[spdd] Daily spec work plan - 2026-08-12

[github-actions]

Summary

Daily SPDD review of 5 spec files (rotation indices 5–9): intent-attribution-agent-governance.md, intent-attribution-compliance/README.md, otel-observability-spec.md, replace-label-compliance/README.md, replace-label-spec.md. The intent/governance spec documents a fully advisory-only policy engine (no runtime enforcement), and the OTel spec has four unimplemented Level-1 compliance test stubs (T-OT-008–011). No blocking defects found in replace-label docs; work items below are enforcement wiring, missing tests, and sync hygiene.

Priority Work Queue

• P0 — Wire Authorizer.AuthorizeTool into the Go orchestrator so ExecutionPolicy (write scope, human approval, auto-merge, required checks) has real runtime effect instead of being purely advisory.
• P1 — Implement the four stubbed OTel compliance tests (T-OT-008 through T-OT-011) referenced in specs/otel-observability-spec.md §17.1.2.
• P2 — Add sync notes / migration tracking for .github/objective-mapping.json → .github/intent-policy.json transition and tighten replace-label fixture cross-references.

SPDD Checklist

• /spdd-generate: Implement Authorizer.AuthorizeTool in pkg/intent (new pkg/intent/authz sub-package) per specs/intent-attribution-agent-governance.md §"Authorizer.AuthorizeTool Implementation Audit"; done when a feature-flagged call site in the orchestrator enforces AllowedTools/DeniedTools/WriteScope/HumanApprovalRequired/RequiredChecks and a unit test proves a denied tool call is rejected.
• /spdd-generate: Add regression test asserting MaxAttempts and AutoMergeAllowed are read from the compiled ExecutionPolicy at execution time in pkg/intent/ or the calling orchestrator package; done when the test fails on current main (proving the gap) and passes once wiring lands.
• /spdd-generate: Implement compliance test T-OT-008 (gh-aw.job.name on built-in job spans) in pkg/workflow/otel_observability_formal_test.go; done when the test decodes /tmp/gh-aw/otel.jsonl and asserts the attribute matches the GitHub Actions job name.
• /spdd-generate: Implement compliance test T-OT-009 (gen_ai.system on built-in agent spans) in pkg/workflow/otel_observability_formal_test.go; done when it asserts non-empty normalized provider value for a known engine.
• /spdd-generate: Implement compliance test T-OT-010 (gh-aw.outcome.type on outcome-evaluation spans) in pkg/workflow/otel_observability_formal_test.go; done when it asserts the attribute matches the evaluated manifest item type.
• /spdd-generate: Implement compliance test T-OT-011 (v0.3.0→v0.4.0 backward-compatibility attribute inventory diff) in pkg/workflow/otel_observability_formal_test.go; done when it compares attribute key sets against the v0.3.0 change-log inventory and fails on any removed/renamed key.
• /spdd-sync: Update make validate-otel-contract target (or its backing script) to include the four new T-OT-008–011 tests so CI enforces Level 1 conformance; done when make validate-otel-contract runs and reports these test IDs.
• /spdd-sync: Add a "Sync Notes" subsection to specs/replace-label-spec.md cross-referencing specs/replace-label-compliance/README.md's Behavioral Coverage Map, mirroring the pattern already used in specs/intent-attribution-agent-governance.md; done when both docs link to each other's fixture/test tables bidirectionally.
• /spdd-reasons-canvas: Add an explicit Safeguards note to specs/otel-observability-spec.md §17 clarifying that stubbed (unimplemented) test IDs MUST NOT be counted toward a Level 1 conformance claim; done when the wording change is committed and reviewed.
• /spdd-generate: Add a fixture or unit test in pkg/intent/ proving PolicyCompiler.Compile() output is currently unused by any orchestrator call site (documents the advisory-only state as an executable assertion); done when the test exists and is annotated with a link to the tracking issue for P0 wiring work.

Per-Spec Findings

specs/intent-attribution-agent-governance.md — Intent Attribution & Agent Governance (v2.0.0, Partially Implemented)

Analysis: Defines deterministic attribution precedence (explicit intent → closing issue → labels → unlinked) and fail-closed governance policy compilation. Core resolver/compiler logic (pkg/intent.Resolver, pkg/intent.PolicyCompiler) is implemented and covered by formal fixtures, but the spec explicitly states (line ~940) that AuthorizeTool is not yet implemented, meaning compiled policies (AllowedTools, WriteScope, HumanApprovalRequired, AutoMergeAllowed, RequiredChecks, MaxAttempts) have zero runtime enforcement today — they are "purely advisory."

