[spdd] Daily spec work plan - 2026-07-16 (rotation 15–19) by Copilot · Pull Request #46044 · github/gh-aw

Copilot · 2026-07-16T16:27:00Z

Addresses 8 SPDD checklist items across 5 spec files: missing compliance test IDs, underspecified safeguards, absent entity definitions, and sync cross-references.

`checkout-behavior-specification.md`

§3.4: Cross-references new T-CHK-014
§4.0 (new): Normative compiler error message format for github-token/github-app mutual exclusivity — format includes the offending repository value
§7.1: Added T-CHK-014 — runtime MUST reject manifest paths that are absolute or escape workspace root
§7.3 (new): Safeguards section with three MUST-level norms: safe-outputs-github-app tokens MUST NOT be written to disk before the safe_outputs job begins; manifest path rejection; credential cleanup scope

`ai-credits-specification.md`

§3.7 (new): Entities subsection — formal field tables for AICRecord, PricingCatalogEntry, InvocationRecord; cross-referenced from §3.3 and §4
§5.5 (new): Catalog Staleness SLA — catalog ≥7 days old SHOULD emit a re-sync warning including last-sync timestamp and elapsed days (SHOULD-level; suppression is not permitted)

`bash-command-parser-specification.md`

§11.3 (new): Safeguards subsection with two MUST-level norms: empty extractCommandNamesFromPipeline result MUST default-deny; parse errors MUST NOT silently allow execution

`security-architecture-spec.md`

Sync Notes → Last Revalidation (new subsection): Records 2026-07-15 revalidation date against specs/security-architecture-spec-validation.md

`specs/awf-config-sources-compliance/README.md` (new file)

Compliance fixture directory for DriftRecord (§6.5 of awf-config-sources-spec.md)
Defines test IDs T-DR-001–T-DR-010 covering required fields, enum values, timestamp format, corrective PR trigger, SLA escalation, and empty-list no-op behavior

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

- checkout-behavior-specification: add T-CHK-014 path-escape test ID, normative compiler error message format for mutual exclusivity (§4.0), and §7.3 Safeguards section with MUST-level norms - ai-credits-specification: add §3.7 Entities subsection (AICRecord, PricingCatalogEntry, InvocationRecord) and §5.5 catalog staleness SLA - bash-command-parser-specification: add §11.3 Safeguards with empty-result default-deny and parse-error denial MUST norms - security-architecture-spec: add Last Revalidation note (2026-07-15) to existing Sync Notes section - specs/awf-config-sources-compliance/README.md: new file with DriftRecord conformance test IDs T-DR-001 through T-DR-010 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Expands gh-aw specifications with compliance IDs, safeguards, entity schemas, and validation metadata, alongside regenerated workflow outputs.

Changes:

Adds checkout, parser, and AI-credit requirements.
Introduces DriftRecord compliance test IDs.
Refreshes generated workflow metadata and scheduling.

Show a summary per file

File	Description
`specs/security-architecture-spec.md`	Records the latest validation date.
`specs/awf-config-sources-compliance/README.md`	Defines DriftRecord compliance IDs.
`docs/src/content/docs/specs/checkout-behavior-specification.md`	Adds checkout safeguards and tests.
`docs/src/content/docs/specs/bash-command-parser-specification.md`	Adds parser denial safeguards.
`docs/src/content/docs/specs/ai-credits-specification.md`	Adds entities and catalog staleness rules.
`.github/workflows/skillet.lock.yml`	Refreshes generated action metadata.
`.github/workflows/release.lock.yml`	Refreshes generated setup-go metadata.
`.github/workflows/hourly-ci-cleaner.lock.yml`	Refreshes generated checkout metadata.
`.github/workflows/avenger.lock.yml`	Refreshes generated checkout metadata.
`.github/workflows/agentic-auto-upgrade.yml`	Changes the weekly upgrade schedule.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 10/10 changed files
Comments generated: 11
Review effort level: Medium


