ahmido
92704a2f7e
Implements Spec 118 baseline drift engine improvements: - Resumable, budget-aware evidence capture for baseline capture/compare runs (resume token + UI action) - “Why no findings?” reason-code driven explanations and richer run context panels - Baseline Snapshot resource (list/detail) with fidelity visibility - Retention command + schedule for pruning baseline-purpose PolicyVersions - i18n strings for Baseline Compare landing Verification: - `vendor/bin/sail bin pint --dirty --format agent` - `vendor/bin/sail artisan test --compact --filter=Baseline` (159 passed) Note: - `docs/audits/redaction-audit-2026-03-04.md` left untracked (not part of PR). Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #143
49 lines
2.3 KiB
Markdown
49 lines
2.3 KiB
Markdown
# Specification Quality Checklist: Golden Master Deep Drift v2 (Full Content Capture)
|
|
|
|
**Purpose**: Validate specification completeness and quality before proceeding to planning
|
|
**Created**: 2026-03-03
|
|
**Feature**: [specs/118-baseline-drift-engine/spec.md](../spec.md)
|
|
|
|
## Content Quality
|
|
|
|
- [x] No implementation details (languages, frameworks, APIs)
|
|
- [x] Focused on user value and business needs
|
|
- [x] Written for non-technical stakeholders
|
|
- [x] All mandatory sections completed
|
|
|
|
## Requirement Completeness
|
|
|
|
- [x] No [NEEDS CLARIFICATION] markers remain
|
|
- [x] Requirements are testable and unambiguous
|
|
- [x] Success criteria are measurable
|
|
- [x] Success criteria are technology-agnostic (no implementation details)
|
|
- [x] All acceptance scenarios are defined
|
|
- [x] Edge cases are identified
|
|
- [x] Scope is clearly bounded
|
|
- [x] Dependencies and assumptions identified
|
|
|
|
## Feature Readiness
|
|
|
|
- [x] All functional requirements have clear acceptance criteria
|
|
- [x] User scenarios cover primary flows
|
|
- [x] Feature meets measurable outcomes defined in Success Criteria
|
|
- [x] No implementation details leak into specification
|
|
|
|
## Constitution & Spec 118 Gates
|
|
|
|
- [x] Cross-tenant subject matching terminology is defined and consistent (`subject_key` is defined and tied to normalization rules)
|
|
- [x] Workspace-owned snapshot items explicitly forbid persisting tenant identifiers (including tenant IDs and tenant external IDs)
|
|
- [x] Compare behavior for missing/ambiguous cross-tenant matching is specified (gap reason + suppress drift evaluation)
|
|
- [x] Coverage proof guard is specified (missing-policy outcomes suppressed when coverage is unproven)
|
|
- [x] Rollout gate requirement exists for full-content mode (canary flag)
|
|
- [x] Security requirement exists to redact secrets/PII before persistence/fingerprinting
|
|
- [x] Baseline-purpose evidence visibility is explicitly tied to baseline-related capabilities (no `tenant.view`-only access)
|
|
- [x] Audit events requirement exists for starting capture/compare runs (and includes purpose + summary context)
|
|
- [x] Retention requirement exists for baseline-purpose evidence distinct from long-term backups
|
|
- [x] Findings recurrence identity/lifecycle requirement exists and is independent of fingerprints
|
|
- [x] Ops-UX “no silent zeros” requirement exists (reason codes + UI explanation)
|
|
|
|
## Notes
|
|
|
|
- Validated on 2026-03-03; all checks passing.
|