[spdd] Daily spec work plan - 2026-08-18

[github-actions]

Summary

Daily SPDD review of 5 spec files (rotation indices 0–4): awf-config-sources-spec.md + its compliance fixture README, compiler-threat-detection-spec.md + its compliance map README, and forecast-compliance-fixtures/README.md. Overall these specs are mature (RFC 2119 norms, formal JSON Schemas, test-ID catalogs), but each has concrete gaps in synchronization, ambiguous coverage, or missing safeguard tests that should be closed today.

Priority Work Queue

• P0: Fix T-CTR-025 test-ID collision in compiler-threat-detection-spec.md (§6.4 item 2 and §8.1 both reference T-CTR-025 for different requirements — one for suppression audit trail, one superseded by T-CTR-039 for CTR-025 rule).
• P0: Verify the automated drift-detection workflow (schema-consistency-checker.md) actually implements the CR-06a escalation-owner assignment logic described in awf-config-sources-spec.md; no implementation file is cited for CR-06a.
• P1: Add missing compliance test-ID rows for CR-06a (owner assignment/acknowledgement) to awf-config-sources-compliance/README.md — currently only DriftRecord (T-DR-001–010) and safeguards (T-DR-SAFE-001–004) are tracked, CR-06/CR-06a escalation-issue behavior has no test ID.
• P1: Add a run_summary_missing_updatedat.json (or similar edge-case) fixture to forecast-compliance-fixtures/README.md to cover in-progress/malformed timestamp handling, since duration computation depends on updatedAt/startedAt and only a partial-ET fixture exists for in-progress runs.
• P2: Clarify in compiler-threat-detection-spec.md §6.6 whether OPTIMIZER_DEGRADED and OPTIMIZER_TIMEOUT states are mutually exclusive or can co-occur in the same run (ambiguous interaction between T-CTR-030 and T-CTR-033).
• P2: Cross-link awf-config-sources-spec.md Known Drift Example table (§5) forward to T-DR-* test IDs so each apiProxy field's drift status is traceable to a conformance test, matching the pattern already used for DriftRecord.

SPDD Checklist

• /spdd-sync: Resolve duplicate T-CTR-025 reference in specs/compiler-threat-detection-spec.md (lines ~221 and ~382) — rename one occurrence or renumber per the Section 8.1 sequential allocation rule; done when no test ID is bound to two distinct requirements.
• /spdd-generate: Implement/verify CR-06a owner-assignment logic in the schema-consistency-checker workflow or equivalent Go code under pkg/workflow/; done when a code path or test file demonstrably implements git-log-based owner lookup with on-call fallback.
• /spdd-generate: Add T-DR-CR06-001+ test IDs for CR-06/CR-06a SLA and escalation-owner behavior to specs/awf-config-sources-compliance/README.md; done when the table has new rows referencing an implementing test file.
• /spdd-generate: Create run_summary_missing_updatedat.json fixture and document it in specs/forecast-compliance-fixtures/README.md; done when the fixture exists and is referenced by a T-FC-* test ID.
• /spdd-analysis: Clarify OPTIMIZER_DEGRADED vs OPTIMIZER_TIMEOUT interaction in specs/compiler-threat-detection-spec.md §6.6; done when the spec text explicitly states precedence or co-occurrence rules.
• /spdd-sync: Add forward cross-references from §5 apiProxy drift table rows to T-DR-* IDs in specs/awf-config-sources-spec.md; done when each table row links to a test ID or explicitly states "not yet tracked".
• /spdd-reasons-canvas: Add an explicit "Entities" subsection cross-reference for RunSummary in forecast-compliance-fixtures/README.md pointing to the full JSON Schema (not just the Go struct), since only pkg/cli/logs_models.go is cited; done when schema location is documented or noted as absent.
• /spdd-sync: Confirm pkg/workflow/compiler_threat_optimizer_protocol_test.go test names actually match T-CTR-024 through T-CTR-038 IDs 1:1 (spot check for drift between spec and Go); done when a go test -list run output is diffed against the compliance table.