REASONS gaps:

• Safeguards: Present for attribution fail-closed behavior, but the governance layer's biggest safeguard gap (no enforcement) is documented as a known risk rather than mitigated.
• Operations: No defined rollout/feature-flag sequencing for turning on enforcement once implemented.
• Structure: ExecutionPolicy struct is well-specified; the missing piece is purely the authorization call site, not the data model.

Risk: Any repository relying on .github/intent-policy.json to restrict agent behavior today has no actual protection — this is a security-relevant documentation-implementation mismatch.

specs/intent-attribution-compliance/README.md — Compliance Fixtures

Analysis: Well-formed formal model (F1–F7 predicates) with full behavioral coverage map and matching Go test functions in pkg/intent/compliance_fixtures_formal_test.go. No gaps found in fixture coverage.

REASONS gaps: None significant. Requirements and Structure sections are strong. Minor: no explicit note cross-linking to the AuthorizeTool audit in the parent spec, so a reader of only this README would not know policy enforcement is unimplemented.

specs/otel-observability-spec.md — OpenTelemetry Observability Specification (v0.4.0, Working Draft)

Analysis: Comprehensive 19-section W3C-style spec covering config, export, context propagation, trace/metric/log contracts, and compliance testing. Section 17.1.1 defines 7 Level-1 test ID stubs (T-OT-001–007); Section 17.1.2 defines 4 additional attribute-contract test IDs (T-OT-008–011). Grep of pkg/workflow/otel_observability_formal_test.go and actions/setup/js/otel_contract.test.cjs found zero references to T-OT-008 through T-OT-011 — these stubs are not yet implemented despite the spec's Compliance Testing section requiring them "before claiming Level 1 conformance."

REASONS gaps:

• Operations: §17 doesn't specify what happens if make validate-otel-contract is run before these stubs exist — currently it presumably passes without covering them, creating a false sense of conformance.
• Safeguards: No explicit statement preventing a conformance claim while stub tests are missing.

specs/replace-label-compliance/README.md and specs/replace-label-spec.md — replace-label safe-output type

Analysis: Mature, well-tested feature (v1.0.0, Candidate Recommendation). Formal predicate model (P1–P15, Q1–Q9) fully mapped to pkg/workflow/replace_label_formal_test.go and pkg/workflow/replace_label_transitions_formal_test.go, with a documented coverage-parity check dated 2026-08-05. No functional gaps identified.

REASONS gaps: Structure — the compliance README references the spec for fixture registration instructions but the spec itself has no reciprocal "Sync Notes" section pointing back to the compliance README's coverage map (asymmetric cross-referencing, unlike the intent-attribution pair).

Sync Follow-ups

• After Authorizer.AuthorizeTool wiring lands, update specs/intent-attribution-agent-governance.md's "Implementation Audit" table to mark fields as "Wired" and remove the "purely advisory" risk language.
• After T-OT-008–011 are implemented, update specs/otel-observability-spec.md §17.1.2 to mark these as implemented (not stubs) and confirm make validate-otel-contract includes them.
• Once bidirectional sync notes are added to replace-label-spec.md and replace-label-compliance/README.md, re-run the 2026-08-05-style coverage-parity check and update its date.

Context

• Files reviewed (rotation indices 5–9 of 17): specs/intent-attribution-agent-governance.md, specs/intent-attribution-compliance/README.md, specs/otel-observability-spec.md, specs/replace-label-compliance/README.md, specs/replace-label-spec.md
• Rotation state: advanced last_index from 5 to 10 in /tmp/gh-aw/cache-memory/spdd-daily/rotation.json; next run continues at specs/safe-output-outcome-evaluation.md
• Workflow run: https://github.com/github/gh-aw/actions/runs/31616080765

Generated by 📋 Daily SPDD Spec Planner · auto · 34.5 AIC · ⌖ 2.38 AIC · ⊞ 6.8K · ◷

• expires on Aug 15, 2026, 8:14 AM UTC-08:00

[github-actions]

This issue was automatically closed because it expired on 2026-08-15T16:14:25.865Z.

Closed by Workflow