[daily-security-observability] Restore and persist 7-day cache snapshot with stale-age gating

[Copilot]

The Daily Security Observability workflow declared shared cache-memory but did not reliably reuse prior 7-day DIFC state, causing cold recomputation despite available history. This change adds an explicit warm-start + staleness gate and ensures the updated snapshot is written back on every run.

• Cache warm-start (startup restore)

  • Added restore logic from /tmp/gh-aw/cache-memory/security-observability/filtered-logs.snapshot.json.
  • Loads cached runs into /tmp/gh-aw/agent/integrity/filtered-logs.json when cache metadata is present and valid.

• Explicit stale-data detection

  • Added age validation using updated_at with a 7-day TTL.
  • Treats missing/expired metadata as stale and falls back to fresh collection.

• Fresh + cached state merge

  • Downloads fresh --filtered-integrity logs into a separate file.
  • Merges cached and fresh runs, deduping by run_id with deterministic precedence.

• Always persist updated snapshot

  • Writes the merged 7-day view back to cache-memory each run with:
    • updated_at
    • runs
    • summary.total_runs

• Workflow guidance alignment

  • Updated Phase 3 instructions to reflect warm-start validation and stale-cache handling semantics.

CACHE_FILE=/tmp/gh-aw/cache-memory/security-observability/filtered-logs.snapshot.json
RUN_FILE=/tmp/gh-aw/agent/integrity/filtered-logs.json
FRESH_LOGS=/tmp/gh-aw/agent/integrity/filtered-logs.fresh.json
MAX_CACHE_AGE_SECONDS=$((7 * 24 * 60 * 60))

# restore if fresh; otherwise treat as stale
# collect fresh logs
# merge cached+fresh by run_id
# persist merged snapshot with updated_at

[Copilot]

Pull request overview

This PR updates the Daily Security Observability workflow to reuse a cached 7‑day DIFC integrity-filtered log snapshot across runs, apply a staleness gate (7 days), merge cached + fresh results deterministically, and write the updated snapshot back each run. It also updates Phase 3 guidance to reflect the new warm-start semantics.

Changes:

• Added warm-start restore from a cached snapshot file and a 7‑day updated_at TTL gate.
• Downloaded fresh logs to a separate file, merged cached+fresh runs by run_id (fresh wins), and always persisted a merged snapshot back to cache-memory.
• Updated Phase 3 instructions to describe warm-start validation and stale-cache behavior.

Show a summary per file

File	Description
.github/workflows/daily-security-observability.md	Adds warm-start/merge/persist logic for DIFC integrity-filtered logs and updates Phase 3 instructions accordingly.
.github/workflows/daily-security-observability.lock.yml	Regenerates the compiled workflow to include the updated run script.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 4