The spec-guard job is now failing on develop CI runs that read the current factory-artifacts content. First observed on a downstream fork (ArcavenAE/jira-cli run 29461136967, a Formula-only commit); upstream's last develop CI (15:07 UTC, run 29426681872) predates the factory-artifacts spec pushes, so the next develop push here will hit the same failure.
scripts/check-bc-no-numeric-test-counts.sh flags:
.factory/specs/prd/bc-2-issue-read.md:739 ... SEC-576-003 (CWE-522 credential-stripping wiremock test requirement added 2026-07-15)
.factory/specs/prd/bc-3-issue-write.md:3256 ... SEC-576-004 (CWE-93 multipart encoding test added 2026-07-15)
.factory/specs/prd/bc-3-issue-write.md:3308 ... SEC-576-005 (CWE-352 X-Atlassian-Token step-1 wiremock test added 2026-07-15)
These are false positives. The guard's pattern
PATTERN='[0-9]+[[:space:]]+([[:alnum:]_-]+[[:space:]]+){0,3}tests?([^[:alnum:]]|$)'
has no left boundary on [0-9]+, so it matches the digits inside hyphenated identifiers: "CWE-522 credential-stripping wiremock test", "CWE-93 multipart encoding test", "CWE-352 X-Atlassian-Token step-1 wiremock test". The Trace lines are qualitative descriptions with CWE references — exactly what PG-365-1 asks for — not numeric test counts.
Suggested one-line fix (require the number not to be glued to a preceding word/hyphen):
PATTERN='(^|[^[:alnum:]-])[0-9]+[[:space:]]+([[:alnum:]_-]+[[:space:]]+){0,3}tests?([^[:alnum:]]|$)'
Behavior check: "16 wiremock tests" still flagged (preceded by space); "CWE-522 ... test" no longer flagged (522 preceded by '-'); "step-1 wiremock test" no longer flagged; dates like "added 2026-07-15" were never flagged (digits not followed by whitespace) and remain unflagged.
Alternative is rewording the three Trace lines, but CWE references in Trace fields seem worth keeping legal.
The spec-guard job is now failing on develop CI runs that read the current factory-artifacts content. First observed on a downstream fork (ArcavenAE/jira-cli run 29461136967, a Formula-only commit); upstream's last develop CI (15:07 UTC, run 29426681872) predates the factory-artifacts spec pushes, so the next develop push here will hit the same failure.
scripts/check-bc-no-numeric-test-counts.shflags:These are false positives. The guard's pattern
has no left boundary on
[0-9]+, so it matches the digits inside hyphenated identifiers: "CWE-522 credential-stripping wiremock test", "CWE-93 multipart encoding test", "CWE-352 X-Atlassian-Token step-1 wiremock test". The Trace lines are qualitative descriptions with CWE references — exactly what PG-365-1 asks for — not numeric test counts.Suggested one-line fix (require the number not to be glued to a preceding word/hyphen):
Behavior check: "16 wiremock tests" still flagged (preceded by space); "CWE-522 ... test" no longer flagged (522 preceded by '-'); "step-1 wiremock test" no longer flagged; dates like "added 2026-07-15" were never flagged (digits not followed by whitespace) and remain unflagged.
Alternative is rewording the three Trace lines, but CWE references in Trace fields seem worth keeping legal.