+### 4.0 Compiler Error Message Requirements
+
+When `github-token` and `github-app` are both specified on the same checkout entry, the compiler MUST reject the workflow with an error. The normative error message format is:


 - **T-CHK-011**: `checkout.safe-outputs-github-app` is the sole supported safe_outputs auth override per checkout entry
 - **T-CHK-012**: safe_outputs checkout token MUST NOT use `safe-outputs.github-app` or `safe-outputs.github-token`; only `safe-outputs-github-app` (per entry) or `GITHUB_TOKEN` are permitted
 - **T-CHK-013**: Checkout-manifest generation includes safe_outputs auth metadata without persisting resolved tokens
+- **T-CHK-014**: Checkout-manifest path resolution MUST reject paths that are absolute (e.g., `/etc/passwd`) or escape the workspace root (e.g., `../../sensitive`); rejected paths MUST produce an error and MUST NOT be used for checkout or file lookup


+
+1. **Token write-to-disk prohibition**: `safe-outputs-github-app` minted tokens MUST NOT be written to disk at any point before the `safe_outputs` job begins its push/PR operations. Token values MUST be passed only as environment variables or via GitHub Actions secret interpolation at the step level. Any intermediate file, log entry, or env export that materializes the token value to disk MUST be treated as a security violation.
+
+2. **Manifest path rejection**: Checkout-manifest paths that are absolute or that escape the workspace root MUST be rejected before any file I/O is performed against them. The rejection MUST produce an actionable error message (see §3.4 and T-CHK-014).


+
+The following MUST-level norms govern credential and token safety during checkout and `safe_outputs` operations:
+
+1. **Token write-to-disk prohibition**: `safe-outputs-github-app` minted tokens MUST NOT be written to disk at any point before the `safe_outputs` job begins its push/PR operations. Token values MUST be passed only as environment variables or via GitHub Actions secret interpolation at the step level. Any intermediate file, log entry, or env export that materializes the token value to disk MUST be treated as a security violation.


+
+The following MUST-level norms apply to all Class I (Integration Consumer) conforming implementations:
+
+1. **Empty-result default-deny**: When `extractCommandNamesFromPipeline` returns an empty list (`length === 0`), the integration MUST apply default-deny and MUST NOT proceed with command execution. An empty result is never implicit authorization. This norm strengthens the requirement stated in §2.2 and §5, and applies regardless of whether the empty result arises from a blank input, a fully structural-keyword input, or a parse that yields only redirections.


+- The number of days elapsed since that sync.
+- A recommendation to run the catalog refresh process.
+
+This is a SHOULD-level norm; catalog staleness does not constitute a hard failure, but implementations MUST NOT suppress the warning if the threshold is exceeded. Implementations that cannot determine the last sync timestamp SHOULD treat the catalog as potentially stale and emit the warning unconditionally.


+When the elapsed time since the last successful sync exceeds 7 days, the implementation SHOULD emit a re-sync warning. The warning MUST include:
+
+- The timestamp of the last successful sync.
+- The number of days elapsed since that sync.
+- A recommendation to run the catalog refresh process.


+This directory contains conformance test IDs and fixture stubs for the `DriftRecord` entity
+defined in [§6.5 of the AWF Config Canonical Sources Specification](../awf-config-sources-spec.md#65-driftrecord-entity-schema).


+1. Assign a new `T-DR-xxx` identifier (increment from the last used ID).
+2. Add a row to the table above with the test ID, requirement reference (§ number), and description.
+3. Implement the test in the conformance test file listed above.
+4. Cross-reference the new test ID from the relevant subsection of `specs/awf-config-sources-spec.md`.


 on:
  schedule:
-    - cron: "21 3 * * 5"  # Weekly (auto-upgrade)
+    - cron: "11 4 * * 6"  # Weekly (auto-upgrade)


github-actions · 2026-07-16T19:58:01Z

🎉 This pull request is included in a new release.

