[spdd] Daily spec work plan - 2026-06-24

[github-actions]

Summary

SPDD review of 5 spec files: security architecture cluster + MCP access control group. Rotation batch: indices 11–13 + wrap 0–1 (14 files total tracked). One P0 implementation gap found (compile-time lockdown warning), one spec prose error (layer count), and several norms/sync gaps across four specs.

Files: specs/security-architecture-spec-summary.md, specs/security-architecture-spec-validation.md, specs/security-architecture-spec.md, scratchpad/github-mcp-access-control-specification.md, scratchpad/guard-policies-specification.md

---

Priority Work Queue

P0 — Implementation gap

• Emit compile-time warning in pkg/workflow/tools_validation.go (validateGitHubGuardPolicy()) when lockdown: true co-exists with guard-policy fields. Marked Partial in divergence audit of github-mcp-access-control-specification.md §9.5.2.

P1 — Spec correctness

• Fix "six independent security layers" → "seven" in specs/security-architecture-spec.md §3.1 (Layers 0–6 = 7 layers).
• Add GP-11 normative requirement to scratchpad/guard-policies-specification.md: min-integrity MUST be present when allowed-repos is non-"all" (currently prose only in §Validation Rules).
• Clarify §4.4.1 heading in scratchpad/github-mcp-access-control-specification.md: repos (gateway-internal) vs allowed-repos (frontmatter key) — resolve line 2682 divergence note.
• Complete ⏳ pending "spec-to-lock sync note" in specs/security-architecture-spec-summary.md mapping version 1.0.0 to validated compiler behaviors.

P2 — Maintenance

• Add normative cross-refs to guard-policies and MCP access-control specs in specs/security-architecture-spec.md §References.
• Add revalidation cadence section to specs/security-architecture-spec-validation.md.
• Promote 3 Minor Discrepancy recommendations in validation doc to tracked rows in summary maintenance table.
• Add Documentation Tasks stub to scratchpad/guard-policies-specification.md §Next Steps with target file/page paths.

---

SPDD Checklist

• [/spdd-generate, P0] Add warning in pkg/workflow/tools_validation.go when lockdown: true + guard-policy fields co-exist. Done: go test ./pkg/workflow/ -run TestValidateGitHub passes; warning appears in compilation output.
• [/spdd-generate, P1] Fix layer count in specs/security-architecture-spec.md §3.1: "six" → "seven independent security layers". Done: text matches Layer 0–6 enumeration.
• [/spdd-generate, P1] Add GP-11 to scratchpad/guard-policies-specification.md §Conformance: min-integrity MUST be present when allowed-repos is non-"all". Done: requirement added; tools_validation.go confirmed consistent.
• [/spdd-generate, P1] Fix §4.4.1 heading in scratchpad/github-mcp-access-control-specification.md to distinguish repos (gateway field) from allowed-repos (frontmatter). Done: divergence audit note at line 2682 resolved.
• [/spdd-generate, P1] Add "Spec-to-Lock Sync" section to specs/security-architecture-spec-summary.md. Done: maps v1.0.0 to minimum validated .lock.yml behaviors per validation report.
• [/spdd-sync, P2] Add normative refs to guard-policies-specification.md and github-mcp-access-control-specification.md in specs/security-architecture-spec.md §References. Done: both listed with path and version.
• [/spdd-sync, P2] Add revalidation cadence section to specs/security-architecture-spec-validation.md (≥3 triggers defined). Done: section names triggers and references the validation procedure.
• [/spdd-analysis, P2] Convert 3 Minor Discrepancy recommendations from specs/security-architecture-spec-validation.md into tracked rows in specs/security-architecture-spec-summary.md maintenance table. Done: 3 new rows added (Status=Pending).
• [/spdd-generate, P2] Add Documentation Tasks section to scratchpad/guard-policies-specification.md with target paths for 3 pending doc items. Done: each item has a file path and done condition.
• [/spdd-analysis, P2] Audit whether trusted-users runtime enforcement (§4.4.6 github-mcp-access-control-specification.md) is covered in specs/security-architecture-spec.md §8 or §9. Done: gap documented or §8/§9 updated.
• [/spdd-sync, P2] Verify T-Tweaks to docs, gh aw help and notice #47–060 test IDs (added in v1.1.0) are mirrored or noted in specs/security-architecture-spec.md §12. Done: either added or gap note present.
• [/spdd-reasons-canvas, P2] Add safeguards note to scratchpad/guard-policies-specification.md GP-05/GP-06 covering behavior if deriveSafeOutputsGuardPolicyFromGitHub() produces a malformed write-sink. Done: normative or informative note added.

