diff --git a/pkg/repoutil/README.md b/pkg/repoutil/README.md
index e2a62bebbd6..cd8ec232818 100644
--- a/pkg/repoutil/README.md
+++ b/pkg/repoutil/README.md
@@ -32,12 +32,20 @@ if err != nil {
 **Internal**:
 - `github.com/github/gh-aw/pkg/logger` — debug logging
 
+## Thread Safety
+
+Both functions are pure and stateless; they MAY be called concurrently without synchronization.
+
 ## Design Notes
 
 - All debug output uses `logger.New("repoutil:repoutil")` and is only emitted when `DEBUG=repoutil:*`.
 - For paths that include sub-folders (e.g. GitHub Actions `uses:` fields such as `github/codeql-action/upload-sarif`), use `gitutil.ExtractBaseRepo` first to strip the sub-path before calling `SplitRepoSlug`.
 - `NormalizeRepoForAPI` only treats three-segment strings as `HOST/owner/repo`; plain `owner/repo` values are returned unchanged with an empty host.
 
+## Source Synchronization
+
+Reviewed against source on 2026-07-26; no public-contract deltas identified.
+
 ---
 
 *This specification is automatically maintained by the [spec-extractor](../../.github/workflows/spec-extractor.md) workflow.*
diff --git a/pkg/sliceutil/README.md b/pkg/sliceutil/README.md
index 3d577dc9614..b6be7f7af9e 100644
--- a/pkg/sliceutil/README.md
+++ b/pkg/sliceutil/README.md
@@ -64,6 +64,10 @@ keys := sliceutil.SortedKeys(m)
 **External**:
 - None beyond the Go standard library (`slices`).
 
+## Thread Safety
+
+All functions in this package are pure and stateless — they create and return new slices or maps without writing to shared state. Callers MAY call any function concurrently without synchronization.
+
 ## Design Notes
 
 - `Any` is implemented via `slices.ContainsFunc` from the standard library.
@@ -71,6 +75,10 @@ keys := sliceutil.SortedKeys(m)
 - `SortedKeys` delegates to `slices.Sorted(maps.Keys(m))` from the standard library and returns a new sorted slice each call.
 - None of the other functions sort their output; callers that require sorted results should call `slices.Sort` on the returned slice.
 
+## Source Synchronization
+
+Reviewed against source on 2026-07-26; no public-contract deltas identified.
+
 ---
 
 *This specification is automatically maintained by the [spec-extractor](../../.github/workflows/spec-extractor.md) workflow.*