[compiler-threat-spec] docs: sync compiler threat spec 1.0.30 changelog and mapping audit (#58902)

Author: github-actions[bot]

specs/compiler-threat-detection-spec.md

@@ -322,6 +322,10 @@ The mappings above are pattern-based references and MUST be validated against co
 
 When mappings change, this table MUST be updated in the same change set as the implementation update.
 
+### 7.2 Mapping Audit (2026-09-06)
+
+Audit result: ✅ all listed `CTR-001` through `CTR-026` rows currently include non-empty implementation references and non-empty test coverage targets; no `TODO` placeholders were found in the mapping table. Review window: daily optimizer cycle 2026-09-06, covering commits merged in the prior 48 hours (repository history begins at `8fb0a67`, the sole reachable commit; no additional compiler or parser diffs were available to review beyond the existing baseline). Security-relevant items evaluated: (1) **Spec-to-implementation sync gap**: the specification header and Section 2 sync table were previously bumped to version `1.0.30` (documenting the CTR-001 status-function guard for compiler-owned prerequisites, `guardIfAgainstStatusFuncBypass`/`ifExpressionContainsStatusFunc` in `pkg/workflow/compiler_builtin_job_augmentation.go`), but this Section 7.2 mapping audit and the Section 10 change log were not updated to match, violating the Section 7.3 sync protocol. Verified the guard is implemented and covered by `TestApplyBuiltinJobNeedsAugmentations_StatusFuncAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncFailureAddsSuccessGuards`, `TestApplyBuiltinJobNeedsAugmentations_StatusFuncAlwaysAddsSuccessGuards`, and `TestApplyBuiltinJobNeedsAugmentations_StatusFuncKeepsCustomJobUnguarded` (`pkg/workflow/compiler_custom_jobs_test.go`); this is a documentation-sync fix only, not a new threat class, so no new `CTR-*` rule is required. (2) Reviewed open code-scanning alerts (severity critical/high) via GitHub MCP: alerts #674/#669/#668/#667 (`go/bad-redirect-check`), #672 (`go/allocation-size-overflow`), and #663 (`js/http-to-file-access`) affect non-compiler tooling (`pkg/cli/add_package_manifest_imports.go`, `pkg/cli/add_package_manifest_includes.go`, `pkg/cli/project_command.go`, `scripts/ensure-docs-slide-pdf.js`) and are outside this specification's conformance targets (Section 3.1: `pkg/workflow/`, `pkg/parser/`, `actions/setup/`); alerts #653 (`workflow-out-of-context`) and #651/#652 (`workflow-go-graphql-injection-sprintf`) are findings from the `daily-malicious-code-scan` and `daily-semgrep-scan` workflows' own self-scans and are tracked by those workflows' remediation processes, not compiler-generated-workflow threat detection. No new compiler-side threat class identified. (3) No `threat-detection-suppress` annotations were found in any live (non-fixture, non-documentation-example) workflow source in this review window, so no `SLA_BREACH` or expiration findings apply. No new `CTR-*` rule required this cycle.
+
 ### 7.2 Mapping Audit (2026-08-31)
 
 Audit result: ✅ all listed `CTR-001` through `CTR-026` rows currently include non-empty implementation references and non-empty test coverage targets; no `TODO` placeholders were found in the mapping table. Review window: daily optimizer cycle 2026-08-31, covering commits merged in the prior 48 hours (through `ff62cdb`). Security-relevant items evaluated: (1) **Duplicate Playwright `--no-sandbox` entrypoint arg** (`pkg/workflow/mcp_renderer_builtin.go`, commit `ce08eba4b` "Fix Playwright MCP TOML sandbox configuration"): the unified MCP config renderer's `renderPlaywrightTOML` now emits the same `--no-sandbox` Chromium entrypoint flag already validated for `pkg/workflow/mcp_config_playwright_renderer.go` under the 2026-07-26 audit; this is the identical browser-process-level flag (required for headless Chromium to reach `localhost` inside CI containers), not a workflow sandbox bypass; already covered under CTR-004's established rationale; regression test `pkg/workflow/mcp_config_refactor_test.go` covers the new emission path; no new threat class; no new CTR rule required. (2) No other security-sensitive compiler or parser diffs, and no new `threat-detection-suppress` annotations, were found in the review window. Review window: SPDD daily spec review cycle 2026-07-31 (rotation index 5–9 of 18, covering `specs/compiler-threat-detection-spec.md` among others). Security-relevant items evaluated: (1) **CTR-016/018/019/020/021 sync references**: each of these five rules was individually verified against current `pkg/workflow/` source locations — `safe_update_enforcement.go` (CTR-016), `strict_mode_update_check_validation.go` (CTR-018), `cache.go` + `expression_builder.go` (CTR-019), `pkg/parser/import_bfs.go` (CTR-020), `agent_validation.go` (CTR-021); all implementation references and test coverage targets in Section 7.1 are current and accurate; no drift detected. (2) **Section 6 Optimizer Failure Safeguards** (§6.6): the three failure modes (API unavailability, runner timeout, rate-limit exhaustion) are specified normatively but are not currently covered by a dedicated unit or integration test; flagged as a coverage gap for the next implementation cycle — a future PR should add tests in `pkg/workflow/` or an integration harness that exercises the `OPTIMIZER_DEGRADED`, `OPTIMIZER_TIMEOUT`, and `OPTIMIZER_RATE_LIMITED` diagnostic paths. No new threat class; no new CTR rule required this cycle.
@@ -431,6 +435,11 @@ These optimizer-protocol IDs cover Section 6 norms; they do not add or replace t
 
 ## 10. Change Log
 
+### 1.0.30 (2026-09-06)
+
+- Reconciled the existing `1.0.30` CTR-001 status-function mapping with its missing Section 7.2 audit and Section 10 changelog entries, as required by Section 7.3.
+- Confirmed the guard implementation and tests; reviewed critical/high code-scanning alerts and live workflow sources. Findings were outside this specification's compiler targets or were self-scan findings; no new `CTR-*` rule or `SLA_BREACH` finding applies.
+
 ### 1.0.29 (2026-08-31)
 
 - Daily optimizer review cycle. Reviewed compiler and parser changes merged in the prior 48 hours (through commit `ff62cdb`). The only security-sensitive diff identified was `ce08eba4b` "Fix Playwright MCP TOML sandbox configuration" (#56800), which adds a `--no-sandbox` Chromium entrypoint arg to the unified MCP config renderer's `renderPlaywrightTOML` (`pkg/workflow/mcp_renderer_builtin.go`) so the refactored TOML-emission path matches the existing behavior of `pkg/workflow/mcp_config_playwright_renderer.go`.