trail, but §6.6 Optimizer Failure Safeguards still lacks dedicated tests (a gap the spec's own §7.2 audit already flags). The GitHub MCP access-control compliance README documents a manual-only drift guard with no CI enforcement, and the intent-attribution governance doc's escalation norm (3+ consecutive CI sync-warning runs → compliance failure) has no verified implementing check.

Priority Work Queue

• P0: Wire up (or confirm absent) automated CI enforcement for the intent-attribution "3+ consecutive CI runs" escalation norm; today it is a specified-but-unverified control.
• P0: Add unit/integration coverage for the three Optimizer Failure Safeguards (OPTIMIZER_DEGRADED, OPTIMIZER_TIMEOUT, OPTIMIZER_RATE_LIMITED) — flagged as a known gap in the spec's own audit log.
• P1: Convert the pinned-spec-drift check in specs/github-mcp-access-control-compliance/README.md from a manual/local-only script into an enforced CI guard, or explicitly document why it remains manual.
• P1: Split specs/intent-attribution-agent-governance.md per its own "Non-normative maintenance split proposal" to reduce single-file review risk.
• P2: Tighten Norms language in specs/compiler-threat-detection-spec.md §7.3 sync protocol to specify enforcement tooling name (currently says "CI policy MUST fail" without naming the check).
• P2: Add a Sync note to specs/forecast-compliance-fixtures/README.md describing what happens if pkg/cli/logs_models.go's RunSummary schema changes shape.

SPDD Checklist

• /spdd-analysis: Verify whether any CI workflow currently exercises the §6.6 Optimizer Failure Safeguards diagnostic paths (OPTIMIZER_DEGRADED, OPTIMIZER_TIMEOUT, OPTIMIZER_RATE_LIMITED) in pkg/workflow/; document findings in the spec's Section 10 change log.
• /spdd-generate: Add Go tests in pkg/workflow/compiler_threat_optimizer_protocol_test.go (or a new file) covering T-CTR-030 through T-CTR-038 and T-CTR-040 safeguard behaviors, per specs/compiler-threat-detection-compliance/README.md §6.6 table.
• /spdd-generate: Implement an automated CI job (e.g., a go test or shell check in .github/workflows/) that runs the pinned-commit drift check documented in specs/github-mcp-access-control-compliance/README.md (Sync Guard section), replacing the current manual-only instruction.
• /spdd-generate: Implement the intent-attribution escalation norm check (3+ consecutive CI sync-warning runs → fail + open/update tracking issue) referenced in specs/intent-attribution-agent-governance.md § Sync Notes; target a new or existing CLI/CI script under pkg/cli/ or .github/workflows/.
• /spdd-generate: Execute the "Non-normative maintenance split proposal" in specs/intent-attribution-agent-governance.md (lines 140-154): extract "Current implementation" + runtime enforcement map into specs/intent-attribution-agent-governance-implementation.md, keeping RFC 2119 norms in the main file.
• /spdd-reasons-canvas: Review specs/forecast-compliance-fixtures/README.md Structure/Operations sections for a missing note on schema-change handling for RunSummary (pkg/cli/logs_models.go); add a Sync note if the schema is expected to evolve.
• /spdd-sync: After any CTR rule catalog change, verify Section 5.1, 7.1, and 8.1 of specs/compiler-threat-detection-spec.md plus the crosswalk table in specs/compiler-threat-detection-compliance/README.md are updated together, per the existing §7.3 Sync Protocol — add an automated check if one does not already exist.
• /spdd-sync: Re-verify specs/github-mcp-access-control-compliance/README.md's pinned commit (36dc9545032b6ac02ed719c725b88368d7e34d23) still matches the live tip of scratchpad/github-mcp-access-control-specification.md; update the pin or the spec if drifted.
• /spdd-sync: Confirm TestFormal_ComplianceReadmeNormTestNamesStaySynced (referenced in specs/compiler-threat-detection-compliance/README.md) still passes and covers any newly added T-CTR-* rows.

Per-Spec Findings

specs/compiler-threat-detection-spec.md + specs/compiler-threat-detection-compliance/README.md

Goals: Define a normative CTR-* threat-detection rule catalog, compiler response requirements, deprecation policy, and a daily optimizer maintenance protocol with compliance test IDs.

Risks: §6.6 Optimizer Failure Safeguards (API unavailability, runner timeout, rate limiting) are specified with MUST-level language but the spec's own §7.2 audit (2026-07-31 cycle) explicitly flags them as an untested coverage gap — this has now persisted across at least one further audit cycle (2026-08-31) without a fix landing.

