[spdd] Daily spec work plan - 2026-06-29

[github-actions]

Summary

Daily SPDD review for 2026-06-29 (rotation 3/3, files 7–11 of 14). Five specs reviewed: intent attribution & governance, OTel observability, replace-label type, outcome evaluation, and security architecture summary. Top finding: replace_label is entirely absent from the outcome evaluation spec; 4 pending security-summary maintenance tasks remain; intent-attribution spec lacks RFC 2119 norms and Safeguards.

---

Priority Work Queue

Priority	Area	Issue
P0	safe-output-outcome-evaluation.md	replace_label absent from status table and evaluator spec
P0	security-architecture-spec.md	pre_activation role-validation note missing §§8–9; trusted-users unaudited
P1	intent-attribution-agent-governance.md	No RFC 2119 Norms or Safeguards section; rules are informal
P1	safe-output-outcome-evaluation.md	dispatch_workflow, update_project, update_release lack evaluator spec
P2	security-architecture-spec-summary.md	Detection-job Appendix D + conclusion job docs pending
P2	replace-label-spec.md	No outcome-evaluation cross-reference in §9
P2	intent-attribution-agent-governance.md	intent-policy.json migration schema undefined

---

SPDD Checklist

• [P0 /spdd-generate] Add replace_label to the implementation status table in specs/safe-output-outcome-evaluation.md and write its per-type evaluator section (pass/fail conditions, OTel attrs ghaw.outcome.label.removed/added). Done when type appears in both status table and conformance test table.
• [P0 /spdd-generate] Add normative note in specs/security-architecture-spec.md (§8 or §9) tying role validation to pre_activation job; reference pre_activation→activation→agent→detection→safe_outputs→conclusion flow. Mark row ✅ in summary.
• [P0 /spdd-generate] Audit trusted-users enforcement in specs/security-architecture-spec.md §§8–9. Add normative subsection or forward-reference to GitHub MCP access-control spec. Mark row ✅ in summary.
• [P1 /spdd-generate] Add ## Norms section to specs/intent-attribution-agent-governance.md with RFC 2119 notation; convert resolution order, fail-closed rule, provenance requirement, unknown-is-not-zero to MUST/SHOULD language.
• [P1 /spdd-generate] Add ## Safeguards section to specs/intent-attribution-agent-governance.md: (a) missing config → safestDefaultPolicy(); (b) corrupted IntentRecord → unlinked; (c) compile error → block + structured error.
• [P1 /spdd-generate] Write evaluator spec sections in specs/safe-output-outcome-evaluation.md for dispatch_workflow, update_project, update_release — each with evaluation table, API ref, and OTel attributes.
• [P2 /spdd-generate] Add Appendix D example to specs/security-architecture-spec.md naming detection job as runtime threat-detection layer; document conclusion job as optional. Mark both rows ✅ in summary.
• [P2 /spdd-generate] Add outcome-evaluation cross-reference in §9 of specs/replace-label-spec.md pointing to replace_label section once created.
• [P2 /spdd-generate] Add draft intent-policy.json schema skeleton (version, labels map with dimension/value/weight, scoring, attribution) to specs/intent-attribution-agent-governance.md.
• [/spdd-sync] After task 1: grep pkg/cli/outcome_eval.go for replace_label — add evalGenericSticky fallback or // TODO(spdd) placeholder if absent.
• [/spdd-sync] After task 2: run make recompile to confirm no .lock.yml regressions.
• [/spdd-sync] After task 5: file follow-up implementation issue tracking safestDefaultPolicy() wiring in the Orchestrator.

---

Per-Spec Findings

intent-attribution-agent-governance.md v2.0.0 · Partially Implemented

• Goals: Deterministic intent layer (priority/domain/initiative/risk/root) for attribution+reporting and workflow governance.
• Risks: Resolver covers only 0/1/multiple-closing-issues. Missing parent_issue, referenced_issue, project, milestone, suggestion paths. No conformance tests.
• REASONS gaps: Norms ❌ (no RFC 2119), Safeguards ❌ (no config-absent or corrupted-state handling), Operations ⚠️ (Orchestrator integration point is pseudo-code only).

otel-observability-spec.md v0.4.0 · Working Draft

• Goals: OTel observability contract — OTLP export, trace/metric/log, W3C context propagation, security/privacy.
• Risks: capture-content, mode, signals reserved but unimplemented. Collector mode RECOMMENDED but no setup docs. No compliance test harness referenced.
• REASONS gaps: Operations ⚠️ (§11 Metrics and §12 Logs coverage unverified); §5.6 extension fields have no implementation timeframe.

replace-label-spec.md v1.0.0 · Candidate Recommendation

• Goals: Atomic label swap via PUT /issues/{n}/labels. Eliminates race window in separate remove+add calls.
• Risks: 55+ RL-* requirements, comprehensive 8-stage pipeline — but replace_label entirely absent from outcome evaluation spec. §9 test IDs not linked to implementation file.
• REASONS gaps: Operations ⚠️ (no outcome evaluator anywhere for this type); staged-mode count semantics ambiguous to operators.

safe-output-outcome-evaluation.md v1.0.0 · Working Draft

• Goals: Per-type outcome evaluation logic for all safe-output types.
• Risks: 8 types not-started; replace_label completely absent. Audit NDJSON path defined but schema unspecified. Reconciliation process has no ownership.
• REASONS gaps: Structure ⚠️ (replace_label missing), Operations ⚠️ (8 not-started types), Safeguards ⚠️ (NDJSON schema and reconciliation unowned).

security-architecture-spec-summary.md v1.0.0 · Candidate Recommendation

• Goals: Navigation summary for 130+-requirement security spec; tracks 7-layer architecture, SG-01–SG-07, 70+ tests.
• Pending maintenance: (1) pre_activation note in §§8–9, (2) detection-job Appendix D example, (3) conclusion-job documentation, (4) trusted-users enforcement audit.
• REASONS gaps: Operations ⚠️ (4 tasks ⏳), Safeguards ⚠️ (trusted-users not in §§8–9).

---

Sync Follow-ups

• After replace_label evaluator spec: grep pkg/cli/outcome_eval.go and add fallback/TODO if absent.
• After pre_activation note: make recompile to verify no .lock.yml drift.
• After Norms+Safeguards in intent-attribution: verify Go types (IntentRecord, ExecutionPolicy) consistent with spec.
• After dispatch_workflow/update_project/update_release specs: add // TODO(spdd-sync): implement dedicated evaluator comments in pkg/cli/outcome_eval.go.
• After Safeguards section: file implementation issue for safestDefaultPolicy() Orchestrator fallback.

---

Context

Field	Value
Files reviewed	specs/intent-attribution-agent-governance.md, specs/otel-observability-spec.md, specs/replace-label-spec.md, specs/safe-output-outcome-evaluation.md, specs/security-architecture-spec-summary.md
Rotation index	7–11 of 14 (new last_index: 11)
Previous batch	scratchpad/safe-outputs-specification.md, specs/aw-harness.md, specs/awf-config-sources-spec.md, specs/compiler-threat-detection-spec.md, specs/forecast-compliance-fixtures/README.md
Run	§28388394797

Generated by 📋 Daily SPDD Spec Planner · 112.1 AIC · ⌖ 10.1 AIC · ⊞ 4.8K · ◷

• expires on Jul 2, 2026, 9:02 AM UTC-08:00