From 3bc9213a7161dfa8fc53a2662061adbbcad2af10 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Mon, 19 Oct 2026 20:31:43 +0200 Subject: [PATCH] docs(spec-loop): sync specs with main up to 03c15a6d1 Hand-sync of tools/spec-loop/specs/ with the functionality that landed between ccb53a388 and 03c15a6d1. Specs changed: - security-issue-lifecycle: the tools/security-management shared library gains drafting, recipients and numbered; the package reuses github-body-field, generate-cve-json and magpie-vcs (the embargo scrub); every skill of the family now has its CLI family, completing the deep split (#1672); the Validation block runs its pytest suite. - .last-sync bumped to 03c15a6d1. No spec change needed (specs already updated in the commit itself): 03c15a6d1 (#1712), c819c9023 (#1711), dacf00a5d (#1710), cb6bb8b8f (#1705). Exempt: aee01bf27 (the previous sync), 0bd021f67 (npm pin bump in prek hooks). Generated-by: Claude Opus 5 --- tools/spec-loop/.last-sync | 2 +- tools/spec-loop/specs/security-issue-lifecycle.md | 11 +++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/tools/spec-loop/.last-sync b/tools/spec-loop/.last-sync index 90f78dfde..b5d2b7317 100644 --- a/tools/spec-loop/.last-sync +++ b/tools/spec-loop/.last-sync @@ -1 +1 @@ -ccb53a38843646e1d02f97b1a27253b82aa2675d +03c15a6d1c9f51c58e492ecff87036af05388d06 diff --git a/tools/spec-loop/specs/security-issue-lifecycle.md b/tools/spec-loop/specs/security-issue-lifecycle.md index 3aabed7d8..c2f817971 100644 --- a/tools/spec-loop/specs/security-issue-lifecycle.md +++ b/tools/spec-loop/specs/security-issue-lifecycle.md @@ -63,8 +63,14 @@ publication, with a human gate and an audit-log entry at every step. - `tools/security-management` (stdlib, runs nothing) holds the deterministic rules of the security skills, one CLI family per skill over a shared library (`body`, `rollup`, `refs`, `titles`, `grammar`, - `keyword`, and `fields` / `threads` / `dispositions` / `selectors` for - reading existing trackers, #1672). For `security-issue-import` it decides the Step 0 + `keyword`, `fields` / `threads` / `dispositions` / `selectors` for + reading existing trackers, and `drafting` / `recipients` / `numbered` + for reporter drafts, the security CC and the numbered-proposal reply, + #1672). It reuses, never copies, three stdlib workspace members: + github-body-field (the field parser), generate-cve-json (the bot-credit + policy) and magpie-vcs (the embargo scrub of public text). Every skill + of the family — the five importers, triage, invalidate, cve-allocate, + deduplicate, sync and fix — now has its family. For `security-issue-import` it decides the Step 0 disclosure-governance defaults, the Step 1 pre-filter, the Step 2 `threadId` batches and their attribution, the Step 3 forwarder pre-screen, the Step 6 reply grammar and the Step 7 receipt-draft @@ -507,6 +513,7 @@ publication, with a human gate and an audit-log entry at every step. ```bash uv run --project tools/skill-and-tool-validator --group dev skill-and-tool-validate +uv run --project tools/security-management --group dev pytest uv run --project tools/cve-tool-vulnogram/generate-cve-json --group dev pytest uv run --project tools/gmail/oauth-draft pytest ```