---

Per-Spec Findings

security-architecture-spec-summary.md — 1 pending task, 3 untracked recommendations

• ⏳ Pending: "Add spec-to-lock sync note" (sole unresolved row in maintenance table).
• 3 Minor Discrepancy recommendations from validation doc not tracked here (pre-activation note, detection job Appendix D example, conclusion job note).
• REASONS gaps: Operations (sync note), Safeguards (none in summary).

security-architecture-spec-validation.md — no cadence, recommendations untracked

• No revalidation cadence defined; last run 2026-05-15.
• 3 recommendations in §Minor Discrepancies not converted to tracked tasks.
• REASONS gaps: Operations (cadence missing), Safeguards (no fail-path for failed validation).

security-architecture-spec.md (74 KB, v1.0.0 CR) — layer count error, missing companion refs

• §3.1 says "six independent security layers" but Layers 0–6 = 7 layers.
• §References missing guard-policies-specification.md and github-mcp-access-control-specification.md.
• REASONS: Requirements and Safeguards excellent; Approach doesn't cross-ref companion specs.

github-mcp-access-control-specification.md (100 KB, v1.1.0 Draft) — partial impl, heading ambiguity

• P0 Partial: §9.5.2 compile-time warning for lockdown + guard policies co-presence not yet emitted in code (divergence audit 2026-06-21).
• §4.4.1 heading ambiguity: "repos" vs frontmatter key "allowed-repos" (line 2682).
• REASONS: Safeguards partial (compile-time warning unimplemented); Norms strong (2 conformance classes).

guard-policies-specification.md (v0.1.0 Draft) — missing GP-11, deferred runtime impl

• min-integrity presence constraint stated in prose only; no GP-XX normative requirement.
• GP-10 SHOULD warning (lockdown + guard policies) not yet implemented — same as P0 above.
• §Next Steps item 3 "Runtime Implementation" deferred with no tracking reference.
• 3 documentation sub-tasks in §Next Steps lack target paths or done conditions.
• REASONS: Norms have GP-10 SHOULD gap; Operations missing deferred runtime tracking; Safeguards absent for malformed write-sink.

---

Sync Follow-ups

• pkg/workflow/tools_validation.go changes → update Divergence Audit in github-mcp-access-control-specification.md; rerun go test ./pkg/workflow/ -run TestValidateGitHub.
• specs/security-architecture-spec.md MUST-level requirement change → trigger revalidation in security-architecture-spec-validation.md, update grade table.
• guard-policies-specification.md reaches v1.0.0 → update security-architecture-spec-summary.md Implementation Status; add to security spec normative refs.
• github-mcp-access-control-specification.md reaches v1.1.0 Final → cross-check T-Tweaks to docs, gh aw help and notice #47–060 against security-architecture-spec.md §12.
• Guard-policies runtime implementation complete → update github-mcp-access-control-specification.md §10 with actual enforcement behavior.

---

Context

Item	Value
Files reviewed	5 (indices 11–13 + wrap 0–1 of 14)
Rotation index after run	1 / 14
Previous rotation index	9 / 13
New unprocessed file	specs/forecast-compliance-fixtures/README.md (index 6, picked up next rotation)
Run date	2026-06-24
Workflow run	§28114033826

References:

• §28114033826

Generated by 📋 Daily SPDD Spec Planner · 92.7 AIC · ⌖ 11 AIC · ⊞ 4.7K · ◷

• expires on Jun 27, 2026, 8:46 AM UTC-08:00

[github-actions]

This issue was automatically closed because it expired on 2026-06-27T16:46:59.676Z.

Closed by Workflow