[spdd] Daily spec work plan - 2026-07-16

[github-actions]

Summary

This daily SPDD plan covers 5 specification files (rotation index 15–19 of 30). The batch includes the Security Architecture Validation doc, the Security Architecture Specification itself, the AI Credits Specification, the Bash Command Parser Specification, and the Checkout Behavior Specification. Key gaps span missing safeguard tests, incomplete sync notes, and several REASONS Canvas sections that need strengthening — particularly in Norms, Safeguards, and Sync Follow-ups.

---

Priority Work Queue

Priority	Task	Spec
P0	Add missing checkout-manifest rejection unit tests (absolute path / workspace escape)	checkout-behavior-specification.md
P0	Document DriftRecord compliance test coverage in awf-config-sources-spec	specs/awf-config-sources-spec.md
P1	Strengthen Norms section in AI Credits spec (SLA for catalog staleness)	ai-credits-specification.md
P1	Add Safeguards subsection to Bash Command Parser spec (empty-result default-deny under-specified)	bash-command-parser-specification.md
P1	Add Sync Notes entry to Security Architecture spec (validation doc cross-reference)	security-architecture-spec.md
P2	Add Operations ordering note to Checkout Behavior spec	checkout-behavior-specification.md
P2	Add Entities section to AI Credits spec (AICRecord, PricingCatalogEntry, InvocationRecord)	ai-credits-specification.md
P2	Verify canonical cross-links in deprecated scratchpad safe-outputs spec are current	scratchpad/safe-outputs-specification.md

---

SPDD Checklist

• /spdd-analysis docs/src/content/docs/specs/checkout-behavior-specification.md — §3.4 checkout-manifest path-escape rejection lacks a compliance test ID; assign T-CB-xxx and add to §7. Done when test ID is present in §7.
• /spdd-reasons-canvas docs/src/content/docs/specs/checkout-behavior-specification.md — Safeguards section is thin: add explicit MUST-level norm that safe-outputs-github-app tokens MUST NOT be written to disk before the safe_outputs job begins.
• /spdd-generate docs/src/content/docs/specs/ai-credits-specification.md — add an Entities subsection (§3.0a) defining AICRecord, PricingCatalogEntry, and InvocationRecord with required fields; done when entities table exists and is cross-referenced from §3.3.
• /spdd-generate docs/src/content/docs/specs/ai-credits-specification.md — Norms gap: §5 lacks a catalog-staleness SLA. Add a SHOULD-level norm: catalog older than 7 days SHOULD trigger a re-sync warning. Done when norm is present in §5.
• /spdd-generate docs/src/content/docs/specs/bash-command-parser-specification.md — add ### Safeguards to §11 Security Considerations: (a) empty-list result MUST produce default-deny, (b) parse errors MUST NOT silently allow execution. Done when both norms have MUST-level language.
• /spdd-sync specs/security-architecture-spec.md — add ### Sync Notes section cross-referencing specs/security-architecture-spec-validation.md and noting revalidation date 2026-07-15. Done when section exists.
• /spdd-sync specs/awf-config-sources-spec.md — §6.5 defines DriftRecord but no compliance test file tracks it; create specs/awf-config-sources-compliance/README.md listing DriftRecord conformance test IDs. Done when file exists referencing §6.5.
• /spdd-analysis docs/src/content/docs/specs/checkout-behavior-specification.md — §4 states github-token and github-app MUST be mutually exclusive but does not specify compiler error message format; add normative error message spec to §4. Done when error format is defined.

---

Per-Spec Findings

specs/security-architecture-spec-validation.md — Validation doc (index 15)

/spdd-analysis

• Goals: Cross-reference security spec requirements against .lock.yml and JS implementation.
• Status: Revalidated 2026-07-15; all major sections verified except sandbox isolation (partial).
• Risks: Validation is manual and snapshot-based — no automated re-run schedule.
• Missing constraints: No CI job runs this validation; drift could accumulate silently.

/spdd-reasons-canvas

Section	Gap
Requirements	No traceability matrix linking spec requirement IDs to validation evidence
Safeguards	No behavior specified when validation fails to locate a .lock.yml
Norms	No staleness SLA for re-running validation
Sync	No explicit sync trigger on spec change

/spdd-generate

• Add a ### Sync Trigger note: re-run whenever security-architecture-spec.md changes.

/spdd-sync

• Cross-link to the spec ### Change Log so future spec entries prompt a revalidation run.

specs/security-architecture-spec.md — Security Architecture Spec v1.0.0 (index 16)

/spdd-analysis

• Goals: Formal W3C-style spec for defense-in-depth security (7 layers, 3 conformance classes).
• Status: Candidate Recommendation; comprehensive.
• Risks: Sandbox isolation (SG-05) marked partially evidenced; no Sync Notes back-reference to companion validation doc.

