SPDD spec alignment: add REASONS Norms/Entities, conflict-order analysis, and extension-field compliance fixture

[Copilot]

SPDD rotation flagged REASONS conformance gaps in key specs: missing explicit Norms/Entities sections, unclear conflict precedence in access-control extension fields, and weak compliance-spec discoverability. This PR adds explicit structure and cross-links so conformance scanning and downstream maintenance are less ambiguous.

• GitHub MCP access-control spec: REASONS structure + precedence analysis

  • Added explicit ## Norms and ## Entities sections.
  • Updated ToC to include the new sections.
  • Added §4.4.8 Precedence and Conflict Resolution (Analysis) clarifying guard order for repos → roles → blocked-users, with worked deny-path examples.
  • Extended §11.4 fixture table with a direct extension-field conformance fixture entry.

• Safe outputs spec: entity model + implementation checklist

  • Added explicit ## Entities section for core config/runtime artifacts.
  • Added §6.0 Files Modified (Implementation Checklist) under GitHub operations for implementation traceability.
  • Updated ToC for new section numbering.

• AW harness spec: formalized entities + budget overrun failure mode

  • Added explicit ## Entities for harness.budget, harness.context, harness.steering, and harness.extensions.
  • Added §7.1.1 Budget-Exceeded Failure Mode to make mid-turn budget exhaustion behavior explicit and cross-referenced from execution flow.
  • Added sync-note linkage for §8.5 observability with logger docs.

• Compliance docs discoverability and anchor precision

  • Expanded specs/awf-config-sources-compliance/README.md with concrete section-anchor links to awf-config-sources-spec.md.
  • Added sync note in pkg/logger/README.md to keep AW harness observability schema/docs aligned.

• New compliance fixture for extension fields

  • Added specs/github-mcp-access-control-compliance/blocked-users-min-integrity-extension-fields.yaml.
  • Registered it in compliance fixture index for direct §4.4.4/§4.4.5 coverage.

# new fixture excerpt
fixture_id: "blocked-users-min-integrity-extension-fields"
scenarios:
  - scenario_id: "blocked-users-min-integrity-extension-fields-A"
    expected:
      decision: deny
      error_code: -32006
  - scenario_id: "blocked-users-min-integrity-extension-fields-B"
    expected:
      decision: deny
      error_code: -32005

• Fixes [spdd] Daily spec work plan - 2026-07-30 #49173

[github-actions]

Warning

threat detection engine error
The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding.

Details

The threat detection engine failed to produce results.

Review the workflow run logs for details.

✅ Great work on the spec alignment! This PR strengthens conformance scanning and downstream maintenance by adding explicit Norms and Entities sections across three key specifications (GitHub MCP access-control, safe-outputs, and AW harness), along with detailed conflict-resolution analysis and a new compliance fixture for extension-field coverage.

The changes are well-structured:

• Specification clarity: New §4.4.8 precedence analysis with worked examples makes guard evaluation order explicit
• Compliance traceability: Added blocked-users-min-integrity-extension-fields.yaml fixture directly covers §4.4.4/§4.4.5 extension-field semantics
• Cross-doc sync notes: Harness observability linkage and config-sources compliance links improve maintainability
• Entity catalogs: Each spec now documents its key data structures for clearer implementation contracts

Status: Ready for review and merge. All changes are focused on spec maturity without touching runtime code.

Generated by ✅ Contribution Check · auto · 55.7 AIC · ⊞ 8.7K · ◷

[github-actions]

PR Triage

Category: docs - Risk: low - Score: 42/100

Impact	Urgency	Quality
18	8	16

Recommended action: batch_review (batch: spec-docs-20260730)

7-file spec/compliance-doc alignment (+160/-6), draft, CI pending. Content-only spec edits with a new compliance fixture; no code paths touched. Batch with #49177 and #49171 for a single review session. Undraft and confirm CI before merge.

Generated by 🔧 PR Triage Agent · auto · 46.2 AIC · ⌖ 7.96 AIC · ⊞ 7.9K · ◷