docs(spec-loop): sync specs with #1453

tools/spec-loop/.last-sync

@@ -1 +1 @@
-da660f14e69670145e6096aa27626845ae910327
+77884f5c54d01e4b535051b8dc16d8fd50166223

tools/spec-loop/specs/adversarial-review.md

@@ -96,6 +96,12 @@ before the PR is created, through one shared block.
   `security-issue-import-from-scan`, `security-model-prepare`,
   `security-model-verify`, `setup-override-upstream`, and
   `setup-upstream-fix`.
+  The block covers two shapes of host: a skill that opens a PR runs the
+  reviewers once the PR's title and body are final, before the push where
+  the flow allows it; a skill that works from a PR someone else proposed
+  (verifying it, or importing it into the tracker, as
+  `security-issue-import-from-pr` does) runs them over that PR before
+  reporting on it or acting on it (#1453).
 - `validate_pre_pr_review_block` in
   `tools/skill-and-tool-validator/src/skill_and_tool_validator/__init__.py` —
   HARD check, category `pre-pr-review-block`.

tools/spec-loop/specs/repo-health-family.md

@@ -112,6 +112,13 @@ grouped, prioritised report → wait for confirmation before any write.
   A repository whose own run exits outside 0 and 11–14, or that the
   batch's stderr names in a collection warning, is the scan failure
   listed in the report.
+- **No `gh` inside command substitution.** `workflow-security-audit` never
+  passes `--gh-token "$(gh auth token)"` to zizmor: under the secure setup
+  a `gh` inside `$(…)` stays sandboxed and cannot read its credentials.
+  zizmor reads its token from `GH_TOKEN`, `GITHUB_TOKEN` or
+  `ZIZMOR_GITHUB_TOKEN`; with none set, the skill scans a shallow clone
+  made by a plain `gh repo clone`, or asks the user to run the remote scan
+  from their own terminal (#1453).
 
 ## Out of scope
 

tools/spec-loop/specs/security-issue-lifecycle.md

@@ -190,7 +190,9 @@ publication, with a human gate and an audit-log entry at every step.
   and a message matches an enabled adapter's sender or preamble pattern,
   a strict subset of the sub-skill's own *not a relay* outcome.
   `gh` calls that were wrapped in `$(…)` or piped are now plain commands,
-  which the secure setup needs.
+  which the secure setup needs; #1453 made the last one plain too
+  (`security-issue-invalidate` Step 1 no longer redirects `gh issue view`
+  into a file, it reads the JSON the plain command prints).
 - **Small always-on footprint (#1447).**
   Each security skill's `description` and `when_to_use`, which load in
   every session, state only its purpose, main trigger phrases and where