[spdd] Daily spec work plan - 2026-09-14

### Summary

Daily SPDD rotation reviewed 5 spec files (rotation index 4→9 of 20): `specs/awf-config-sources-spec.md`, `specs/compiler-threat-detection-changelog.md`, `specs/compiler-threat-detection-compliance/README.md`, `specs/compiler-threat-detection-spec.md`, and `specs/forecast-compliance-fixtures/README.md`. All five are mature, actively-maintained conformance units with formal REASONS structure already in place. No critical gaps were found; work items below are refinement, drift-closure, and sync-hygiene tasks that keep the spec/compliance/implementation triads in sync.

### Priority Work Queue

- **P0** — None. No blocking safety or correctness gaps identified in this batch.
- **P1**:
- Close CR-06a automation gap in `awf-config-sources-spec.md` (escalation-issue owner assignment is normative but not automated).
- Reconcile stale `1.0.35` audit entries in `compiler-threat-detection-changelog.md` for out-of-context commit artifacts (`test_dup_import` binary, stray `tmp/` file) flagged as housekeeping but never actioned.
- **P2**:
- Tighten Operations wording in `awf-config-sources-spec.md` §7.4 (SLA escalation template) to state issue-creation actor.
- Add explicit Norms cross-reference from `forecast-compliance-fixtures/README.md` to the top-level forecast Safeguards section (currently only linked via a "Sync note" paragraph).
- Verify `compiler-threat-detection-compliance/README.md` T-CTR-* numbering note stays accurate after any future rule addition (currently manually explained, no automated regression beyond the naming-sync test).

### SPDD Checklist

- [ ] **/spdd-generate** — Implement production issue auto-assignment + comment-acknowledgement automation for CR-06a in `specs/awf-config-sources-spec.md`; target files: new workflow under `.github/workflows/` plus test in `pkg/workflow/awf_config_safeguards_formal_test.go`. Done when a fixture-backed test exercises real issue mutation (not just the current normative-contract-only T-DR-011 fixture).
- [ ] **/spdd-sync** — Remove or archive the three out-of-context artifacts (`test_dup_import`, `tmp/smoke_test_22524436360.go`, `{outname}.f`) flagged in the 2026-09-13 mapping audit; target: repository root / `tmp/`. Done when the audit note in `specs/compiler-threat-detection-changelog.md` records the cleanup PR reference and the files no longer exist in the tree.
- [ ] **/spdd-analysis** — Assess whether `CR-06a`'s "on-call maintainer" fallback path in `specs/awf-config-sources-spec.md` §6 has any concrete lookup mechanism; currently undefined. Done when the analysis note documents either an existing on-call system integration point or explicitly scopes it out with rationale added to the spec.
- [ ] **/spdd-generate** — Add a `T-DR-*` fixture (or extend T-DR-011) in `specs/awf-config-sources-compliance/README.md` covering the CR-06 (non-06a) 5-business-day SLA breach path end-to-end, since only the owner-assignment sub-clause is currently fixture-backed. Done when a new/updated test in `pkg/workflow/awf_config_safeguards_formal_test.go` asserts the escalation issue is opened within 1 business day of SLA breach.
- [ ] **/spdd-sync** — Update `specs/compiler-threat-detection-changelog.md` Mapping Audits table of contents / version history to link each dated audit entry to its corresponding PR or commit hash for traceability (currently only commit `0489fac` is cited in the latest entry). Done when the last 3 audit entries each cite a commit hash.
- [ ] **/spdd-generate** — Extend `specs/forecast-compliance-fixtures/README.md` fixture set with a boundary case at exactly `λ = 15.0` using non-integer sample sizes (only integer boundary currently fixtured per T-FC-039/040). Target: new fixture file + entry in `pkg/cli/forecast_montecarlo_test.go`. Done when `TestLambdaCrossoverBoundaryAt15` includes the non-integer case and passes.
- [ ] **/spdd-analysis** — Review whether `specs/compiler-threat-detection-spec.md` §5.3 "Candidacy and Lifecycle" needs an explicit maximum dwell time for experimental threats before they must be promoted or dropped (currently open-ended). Done when analysis note is added to the spec's REASONS canvas or a follow-up issue is filed with a proposed SLA.
- [ ] **/spdd-sync** — Confirm `specs/compiler-threat-detection-compliance/README.md`'s Section 5.4 deprecation-annotation table stays synchronized with any newly deprecated `CTR-*` rule; no rule is currently deprecated, so this is a standing verification task for the next rule removal. Done when the next deprecation PR includes a checklist reference to this README's table format.

