From 721d562ea6100443acde61a580028e92bad8dab2 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 26 Jul 2026 10:14:00 +0000
Subject: [PATCH] docs: update package specifications for repoutil and
 sliceutil

Add Thread Safety and Source Synchronization sections to repoutil and
sliceutil README.md specifications, bringing them in line with other
package specs in the repository.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 pkg/repoutil/README.md  | 8 ++++++++
 pkg/sliceutil/README.md | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/pkg/repoutil/README.md b/pkg/repoutil/README.md
index e2a62bebbd6..cd8ec232818 100644
--- a/pkg/repoutil/README.md
+++ b/pkg/repoutil/README.md
@@ -32,12 +32,20 @@ if err != nil {
 **Internal**:
 - `github.com/github/gh-aw/pkg/logger` — debug logging
 
+## Thread Safety
+
+Both functions are pure and stateless; they MAY be called concurrently without synchronization.
+
 ## Design Notes
 
 - All debug output uses `logger.New("repoutil:repoutil")` and is only emitted when `DEBUG=repoutil:*`.
 - For paths that include sub-folders (e.g. GitHub Actions `uses:` fields such as `github/codeql-action/upload-sarif`), use `gitutil.ExtractBaseRepo` first to strip the sub-path before calling `SplitRepoSlug`.
 - `NormalizeRepoForAPI` only treats three-segment strings as `HOST/owner/repo`; plain `owner/repo` values are returned unchanged with an empty host.
 
+## Source Synchronization
+
+Reviewed against source on 2026-07-26; no public-contract deltas identified.
+
 ---
 
 *This specification is automatically maintained by the [spec-extractor](../../.github/workflows/spec-extractor.md) workflow.*
diff --git a/pkg/sliceutil/README.md b/pkg/sliceutil/README.md
index 3d577dc9614..b6be7f7af9e 100644
--- a/pkg/sliceutil/README.md
+++ b/pkg/sliceutil/README.md
@@ -64,6 +64,10 @@ keys := sliceutil.SortedKeys(m)
 **External**:
 - None beyond the Go standard library (`slices`).
 
+## Thread Safety
+
+All functions in this package are pure and stateless — they create and return new slices or maps without writing to shared state. Callers MAY call any function concurrently without synchronization.
+
 ## Design Notes
 
 - `Any` is implemented via `slices.ContainsFunc` from the standard library.
@@ -71,6 +75,10 @@ keys := sliceutil.SortedKeys(m)
 - `SortedKeys` delegates to `slices.Sorted(maps.Keys(m))` from the standard library and returns a new sorted slice each call.
 - None of the other functions sort their output; callers that require sorted results should call `slices.Sort` on the returned slice.
 
+## Source Synchronization
+
+Reviewed against source on 2026-07-26; no public-contract deltas identified.
+
 ---
 
 *This specification is automatically maintained by the [spec-extractor](../../.github/workflows/spec-extractor.md) workflow.*