Missing constraints: §7.3 Sync Protocol says "CI policy MUST fail the change as out-of-sync" but does not name the enforcing check/tool, making the norm unverifiable without additional investigation.

Ambiguous requirements: None found beyond the above; the compliance crosswalk (README) is otherwise tightly mechanically enforced via TestFormal_ComplianceReadmeNormTestNamesStaySynced.

REASONS gaps: Safeguards section (§6.6) is normatively strong but Operations (implementing tests) lags; Structure (§7.1/7.3) is solid.

specs/forecast-compliance-fixtures/README.md

Goals: Document fixture files and formal Monte Carlo model behavior for forecast compliance testing (pkg/cli/forecast_montecarlo_test.go, forecast_test.go).

Risks: Low — well-specified formal model (Poisson/Bernoulli/bootstrap), explicit boundary conditions (λ=15 crossover, high-ET overflow), and a formal test (TestFormal_ForecastSpecSyncNoteAnchorsExist) that mechanically prevents anchor drift.

Missing constraints: No documented behavior for what happens if the RunSummary JSON schema in pkg/cli/logs_models.go changes shape (e.g., renamed/removed fields) — fixtures could silently go stale.

REASONS gaps: Norms (schema evolution handling) and Sync (schema-change follow-up) are the weakest sections; Requirements/Entities/Approach are strong.

specs/github-mcp-access-control-compliance/README.md

Goals: Provide fixture stubs and a formal predicate model (P1–P6 guards) for GitHub MCP access-control decisions, pinned to a specific spec commit.

Risks: The pinned-commit drift guard is explicitly documented as manual/local-only with no CI workflow currently invoking it — meaning spec drift could go undetected indefinitely between manual reviews.

Missing constraints: No automated schedule or trigger for re-running the drift check; relies entirely on reviewer discipline before merges touching the pinned spec file.

Ambiguous requirements: None in the formal model itself — P1–P6 predicates and evaluation order are precisely defined and covered by TestFormal_* tests.

REASONS gaps: Safeguards (drift enforcement) is the weak point; Structure/Operations (fixture schema, error codes) are thorough and well cross-referenced.

specs/intent-attribution-agent-governance.md

Goals: Define deterministic intent attribution, risk classification, execution policy (propose_only/supervised/bounded), and enforcement for agent governance, with a phased rollout (Phase 1–7) and release gates.

Risks: The "Escalation norm" (3+ consecutive CI sync-warning runs → mandatory compliance failure + tracking issue) is a strong MUST-level requirement but there is no visible reference to an implementing check in the reviewed excerpt — risk that sync warnings could persist silently without escalation ever firing.

Missing constraints: The "fully migrate" definition (all intent keys in .github/intent-policy.json) has no deadline, which is called out as intentional, but there's also no owner/checkpoint for periodically re-assessing migration progress.

Ambiguous requirements: The self-documented "Non-normative maintenance split proposal" acknowledges this file is large enough to carry review risk but has not yet been executed — this is a known-but-unaddressed structural debt.

REASONS gaps: Safeguards (fail-closed, no stale cache reuse) and Norms (RFC 2119) sections are strong; Structure (single 1445-line file) and Sync (escalation enforcement) are the weakest.

Sync Follow-ups

• After adding §6.6 Optimizer Failure Safeguards tests, update specs/compiler-threat-detection-spec.md §7.2 Mapping Audit and §10 Change Log to record the closed gap.
• After implementing the intent-attribution escalation-norm check, update specs/intent-attribution-agent-governance.md § Sync Notes to reference the concrete CI job/script name.
• After converting the GitHub MCP access-control drift guard to automated CI, update specs/github-mcp-access-control-compliance/README.md to remove the "manual/local-only" caveat and link the workflow file.
• If specs/intent-attribution-agent-governance.md is split per its own proposal, update all cross-references from specs/intent-attribution-compliance/README.md to the new companion file.

Context

Files reviewed this run (rotation index 2 → 7 of 19 total spec files):

• specs/compiler-threat-detection-compliance/README.md
• specs/compiler-threat-detection-spec.md
• specs/forecast-compliance-fixtures/README.md
• specs/github-mcp-access-control-compliance/README.md
• specs/intent-attribution-agent-governance.md

Rotation state: /tmp/gh-aw/cache-memory/spdd-daily/rotation.json updated to last_index: 7, last_run: 2026-09-02T15:55:11Z.

Run URL: https://github.com/github/gh-aw/actions/runs/33651389596

Generated by 📋 Daily SPDD Spec Planner · copilot · auto · 35.1 AIC · ⌖ 12.2 AIC · ⊞ 7.2K · ◷

• expires on Sep 5, 2026, 8:00 AM UTC-08:00