### Per-Spec Findings

specs/awf-config-sources-spec.md — AWF Config Canonical Sources Specification (v0.1.0, Working Draft)

**Goals**: Define canonical `gh-aw-firewall` config sources (spec + JSON schemas) that gh-aw agents must consult, a `DriftRecord` data model, and a fetch-compare-report drift detection procedure with SLA-bound remediation.

**Risks / ambiguities**:
- CR-06a's "on-call maintainer" fallback for escalation-owner assignment has no defined lookup mechanism — could stall an escalation if the primary git-blame heuristic finds no maintainer.
- The 7-day/168-hour snapshot freshness safeguard depends on wall-clock UTC recording; no explicit behavior is defined if the recording step itself fails (partial write).
- §7.3 "Example Drift Check (CLI)" is illustrative/non-fatal by design — good, but not enforced as a MUST anywhere, so it can silently rot without failing CI.

**REASONS canvas gaps**:
- *Requirements*: solid (CR-01–CR-06a numbered).
- *Entities*: `DriftRecord` schema is well-formed (§3.1).
- *Approach*: documented rationale for fetch-compare-report vs schema-diff bot (§Approach) — strong.
- *Structure*: cross-links to compliance README and Go test file — strong, enforced via "Structure" section MUST.
- *Operations*: §7.2 step-by-step is clear; missing explicit rollback/idempotency for a partially-completed drift report.
- *Norms*: CR-01–CR-06a present; CR-06a automation explicitly marked out of scope pending a production tracker — flagged as P1 above.
- *Safeguards*: §8 REASONS Safeguards section is comprehensive (snapshot staleness, degraded-mode skip-destructive-actions, tracking-issue escalation) — strong.

specs/compiler-threat-detection-changelog.md — Compiler Threat Detection Changelog

**Goals**: Record version history and dated mapping-audit entries for the threat-detection spec, keeping the normative spec itself free of audit narrative.

**Risks / ambiguities**:
- Multiple recent audit entries (2026-09-10 through 2026-09-13) are "audit-only, no new threat" dispositions for code-scanning alerts — this is healthy but the volume of near-duplicate entries (allocation-overflow, bad-redirect-check) suggests the underlying alerts should be triaged/suppressed upstream rather than re-litigated in every daily audit.
- The 2026-09-13 entry flags stray committed artifacts (binary, placeholder files) as "housekeeping, not a CTR gap" — correct scoping, but no follow-up issue/PR reference is tracked, so cleanup may never happen (P1 above).

**REASONS gaps**: This file is purely an *Operations* log (audit trail) — Requirements/Entities/Approach live in the main spec. No REASONS gaps specific to this file beyond traceability (missing commit/PR links per entry).

specs/compiler-threat-detection-compliance/README.md — Compliance ID crosswalk

**Goals**: Map `CTR-*` rules to `T-CTR-*` test IDs plus Section 6 optimizer-protocol norm tests, with a note explaining the intentionally non-sequential ID allocation.

**Risks / ambiguities**: The `T-CTR-024` through `T-CTR-040` numbering gap (reserved for Section 6 norms) is well-documented but relies entirely on a naming-sync test (`TestFormal_ComplianceReadmeNormTestNamesStaySynced`) — if that test is ever skipped/deleted, drift would be silent.

**REASONS gaps**:
- *Structure*: strong — explicit crosswalk table, deprecation annotation conventions, and formal test enforcement.
- *Safeguards*: relies on a single formal test for sync enforcement; no secondary/manual audit cadence mentioned.

specs/compiler-threat-detection-spec.md — Compiler Threat Detection Specification (v1.0.35, Candidate Recommendation)

**Goals**: Normative source of truth for 27 `CTR-*` compiler threat-detection rules, spanning privilege escalation, sandbox bypass, injection, unsafe outputs, and manifest drift, plus a daily optimizer protocol with suppression and failure-safeguard requirements.

**Risks / ambiguities**:
- §5.3 Candidacy and Lifecycle allows "experimental threats" indefinitely without a promotion/expiry deadline — a candidate could linger without ever becoming normative or being dropped (P2 above).
- §6.1 Suppressions: the 10-business-day resolution SLA and 20-business-day follow-up threshold are well-specified, but there's no explicit cap on repeated suppression renewal (an expired suppression could be immediately replaced by a new one with the same rule/reason, resetting the clock).

