Skip to content

docs(spec-loop): sync specs with main up to 03c15a6d1 #1713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
potiuk merged 1 commit into from
Oct 19, 2026
Merged

docs(spec-loop): sync specs with main up to 03c15a6d1 #1713

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion tools/spec-loop/.last-sync
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
ccb53a38843646e1d02f97b1a27253b82aa2675d
03c15a6d1c9f51c58e492ecff87036af05388d06
11 changes: 9 additions & 2 deletions tools/spec-loop/specs/security-issue-lifecycle.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,8 +63,14 @@ publication, with a human gate and an audit-log entry at every step.
- `tools/security-management` (stdlib, runs nothing) holds the
deterministic rules of the security skills, one CLI family per skill
over a shared library (`body`, `rollup`, `refs`, `titles`, `grammar`,
`keyword`, and `fields` / `threads` / `dispositions` / `selectors` for
reading existing trackers, #1672). For `security-issue-import` it decides the Step 0
`keyword`, `fields` / `threads` / `dispositions` / `selectors` for
reading existing trackers, and `drafting` / `recipients` / `numbered`
for reporter drafts, the security CC and the numbered-proposal reply,
#1672). It reuses, never copies, three stdlib workspace members:
github-body-field (the field parser), generate-cve-json (the bot-credit
policy) and magpie-vcs (the embargo scrub of public text). Every skill
of the family — the five importers, triage, invalidate, cve-allocate,
deduplicate, sync and fix — now has its family. For `security-issue-import` it decides the Step 0
disclosure-governance defaults, the Step 1 pre-filter, the Step 2
`threadId` batches and their attribution, the Step 3 forwarder
pre-screen, the Step 6 reply grammar and the Step 7 receipt-draft
Expand Down Expand Up @@ -507,6 +513,7 @@ publication, with a human gate and an audit-log entry at every step.

```bash
uv run --project tools/skill-and-tool-validator --group dev skill-and-tool-validate
uv run --project tools/security-management --group dev pytest
uv run --project tools/cve-tool-vulnogram/generate-cve-json --group dev pytest
uv run --project tools/gmail/oauth-draft pytest
```
Expand Down