Advisory review, this PR is from a maintainer. Findings are informational only.

Review Summary

This PR delivers a well-structured parity update that brings the SSSC Planner in line with the RAI Planner's architecture: consistent disclaimer tier handling, the new BySessionPath cosign-signing flow, a formal JSON Schema for state.json, and full prompt rewrites for all five entry modes. The overall design and implementation quality is high.

Six informational findings are noted below; the two schema-alignment issues are the most worth addressing before merge since they could cause runtime validation failures.

Issue Alignment

The PR description states "N/A" for Related Issue(s). No GitHub issue is linked. While acceptable for maintainer-driven changes, linking an issue (even a tracking issue) is recommended so change intent is traceable over time.

PR Template Compliance

• ✅ Description is filled in with clear intent and file-level changes.
• ✅ Type of Change checkboxes are checked and match the actual diff (Copilot agent, prompt, instructions, script, schema).
• ⚠️ Related Issue(s) is "N/A" — no linked issue.
• ✅ Testing section references npm run test:ps.
• ✅ Checklist items are checked.

Coding Standards

PowerShell (Sign-PlannerArtifacts.ps1)

The new BySessionPath parameter set follows existing patterns correctly: copyright header, #Requires, CmdletBinding, [OutputType()], $ErrorActionPreference = 'Stop', and comment-based help are all in order. One path-separator edge case is noted in the inline comment at line 183.

Prompt Files (sssc-capture.prompt.md, sssc-from-prd.prompt.md, sssc-from-brd.prompt.md, sssc-from-security-plan.prompt.md)

All four entry-mode prompts reference outputPreferences as a state.json key. This field does not exist in the new sssc-state.schema.json, which uses "additionalProperties": false. The correct path is userPreferences.targetSystem. See inline comments on sssc-capture.prompt.md:43 and sssc-from-prd.prompt.md:52; the same correction applies to the BRD and security-plan variants.

Instructions Files

• sssc-handoff.instructions.md:105 references userPreferences.signingRequested, but signingRequested is a top-level field in the schema, not nested under userPreferences. See inline comment.
• sssc-identity.instructions.md:120 shows a userPreferences template with only autonomyTier; the schema now requires five fields. See inline comment.

Code Quality

• sssc-state.schema.json: Well-formed JSON Schema draft 2020-12. The 16 required fields, entryMode enum, and userPreferences sub-schema with five required fields are consistent with the agent file's sample state. disclaimerShownAt and signingManifestPath are correctly omitted from required (nullable). No issues found.
• Test files: Both Validate-PlannerArtifacts.Tests.ps1 and Sign-PlannerArtifacts.Tests.ps1 follow Pester 5 conventions. The rename from human-facing-with-disclaimer to rai-handoff-with-disclaimer and the new sssc-handoff-with-disclaimer tier are covered by the updated tests.
• Footer config files: The tiered footer design (sssc-*.instructions.md scoped to both agentic and human-facing) mirrors the established RAI pattern. The configuration looks intentional and correct.

Action Items

Generated by PR Review for issue #1497 · ● 2.4M

Advisory review, this PR is from a maintainer. Findings are informational only.

Review Overview

This PR delivers a solid parity pass for the SSSC planner — the new JSON schema, signing script improvements, and four-prompt alignment are all well-structured additions. The inline comments flag a schema/documentation drift that would cause runtime validation failures if left unaddressed, and a gap in test coverage for the new BySessionPath parameter set.

Issue Alignment

No issue is linked (Related Issue(s): N/A). Not blocking in advisory mode, but linking an issue would help trace the RAI parity motivation for this work.

PR Template Compliance

✅ Description is thorough and accurate.
✅ Type of Change checkboxes correctly reflect the diff (instructions, prompts, agent, script/automation).
✅ Testing section is comprehensive.
✅ Required Automated Checks all marked.

Coding Standards

No violations found against the matched instruction files (powershell.instructions.md, pester.instructions.md, prompt-builder.instructions.md). Script structure, copyright headers, CmdletBinding, ErrorActionPreference, and comment-based help all comply.

