📝 docs(spec): decompose the 2026-08-18 audit Next wave as epic P5-AUD2 (D-152) - #76
Merged
Conversation
…2 (D-152) Five INVEST stories over the audit's named risk-reduction wave: the exec transport trio (REL-01 bound stdout, REL-02 WaitDelay, REL-07 stderr), REL-03 ErrNotFound discrimination at the provider-declaration fetch, SEC-03 cosign identity pin in install.sh, TEST-02's demonstrated surviving mutant, and a PR-visible exit gate. Every Verify: line is the audit's own verification recipe, not an invented one. WG-S01 is deliberately excluded (LGTM governance marker). The exit gate is a task check stage rather than a release-exitgate step, because that job is pull_request-skipped (RELSE-08) — the same blind spot that hid AUD-S18's stale CHECK_STAGES pin for four merges.
docs/decisions/decisions.md is inside the mkdocs docs_dir; a relative link out to openspec/ has no target among documentation files and aborts the strict build. Every other spec reference in this file is a plain backticked path — follow that convention. Gap noted: mkdocs --strict is not a task check stage, so no local gate catches this class. Logged to the INBOX as a Later-wave docs item.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Spec-first decomposition of the "Next (risk reduction)" wave named by
agent-context/PROJECT-AUDIT-2026-08-18.md. Spec-only — no code, no schema, no workflow changes.What lands
openspec/specs/p5-aud2-audit-remediation/spec.md— 5 INVEST stories, 26 REQs, every one carryingTest:/Verify:/Level:.openspec/specs/backlog.md— the AUD2 section + story table.docs/decisions/decisions.md— D-152 (why a new epic rather than loose commits or reopening P5-AUD).The stories
CallExecerrors.Is(err, forge.ErrNotFound)at the provider-declaration fetch; engine-gradehack/install.sh, with aSECURITY.mddrift gate{S01 ∥ S02 ∥ S03 ∥ S04} → S05, file-disjoint.Three things recorded so they aren't re-litigated
task checkstage, not arelease-exitgatestep. That job ispull_request-skipped (RELSE-08) — which is exactly how AUD-S18's own staleCHECK_STAGESpin survived four merges (INBOX 2026-08-16). S05 adds the stage and updatesCHECK_STAGESin the same commit.Every
Verify:line is the audit's own verification recipe, lifted verbatim — e.g. REL-02's "stub forkingsleep 60 &must return within ~2× timeout", TEST-02's "the mutation is killed". Three of the four findings exist because a passing suite did not notice them, so each story's DoD names the mutation that must redden.Gate
task checkgreen on this head (exit 0), includingchangelog-verify—CHANGELOG.mdregenerated and amended into the commit.