Per-Spec Findings

specs/awf-config-sources-spec.md + specs/awf-config-sources-compliance/README.md

• Goals: Bind AWF config schema/spec sources in gh-aw-firewall to gh-aw implementation via DriftRecord entity and CR-01...CR-06a norms.
• Risks: CR-06a escalation-owner logic (git-log-based lookup with on-call fallback) has no cited implementation file or test ID — process is normative text only, unverified in code.
• Missing/weak REASONS sections: Norms (CR-06a) and Safeguards are well specified; Sync coverage is incomplete — the compliance README's DriftRecord and safeguard tests don't cover CR-05/CR-06/CR-06a corrective-PR or escalation-issue triggers with dedicated test IDs (only referenced narratively in T-DR-006/007).
• Ambiguity: §5 "Known drift example" table lists apiProxy fields but doesn't state whether they are currently resolved/open drift items or purely illustrative.

specs/compiler-threat-detection-spec.md + specs/compiler-threat-detection-compliance/README.md

• Goals: Normative rule catalog (CTR-001...CTR-025) for compiler threat detection, false-positive suppression protocol, and optimizer failure safeguards.
• Risks: T-CTR-025 is used for two different requirements (§6.4 item 2 audit-trail requirement, and originally CTR-025 rule before renumbering to T-CTR-039 per the 1.0.24 changelog) — the changelog claims this was resolved ("without colliding with optimizer-protocol IDs T-CTR-024 through T-CTR-038") but line 382 in the norms table still shows T-CTR-025 for the suppression-audit norm, which does collide conceptually if not numerically distinct in the shared sequence. Needs a fresh read to confirm no actual runtime collision exists.
• Missing/weak sections: Operations — §6.6 doesn't define precedence when both timeout and degraded conditions could apply to a single optimizer invocation.
• Structure: Multiple test-ID sequences (rule catalog, false-positive norms, optimizer safeguards) share one numeric pool — good practice, but the compliance README doesn't explicitly document the shared-sequence allocation algorithm for future additions beyond "increment from last used ID."

specs/forecast-compliance-fixtures/README.md

• Goals: Bootstrap fixtures for RunSummary Monte Carlo forecast compliance tests (T-FC-, T-ET-).
• Risks: Fixture set covers zero-ET, failed, high-ET, cancelled, and partial-ET runs but not missing/malformed timestamp fields (updatedAt/startedAt), which the duration computation directly depends on.
• Missing/weak sections: Entities — no explicit link to a formal JSON Schema for RunSummary, only a Go struct reference (pkg/cli/logs_models.go), making external validation harder.
• Approach: "Adding New Fixtures" guidance is clear and actionable; good template to replicate for other compliance fixture directories.

Sync Follow-ups

• After resolving the T-CTR-025 naming ambiguity, re-run go test -run "TestThreatSuppression|TestThreatOptimizer" ./pkg/workflow/ and cross-check output test names against the compliance README table to confirm 1:1 mapping holds.
• After adding CR-06a test IDs, update awf-config-sources-spec.md §6 Norms section to forward-reference the new fixture README rows (mirroring the existing DriftRecord backlink pattern).
• After adding the missing-timestamp fixture, re-run go test -v -run "TestForecast|TestMonteCarlo" ./pkg/cli/ and add the new fixture's test ID and file name to the Fixture Files table.
• Track completion of these follow-ups in the next daily rotation pass to confirm files without processed changes don't silently regress.

Context

Files reviewed this run (rotation indices 0–4, last_index now 5):

• specs/awf-config-sources-compliance/README.md
• specs/awf-config-sources-spec.md
• specs/compiler-threat-detection-compliance/README.md
• specs/compiler-threat-detection-spec.md
• specs/forecast-compliance-fixtures/README.md

Rotation state: persisted to /tmp/gh-aw/cache-memory/spdd-daily/rotation.json; next run will continue from specs/github-mcp-access-control-compliance/README.md.

Run URL: https://github.com/github/gh-aw/actions/runs/32157710053

Generated by 📋 Daily SPDD Spec Planner · auto · 28.2 AIC · ⌖ 6.1 AIC · ⊞ 7.2K · ◷

• expires on Aug 21, 2026, 8:04 AM UTC-08:00