Code Quality Findings

⚠️ HIGH — Schema/doc drift: wrong includeOptionalArtifacts field names in agent example

.github/agents/security/sssc-planner.agent.md lines 144–146 document adoptionPlaybook and executiveSummary inside includeOptionalArtifacts. The new sssc-state.schema.json defines this object with additionalProperties: false and requires sbom, scorecardProjection, and artifactSigning. An agent following the embedded example would produce a state.json that fails schema validation. See inline comment on line 146.

⚠️ HIGH — outputPreferences not a valid root state.json key (all four entry prompts)

All four entry-mode prompts instruct the agent to write outputPreferences to state.json. The schema has additionalProperties: false at the root with no outputPreferences property. Every state write following these prompts would fail validation. The correct target is userPreferences.targetSystem. See inline comments on each prompt file.

💡 MEDIUM — disclaimerShownAt and signingManifestPath absent from required

Both fields are always initialised at state creation but are not listed in required. A state file missing these keys still passes schema validation, which could silently surface undefined to agent logic that expects at least null. See inline comment on sssc-state.schema.json line 24.

💡 MEDIUM — BySessionPath parameter set has no test coverage

Sign-PlannerArtifacts.Tests.ps1 was updated to expect sessionPath in the manifest but no tests exercise the new BySessionPath invocation path, its absolute/relative path resolution, or sessionLabel derivation. See inline comment on line 215.

Action Items

1. Fix includeOptionalArtifacts example in sssc-planner.agent.md to use sbom, scorecardProjection, artifactSigning.
2. Replace outputPreferences instructions in all four prompts with userPreferences.targetSystem.
3. Consider adding disclaimerShownAt and signingManifestPath to the schema required array.
4. Consider adding BySessionPath test scenarios to Sign-PlannerArtifacts.Tests.ps1.

Generated by PR Review for issue #1497 · ● 3.7M

Advisory review, this PR is from a maintainer. Findings are informational only.

Review Summary

This run reviews the two new commits added since the previous automated reviews — the Format-MarkdownTables.ps1 wrapper script and the table-reformatting pass — and confirms the current state of all findings from prior runs.

The two HIGH schema-drift issues flagged in earlier reviews remain unresolved and are the most important items to address before merge, as they will cause state.json files written by the agent to fail schema validation at runtime.

Issue Alignment

Related Issue(s): N/A. No linked issue. Not blocking in advisory mode, but linking a tracking issue would help trace the motivation over time.

PR Template Compliance

✅ Description is thorough and accurate.
✅ Type of Change checkboxes match the diff.
✅ Testing section is comprehensive and all checks are marked.
✅ AI Artifact Contributions checklist is present; prompt-builder review items are left unchecked per author's choice.

Coding Standards

Format-MarkdownTables.ps1 (new file)

The script follows copyright headers, #Requires, CmdletBinding, and $ErrorActionPreference = 'Stop' conventions. Two minor deviations from powershell.instructions.md are noted in the inline comment (line 99): missing main execution guard and missing #region/#endregion markers. Low risk.

Code Quality — Persistent Schema Drift

⚠️ HIGH — outputPreferences key invalid in all four entry-mode prompts

sssc-capture.prompt.md (line 43), sssc-from-prd.prompt.md (line 52), sssc-from-brd.prompt.md (line 52), and sssc-from-security-plan.prompt.md (line 48) all instruct the agent to write outputPreferences into state.json. The schema defines "additionalProperties": false at the root with no such property. Every state write following these prompts produces an invalid document. Correct key: userPreferences.targetSystem.

⚠️ HIGH — includeOptionalArtifacts example in sssc-planner.agent.md uses wrong field names

Lines 144–146 use adoptionPlaybook and executiveSummary. The schema's includeOptionalArtifacts sub-object requires exactly sbom, scorecardProjection, and artifactSigning with "additionalProperties": false. The stale example will cause schema validation failure.