Release: v0.82.11

Initial plan

7c40e80

Copilot AI assigned Copilot and pelikhan Jul 16, 2026

Copilot started work on behalf of pelikhan July 16, 2026 16:27 View session

Copilot AI linked an issue Jul 16, 2026 that may be closed by this pull request

[spdd] Daily spec work plan - 2026-07-16 #46043

Closed

9 tasks

Copilot AI and others added 2 commits July 16, 2026 16:33

chore: initial SPDD spec work plan implementation

60de02b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add missing tests and documentation for daily spec work plan~~ [spdd] Daily spec work plan - 2026-07-16 (rotation 15–19) Jul 16, 2026

Copilot finished work on behalf of pelikhan July 16, 2026 16:41

Copilot AI requested a review from pelikhan July 16, 2026 16:41

pelikhan approved these changes Jul 16, 2026

View reviewed changes

pelikhan marked this pull request as ready for review July 16, 2026 17:01

Copilot AI review requested due to automatic review settings July 16, 2026 17:01

pelikhan merged commit 08abf7f into main Jul 16, 2026

pelikhan deleted the copilot/spdd-daily-spec-work-plan branch July 16, 2026 17:02

Copilot started reviewing on behalf of pelikhan July 16, 2026 17:02 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[spdd] Daily spec work plan - 2026-07-16 (rotation 15–19)#46044

[spdd] Daily spec work plan - 2026-07-16 (rotation 15–19)#46044
pelikhan merged 3 commits into
mainfrom
copilot/spdd-daily-spec-work-plan

Copilot AI commented Jul 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		### 4.0 Compiler Error Message Requirements

		When `github-token` and `github-app` are both specified on the same checkout entry, the compiler MUST reject the workflow with an error. The normative error message format is:


		1. Token write-to-disk prohibition: `safe-outputs-github-app` minted tokens MUST NOT be written to disk at any point before the `safe_outputs` job begins its push/PR operations. Token values MUST be passed only as environment variables or via GitHub Actions secret interpolation at the step level. Any intermediate file, log entry, or env export that materializes the token value to disk MUST be treated as a security violation.

		2. Manifest path rejection: Checkout-manifest paths that are absolute or that escape the workspace root MUST be rejected before any file I/O is performed against them. The rejection MUST produce an actionable error message (see §3.4 and T-CHK-014).


		The following MUST-level norms govern credential and token safety during checkout and `safe_outputs` operations:

		1. Token write-to-disk prohibition: `safe-outputs-github-app` minted tokens MUST NOT be written to disk at any point before the `safe_outputs` job begins its push/PR operations. Token values MUST be passed only as environment variables or via GitHub Actions secret interpolation at the step level. Any intermediate file, log entry, or env export that materializes the token value to disk MUST be treated as a security violation.


		The following MUST-level norms apply to all Class I (Integration Consumer) conforming implementations:

		1. Empty-result default-deny: When `extractCommandNamesFromPipeline` returns an empty list (`length === 0`), the integration MUST apply default-deny and MUST NOT proceed with command execution. An empty result is never implicit authorization. This norm strengthens the requirement stated in §2.2 and §5, and applies regardless of whether the empty result arises from a blank input, a fully structural-keyword input, or a parse that yields only redirections.

		This directory contains conformance test IDs and fixture stubs for the `DriftRecord` entity
		defined in [§6.5 of the AWF Config Canonical Sources Specification](../awf-config-sources-spec.md#65-driftrecord-entity-schema).

Uh oh!

Conversation

Copilot AI commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

checkout-behavior-specification.md

ai-credits-specification.md

bash-command-parser-specification.md

security-architecture-spec.md

specs/awf-config-sources-compliance/README.md (new file)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 16, 2026 •

edited

Loading

`checkout-behavior-specification.md`

`ai-credits-specification.md`

`bash-command-parser-specification.md`

`security-architecture-spec.md`

`specs/awf-config-sources-compliance/README.md` (new file)