/spdd-reasons-canvas

Section	Gap
Sync	No reference to specs/security-architecture-spec-validation.md
Norms	SG-05 sandbox isolation note should state host-visibility proof is outstanding

/spdd-generate

• Add ### Sync Notes section pointing to companion validation document.

/spdd-sync

• Trigger policy: Change Log additions MUST prompt a validation doc re-run.

docs/src/content/docs/specs/ai-credits-specification.md — AI Credits v1.4.0 (index 17)

/spdd-analysis

• Goals: Define AIC unit, models.json pricing catalog format, Copilot billing alignment.
• Status: Draft, well-structured; 3 compliance levels; catalog sync addressed in §5.
• Risks: No Entities section — AICRecord, InvocationRecord, PricingCatalogEntry used throughout but never formally defined. Catalog staleness SLA absent from §5.
• Ambiguities: §3.3 references formula but no entity model; §5 sync interval is implicit.

/spdd-reasons-canvas

Section	Gap
Entities	Missing: AICRecord, PricingCatalogEntry, InvocationRecord
Norms	Catalog-staleness SLA not defined in §5
Operations	Catalog fetch vs computation ordering is implied, not explicit

/spdd-generate

• Add §3.0a Entities subsection with entity table and cross-reference from §3.3.
• Add catalog-staleness SHOULD norm to §5.

/spdd-sync

• Add sync note: when models.json schema changes, §8 compliance tests MUST be updated in the same PR.

docs/src/content/docs/specs/bash-command-parser-specification.md — Bash Command Parser v1.1.0 (index 18)

/spdd-analysis

• Goals: Formalize bash command parser for permission gating.
• Status: Draft; conformance classes, grammar, and semantics well-covered.
• Risks: Default-deny norm is in §2.2 Class I but §11 Security Considerations does not consolidate it. Parse-error behavior is unspecified.

/spdd-reasons-canvas

Section	Gap
Safeguards	§11 lacks a Safeguards subsection consolidating deny-on-error norms
Norms	Parse-error → deny path not normatively stated
Sync	No sync note linking to actions/setup/js/ implementation

/spdd-generate

• Strengthen §11 with ### Safeguards covering both empty-list default-deny and parse-error default-deny.

/spdd-sync

• Add sync note: implementation changes in actions/setup/js/ MUST trigger a spec version bump.

docs/src/content/docs/specs/checkout-behavior-specification.md — Checkout Behavior v1.0.0 (index 19)

/spdd-analysis

• Goals: Define normative checkout compilation for activation, agent, safe_outputs jobs.
• Status: Working Draft; comprehensive on token precedence, sparse/shallow, trial mode.
• Risks: §3.4 checkout-manifest path-escape rejection has no compliance test ID. §4 mutual-exclusion rule for github-token + github-app lacks a normative error message.

/spdd-reasons-canvas

Section	Gap
Safeguards	Token-to-disk prohibition stated but no MUST-level norm with test ID
Structure	§7 compliance tests do not cover path-escape rejection
Norms	Compiler error message format for mutual-exclusion violations unspecified
Operations	Entry merge precedence table lacks multi-checkout ordering note

/spdd-generate

• Add T-CB-xxx compliance test ID for path-escape rejection to §7.
• Specify normative compiler error message in §4 for auth field conflict.

/spdd-sync

• Add sync note: any change to pkg/workflow/ checkout generation MUST include a §3 table update and new test ID in §7.

---

Sync Follow-ups

• specs/security-architecture-spec.md → add ### Sync Notes cross-referencing companion validation doc; assign to next available maintainer.
• docs/src/content/docs/specs/ai-credits-specification.md → models.json schema changes MUST trigger §8 compliance test update in the same PR.
• docs/src/content/docs/specs/bash-command-parser-specification.md → actions/setup/js/ parser changes MUST trigger a spec version bump.
• docs/src/content/docs/specs/checkout-behavior-specification.md → pkg/workflow/ checkout compilation changes MUST include §3 table update + new §7 compliance test ID.
• specs/security-architecture-spec-validation.md → add CI trigger: re-run validation whenever security-architecture-spec.md Change Log receives a new entry.

---

Context

• Files reviewed (rotation 15–19 of 30):
  1. specs/security-architecture-spec-validation.md
  2. specs/security-architecture-spec.md
  3. docs/src/content/docs/specs/ai-credits-specification.md
  4. docs/src/content/docs/specs/bash-command-parser-specification.md
  5. docs/src/content/docs/specs/checkout-behavior-specification.md
• Next rotation: will start at index 20 (5 files remaining before wrap-around at 30).
• Workflow run: §29514874303

References:

• §29514874303

Generated by 📋 Daily SPDD Spec Planner · 51.8 AIC · ⌖ 8.01 AIC · ⊞ 4.8K · ◷

• expires on Jul 19, 2026, 8:26 AM UTC-08:00