SPDD sync pass: close forecast migration sync, add MCP secret-scope conformance, and align spec notes

[Copilot]

This PR addresses the 2026-07-07 SPDD work-plan gaps across Forecast, Frontmatter Hash, Effective Tokens, MCP Scripts, and Fuzzy Schedule specs. It closes the highest-risk sync drift by making AIC/ET migration status explicit in Forecast and adding missing conformance coverage for MCP secret-scope norms.

• Forecast spec sync updates

  • Added a §14 sync mapping row for safeguards cross-reference (§10.7 / Appendix F).
  • Resolved the open AIC-primary / ET-legacy sync item with explicit field-level assertions and tracking reference.

• Frontmatter Hash deferral clarity

  • Added a Deferral acceptance criteria subsection under §Sync Notes.
  • Embedded the [spdd] Daily spec work plan - 2026-05-13 #31983 prerequisite checklist directly in-spec so review does not require issue context switching.

• Effective Tokens deprecation path

  • Strengthened the deprecation caution block with a direct migration-path link to the AI Credits spec.

• MCP Scripts spec-to-test linkage

  • Added a §12.1.4 / T-MCP-051 sync-map row pointing to mcp_scripts_renderer_test.go with [Open] status.
  • Added an explicit cross-link from Go sandbox constraints to §10 Safeguards.

• Conformance tests added

  • Added TestMCPScriptsScopeConformance to exercise SN-SCOPE-01..04 behavior (per-tool bindings, shared-secret handling, and no secret expression leakage in rendered tool config).
  • Added weighted-slot distribution coverage in schedule_fuzzy_scatter_test.go to assert BEST-hour selection frequency is materially higher than OK-hour frequency over a large deterministic sample.

// SN-SCOPE-04 guard: rendered config must not carry secret expressions.
if strings.Contains(toolsJSON, "secrets.ALPHA_ONLY") ||
   strings.Contains(toolsJSON, "secrets.BETA_ONLY") ||
   strings.Contains(toolsJSON, "secrets.SHARED_SECRET") {
    t.Fatalf("tools.json must not contain secret expressions: %s", toolsJSON)
}

[Copilot]

Pull request overview

This PR performs an SPDD “sync pass” across multiple specifications and adds/extends Go conformance tests to reduce spec↔implementation drift—especially around Forecast AIC/ET migration clarity, MCP secret-scope isolation, and fuzzy schedule weighted scatter behavior.

Changes:

• Added MCP secret-scope conformance coverage via a new TestMCPScriptsScopeConformance test ensuring tools.json does not embed secret expressions and that per-tool env bindings remain isolated.
• Added a deterministic large-sample test to validate the weighted daily scatter distribution favors BEST hours materially more than a sampled BROAD window.
• Updated several specs (Forecast, MCP Scripts, Frontmatter Hash, Effective Tokens) to clarify sync mappings, deferral acceptance criteria, and deprecation/migration references.

Show a summary per file

File	Description
pkg/workflow/mcp_scripts_renderer_test.go	Adds secret-scope isolation conformance test for MCP scripts tool rendering.
pkg/parser/schedule_fuzzy_scatter_test.go	Adds statistical test asserting BEST-hour weighting is materially higher than a sampled BROAD window.
docs/src/content/docs/specs/mcp-scripts-specification.md	Updates sync-map linkage for new test and cross-links Go sandbox constraints to safeguards.
docs/src/content/docs/specs/frontmatter-hash-specification.md	Adds in-spec deferral acceptance checklist tied to issue #31983.
docs/src/content/docs/specs/forecast-specification.md	Extends sync map and resolves AIC-primary / ET-legacy migration notes with explicit field assertions.
docs/src/content/docs/specs/effective-tokens-specification.md	Strengthens deprecation notice by linking directly to the AI Credits spec as the migration path.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Low