[spdd] Daily spec work plan - 2026-06-30

[github-actions]

Summary

SPDD daily review for 2026-06-30 covering 5 spec files: security architecture validation doc, formal security architecture spec, AI Credits spec, bash command parser spec, and Copilot SDK driver spec (rotation indices 23–24 + 0–2 of 25 total).

Key themes: validation lifecycle gaps (no automation/re-trigger), security parser misuse boundary under-specified, catalog integrity weak, undefined terms in driver spec.

---

Priority Work Queue

P0 – Parser security misuse boundary too weak; validation doc has no re-validation trigger or failure escalation; test vector storage location unspecified.

P1 – AI Credits catalog sync failure handling absent from §5; Appendix C catalog integrity is advisory-only; non-ephemeral events undefined in driver spec.

P2 – Driver structured event serialization schema missing from §6; security spec §12 test matrix completeness unverified; bash parser default-deny fallback not normative.

---

SPDD Checklist

• [/spdd-generate | P0] bash-command-parser-specification.md §11: Add 3+ concrete misuse examples and a normative MUST NOT for treating parser output as sandbox proof. Done when §11 has at least one MUST NOT sentence with example.
• [/spdd-generate | P0] bash-command-parser-specification.md §9: Specify canonical repo path/URI for machine-readable test vector storage. Done when §9 has a concrete storage location contract.
• [/spdd-sync | P0] security-architecture-spec-validation.md: Add "Re-validation Triggers" section (triggers on spec/impl changes) and a failure escalation path. Done when section is present with ≥1 normative trigger.
• [/spdd-generate | P1] ai-credits-specification.md §5: Add MUST-level catalog sync failure handling requirements. Done when §5 specifies behavior for unreachable or malformed catalog.
• [/spdd-generate | P1] ai-credits-specification.md Appendix C: Upgrade SHOULD to MUST for catalog provenance validation and review requirements. Done when Appendix C has ≥2 MUST requirements.
• [/spdd-generate | P1] copilot-sdk-driver-specification.md Appendix C: Add normative definition of "non-ephemeral events". Done when term is defined inline or in a glossary.
• [/spdd-generate | P2] copilot-sdk-driver-specification.md §6: Add structured event serialization field schema (names, types) for lifecycle and policy-denial log entries. Done when §6 has a normative schema or field table.
• [/spdd-analysis | P2] security-architecture-spec.md §12: Audit compliance test matrix against security-architecture-spec-validation.md evidence; produce gap list. Done when gap list (or full-coverage confirmation) exists.
• [/spdd-sync | P2] security-architecture-spec-validation.md: Add "Automation Approach" section with ≥1 concrete CI mechanism proposal. Done when section is present.
• [/spdd-generate | P2] bash-command-parser-specification.md §2.2: Add normative MUST requiring Class I consumers to apply default-deny when parser returns empty/nil command. Done when §2.2 or §5 contains this MUST.

---

Per-Spec Findings

security-architecture-spec-validation.md (index 23)

Risks: One-time validation (2026-05-15); stale without a re-trigger mechanism.
REASONS gaps: Approach ❌ (manual only), Operations ❌ (no cadence), Safeguards ❌ (no escalation path).
Tasks: Re-validation triggers (P0), automation approach section (P2).

security-architecture-spec.md (index 24)

Status: Candidate Recommendation, v1.0.0.
REASONS gaps: Operations ⚠️ (§11 completeness unverified), Safeguards ⚠️ (§12 test matrix gap unknown).
Tasks: Audit §12 compliance test matrix (P2).

ai-credits-specification.md (index 0)

Status: Draft, v1.4.0. Active — 4 versions in June 2026.
Risks: Pricing catalog tampering/sync failures could silently produce wrong cost data.
REASONS gaps: Operations ❌ (sync failure behavior unspecified), Safeguards ⚠️ (Appendix C advisory only).
Tasks: §5 sync failure requirements (P1), Appendix C MUST-level (P1).

bash-command-parser-specification.md (index 1)

Status: Draft, v1.1.0. Security-critical — drives permission enforcement.
REASONS gaps: Operations ⚠️ (§9 vector storage unspecified), Safeguards ❌ (§11 lacks normative constraints and examples).
Tasks: §11 misuse examples (P0), §9 storage location (P0), §2.2 default-deny MUST (P2).

copilot-sdk-driver-specification.md (index 2)

Status: Draft, v1.0.2. Token isolation added in latest version.
REASONS gaps: Operations ⚠️ (T-CSD-008 path enumeration incomplete), Safeguards ⚠️ ("non-ephemeral events" undefined, serialization schema missing).
Tasks: Define "non-ephemeral events" (P1), §6 schema (P2).

---

Sync Follow-ups

• security-architecture-spec-validation.md ↔ security-architecture-spec.md: When security layer requirements change, re-run validation. Cross-reference both docs.
• bash-command-parser-specification.md ↔ actions/setup/js/: Parser behavior changes → spec version bump + test vector update.
• ai-credits-specification.md ↔ models.json: New model entries → verify §4 coverage; track as compliance gap if not.
• copilot-sdk-driver-specification.md ↔ copilot_sdk_driver.cjs: Token isolation (§4.2 + T-CSD-008) verified on each driver implementation change.

---

Context

Files reviewed (rotation indices 23–24, 0–2 of 25):

1. specs/security-architecture-spec-validation.md
2. specs/security-architecture-spec.md
3. docs/src/content/docs/specs/ai-credits-specification.md
4. docs/src/content/docs/specs/bash-command-parser-specification.md
5. docs/src/content/docs/specs/copilot-sdk-driver-specification.md

Rotation: last_index=2, total_files=25, next batch starts at index 3.

References: §28460270609

Generated by 📋 Daily SPDD Spec Planner · 49.9 AIC · ⌖ 7.82 AIC · ⊞ 1.6K · ◷

• expires on Jul 3, 2026, 8:45 AM UTC-08:00