**REASONS gaps**:
- *Requirements*: exceptionally thorough — 27 rules, versioned sync table, RFC 2119 keywords throughout.
- *Entities*: rule catalog entries are well-structured (ID, threat class, trigger, action, diagnostic).
- *Approach*: §3 Threat Model Overview groups rules into 5 threat classes — clear rationale.
- *Structure*: §7 Implementation Mapping + §8 Compliance Testing form a tight bidirectional map to compliance README and changelog.
- *Operations*: §6 Daily Optimizer Protocol is detailed (retry backoff, timeout, rate-limit, missed-cron behaviors).
- *Norms*: §5.4 Deprecation Policy is precise (deprecate, don't delete).
- *Safeguards*: §6.2 Failure Safeguards table is comprehensive across 4 failure modes.

specs/forecast-compliance-fixtures/README.md — Forecast Compliance Fixtures

**Goals**: Fixture files and behavioral coverage map bootstrapping Section 12 compliance tests of the Forecast Specification (Monte Carlo AIC/ET projection engine).

**Risks / ambiguities**: The Lambda crossover boundary (`λ = 15`) is tested only with integer-friendly inputs per the coverage map; fractional/edge sample sizes near the boundary aren't called out explicitly (P2 above). The "Sync note" mechanism (anchor-existence formal test) is a good drift-prevention pattern worth reusing elsewhere.

**REASONS gaps**:
- *Requirements*: formal model (Poisson/Bernoulli/bootstrap) is precisely stated with algorithm selection rules.
- *Entities*: `RunSummary`/`TokenUsage` field mapping table is clear.
- *Structure*: behavioral coverage map ties predicates to test functions and IDs — excellent traceability.
- *Operations*: run instructions for full suite, Monte Carlo subset, and race-detector variant are all provided.
- *Norms/Safeguards*: high-value-observation overflow safety (T-ET-006) and empty-sample nil-projection handling are both explicitly fixtured — no significant gaps found.

### Sync Follow-ups

- After any CR-06a automation work lands, update `specs/awf-config-sources-compliance/README.md` to reference the new production-tracker test ID and remove the "not yet automated" caveat from the spec.
- After cleaning up the stray committed artifacts noted in the 2026-09-13 changelog entry, add a one-line changelog follow-up entry confirming remediation (keeps the audit trail closed-loop).
- If the experimental-threat lifecycle SLA proposal (P1/P2 checklist item) is accepted, update `specs/compiler-threat-detection-spec.md` §5.3 and add a corresponding norm test cataloged in the compliance README's Section 6 tables.
- If a new fractional-λ fixture is added to the forecast suite, update the Behavioral Coverage Map row for `LambdaCrossoverAt15` in `specs/forecast-compliance-fixtures/README.md` to reflect the expanded test IDs.

### Context

- **Files reviewed this run** (rotation indices 4–8 of 20, 0-indexed batch of 5): `specs/awf-config-sources-spec.md`, `specs/compiler-threat-detection-changelog.md`, `specs/compiler-threat-detection-compliance/README.md`, `specs/compiler-threat-detection-spec.md`, `specs/forecast-compliance-fixtures/README.md`
- **Rotation state**: advanced from `last_index: 4` → `last_index: 9`; next run resumes at `specs/github-mcp-access-control-compliance/README.md` (index 9 of 20)
- **Cache state file**: `/tmp/gh-aw/cache-memory/spdd-daily/rotation.json`
- **Workflow run**: https://github.com/github/gh-aw/actions/runs/34864977996

> Generated by [📋 Daily SPDD Spec Planner](https://github.com/github/gh-aw/actions/runs/34864977996) · copilot · auto · 45.1 AIC · ⌖ 13.1 AIC · ⊞ 7.4K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fdaily-spdd-spec-planner%22&type=issues)
> - [x] expires on Sep 17, 2026, 8:00 AM UTC-08:00

Start by separating the checklist into independently scoped tasks, then read the named specs and their linked targets: .github/workflows/, pkg/workflow/awf_config_safeguards_formal_test.go, pkg/cli/forecast_montecarlo_test.go, and the compliance READMEs. Run the relevant existing Go tests before choosing one item. Done criteria are stated per checklist entry, but the issue as a whole is complete only when the selected implementation, fixture, analysis, or synchronization work and its documentation updates are finished.

Written by the indexing model from the issue text.