Daily threat spec optimizer: audit cycle 2026-09-09 (v1.0.31)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
pelikhan · Sep 9, 2026 · Sep 9, 2026 · Sep 9, 2026 · Sep 9, 2026 · Sep 9, 2026
commit bd6e960d5b2af00adc526b55a8ea0cc1940409b0
diff --git a/specs/compiler-threat-detection-spec.md b/specs/compiler-threat-detection-spec.md
@@ -7,7 +7,7 @@ sidebar:
 
 # GitHub Actions Compiler Threat Detection Specification
 
-**Version**: 1.0.30
+**Version**: 1.0.31
 **Status**: Candidate Recommendation  
 **Latest Version**: https://github.com/github/gh-aw/blob/main/specs/compiler-threat-detection-spec.md  
 **Editors**: GitHub Next (GitHub, Inc.)
@@ -78,6 +78,7 @@ This section anchors the specification version to the minimum gh-aw binary versi
 
 | Spec version | Minimum gh-aw binary version | Lock-file compatibility notes |
 |--------------|------------------------------|-------------------------------|
+| `1.0.31` | `v0.87.9` (or newer) | No new CTR rules; daily optimizer cycle 2026-09-09 re-audits the CTR-001 through CTR-026 mapping table against the sole reachable commit history and reviews open high/critical code-scanning alerts; alert #672 (`go/allocation-size-overflow`, `pkg/workflow/mcp_setup_generator.go:146`) is confirmed as within compiler conformance scope (Section 3.1) but is a non-security-relevant `make()` capacity hint (`len(tools)+1`) bounded by in-process frontmatter tool maps, not attacker-controlled unbounded input; not a new threat class. No `.lock.yml` schema changes. |
 | `1.0.30` | `v0.87.9` (or newer) | CTR-001 mapping adds the status-function guard for compiler-owned prerequisites; no new rule or `.lock.yml` schema change. |
 | `1.0.29` | `v0.87.9` (or newer) | No new CTR rules; extends the CTR-004 Sandbox Bypass Configuration mapping (Section 7.2 audit) to document that the unified MCP config renderer's duplicate emission of the Playwright Chromium `--no-sandbox` entrypoint flag (`pkg/workflow/mcp_renderer_builtin.go`, commit `ce08eba4b`) is the same browser-process-level flag already covered under the 2026-07-26 audit for `pkg/workflow/mcp_config_playwright_renderer.go`; not a workflow sandbox bypass. No `.lock.yml` schema changes. |
 | `1.0.28` | `v0.87.4` (or newer) | No new CTR rules; extends the CTR-004 Sandbox Bypass Configuration mapping to document the enclave GitHub proxy trust-surface additions (`pkg/workflow/enclaves.go`, `pkg/workflow/enclave_github_proxy.go`) that were already implemented and tested (`pkg/workflow/enclaves_test.go`, `pkg/workflow/enclave_github_proxy_test.go`) but absent from the Section 7.1 mapping table; `enclaves[].agent.github.cli: issues-read-v1` requires AWF network isolation (`validateEnclavesConfig` rejects when `isAWFNetworkIsolationEnabled` is false), gates on minimum AWF/MCPG versions, uses a dedicated read-only operation allowlist (`issues.comments.list`, `issues.get`, `issues.list`), and derives its upstream GitHub token from a chain that intentionally excludes the default `GITHUB_TOKEN` (`getEffectiveEnclaveGitHubToken`). No `.lock.yml` schema changes. |
@@ -322,6 +323,10 @@ The mappings above are pattern-based references and MUST be validated against co
 
 When mappings change, this table MUST be updated in the same change set as the implementation update.
 
+### 7.2 Mapping Audit (2026-09-09)
+
+Audit result: ✅ all listed `CTR-001` through `CTR-026` rows currently include non-empty implementation references and non-empty test coverage targets; no `TODO` placeholders were found in the mapping table. Review window: daily optimizer cycle 2026-09-09, covering commits merged in the prior 48 hours (repository history reachable in this sandbox begins at `bce650c`, the sole reachable commit; no additional compiler or parser diffs were available to review beyond the existing baseline). Security-relevant items evaluated: (1) Reviewed open code-scanning alerts (severity critical/high) via GitHub MCP: no open `critical`-severity alerts. One open `high`-severity alert, #672 (`go/allocation-size-overflow`), is located in `pkg/workflow/mcp_setup_generator.go:146` (`updated := make(map[string]any, len(tools)+1)` inside `toolsWithEnclaveGitHubIssues`), which is within this specification's conformance targets (Section 3.1: `pkg/workflow/`). Verified the flagged capacity hint is computed from `len(tools)`, the in-process `tools` frontmatter map parsed from the workflow's own YAML/JSON frontmatter (already size-bounded by the compiler's frontmatter parsing and schema validation prior to this call), not from unbounded or externally-controlled runtime input; the `+1` addend cannot cause a practical `int` overflow given realistic tool-map sizes, and even a theoretical overflow would only affect a `make` capacity hint (denial-of-service via panic at worst), not memory-safety-relevant or trust-boundary-crossing behavior. This is a code-quality/robustness finding, not a compiler-generated-workflow threat class; no new `CTR-*` rule required. The alert's four other open high-severity siblings (#674/#669/#668/#667, `go/bad-redirect-check`, in `pkg/cli/add_package_manifest_imports.go`, `pkg/cli/add_package_manifest_includes.go`, `pkg/cli/project_command.go`) and #663 (`js/http-to-file-access`, `scripts/ensure-docs-slide-pdf.js`) remain outside conformance targets as previously noted in the 2026-09-06 audit. (2) No `threat-detection-suppress` annotations were found in any live (non-fixture, non-documentation-example) workflow source in this review window, so no `SLA_BREACH` or expiration findings apply. No new `CTR-*` rule required this cycle.
+
 ### 7.2 Mapping Audit (2026-09-06)
 
 Audit result: ✅ all listed `CTR-001` through `CTR-026` rows currently include non-empty implementation references and non-empty test coverage targets; no `TODO` placeholders were found in the mapping table. Review window: daily optimizer cycle 2026-09-06, covering commits merged in the prior 48 hours (repository history begins at `8fb0a67`, the sole reachable commit; no additional compiler or parser diffs were available to review beyond the existing baseline). Security-relevant items evaluated: (1) **Spec-to-implementation sync gap**: the specification header and Section 2 sync table were previously bumped to version `1.0.30` (documenting the CTR-001 status-function guard for compiler-owned prerequisites, `guardIfAgainstStatusFuncBypass`/`ifExpressionContainsStatusFunc` in `pkg/workflow/compiler_builtin_job_augmentation.go`), but this Section 7.2 mapping audit and the Section 10 change log were not updated to match, violating the Section 7.3 sync protocol. Verified the guard is implemented and covered by `TestApplyBuiltinJobNeedsAugmentations_StatusFuncAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncFailureAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncAlwaysAddsSuccessGuards`, and `TestApplyBuiltinJobNeedsAugmentations_StatusFuncKeepsCustomJobUnguarded` (`pkg/workflow/compiler_custom_jobs_test.go`); this is a documentation-sync fix only, not a new threat class, so no new `CTR-*` rule is required. (2) Reviewed open code-scanning alerts (severity critical/high) via GitHub MCP: alerts #674/#669/#668/#667 (`go/bad-redirect-check`), #672 (`go/allocation-size-overflow`), and #663 (`js/http-to-file-access`) affect non-compiler tooling (`pkg/cli/add_package_manifest_imports.go`, `pkg/cli/add_package_manifest_includes.go`, `pkg/cli/project_command.go`, `scripts/ensure-docs-slide-pdf.js`) and are outside this specification's conformance targets (Section 3.1: `pkg/workflow/`, `pkg/parser/`, `actions/setup/`); alerts #653 (`workflow-out-of-context`) and #651/#652 (`workflow-go-graphql-injection-sprintf`) are findings from the `daily-malicious-code-scan` and `daily-semgrep-scan` workflows' own self-scans and are tracked by those workflows' remediation processes, not compiler-generated-workflow threat detection. No new compiler-side threat class identified. (3) No `threat-detection-suppress` annotations were found in any live (non-fixture, non-documentation-example) workflow source in this review window, so no `SLA_BREACH` or expiration findings apply. No new `CTR-*` rule required this cycle.
@@ -435,6 +440,12 @@ These optimizer-protocol IDs cover Section 6 norms; they do not add or replace t
 
 ## 10. Change Log
 
+### 1.0.31 (2026-09-09)
+
+- Daily optimizer review cycle. Reachable commit history in this sandbox is limited to `bce650c` (no additional compiler or parser diffs to review beyond the existing baseline).
+- Reviewed open critical/high code-scanning alerts. No open critical alerts. Evaluated open high-severity alert #672 (`go/allocation-size-overflow`, `pkg/workflow/mcp_setup_generator.go:146`, within `pkg/workflow/` conformance scope): the flagged `make(map[string]any, len(tools)+1)` capacity hint is derived from the already-parsed, schema-validated, in-process frontmatter `tools` map, not attacker-controlled unbounded input, so no practical overflow or new compiler-generated-workflow threat class applies; documented in Section 7.2 as a code-quality finding, no new `CTR-*` rule required.
+- No `threat-detection-suppress` annotations found in this review window; no `SLA_BREACH` findings.
+
 ### 1.0.30 (2026-09-06)
 
 - Reconciled the existing `1.0.30` CTR-001 status-function mapping with its missing Section 7.2 audit and Section 10 changelog entries, as required by Section 7.3.