💡 MEDIUM — userPreferences.signingRequested should be top-level signingRequested

sssc-handoff.instructions.md line 105 references a non-existent nested path. signingRequested is a root-level field.

💡 MEDIUM — BySessionPath parameter set has no test coverage

Sign-PlannerArtifacts.Tests.ps1 verifies the sessionPath manifest field appears but no test exercises the BySessionPath code path, absolute/relative path resolution, or sessionLabel derivation.

💡 LOW — userPreferences example in sssc-identity.instructions.md is incomplete

Line 120 shows only autonomyTier; the schema requires all five userPreferences fields.

Action Items

Generated by PR Review for issue #1497 · ● 3.1M

Advisory review, this PR is from a maintainer. Findings are informational only.

Review Summary: feat/sssc-planner-rai-parity

This PR aligns the SSSC Planner with the RAI Planner feature-set parity: disclaimer gating, session signing, structured state schema, and consistent prompt structure. The overall shape of the change is sound and the implementation is detailed. Five advisory observations are noted below.

Issue Alignment

• No linked issue: The PR correctly states "Related Issue(s): N/A". No substantive misalignment concerns follow from this.

PR Template Compliance

• AI Artifact review checkboxes unchecked: The PR modifies .agent.md, .prompt.md, and .instructions.md files. The template's AI Artifact Contributions checklist ("Used /prompt-analyze to review contribution" and "Addressed all feedback from prompt-builder review") is unchecked. These are manual attestation items that require human action before merging.

Coding Standards

Format-MarkdownTables.ps1 — Missing invocation guard and region blocks

Per powershell.instructions.md, the main execution block must be wrapped in if ($MyInvocation.InvocationName -ne '.') and organized with #region/#endregion. The script currently puts all execution directly at module scope. See inline comment at line 42.

Test-Format-MarkdownTables.Tests.ps1 — Two observations

1. throw in BeforeAll (line 11): Throws abort the suite as an error rather than a skip, giving cryptic failures for contributors who haven't run npm install. See inline comment.
2. -Tag 'Unit' (line 151): The tests launch subprocesses, require node_modules, and mutate the filesystem—integration-test characteristics. The tag should reflect that. See inline comment.

Code Quality

Sign-PlannerArtifacts.Tests.ps1 — Missing coverage for BySessionPath

The new BySessionPath parameter set introduces path-resolution logic, manifest naming, and parameter-set mutual exclusivity—all untested. For a signing script that produces security attestation manifests, coverage gaps here are worth closing. See inline comment at line 215.

disclaimers.yml — Shared applies-to artifact names

Both rai-planner and sssc-planner disclaimers map to handoff-summary and compact-handoff-summary. Disambiguation relies on the validation tool cross-referencing tier scopes from footer-with-review.yml. If the lookup is artifact-name-only, both disclaimers apply simultaneously. Adding an explicit scope field to disclaimer entries would make the intent self-documenting. See inline comment at line 33.

What Looks Good

• pester-tests.yml correctly pins actions/setup-node to a full commit SHA with a version comment — fully compliant with workflow conventions.
• Sign-PlannerArtifacts.ps1 session-path computation handles absolute paths, trailing separators, and repo-root edge cases cleanly.
• sssc-state.schema.json uses additionalProperties: false consistently throughout and correctly models nullable fields (disclaimerShownAt, signingManifestPath) using ["string", "null"].
• The four SSSC prompt files have been restructured consistently with parallel startup/scope/phase-entry sections matching RAI parity.

Action items for the author:

1. Check the AI Artifact Contributions checklist items in the PR description.
2. Consider wrapping main execution in Format-MarkdownTables.ps1 with an invocation guard and region blocks.
3. Replace throw in Test-Format-MarkdownTables.Tests.ps1 BeforeAll with a skip-friendly guard.
4. Reconsider -Tag 'Unit' on the Format-MarkdownTables describe block given its integration-test dependencies.
5. Add BySessionPath parameter set tests to Sign-PlannerArtifacts.Tests.ps1.
6. Evaluate whether disclaimers.yml entries need a scope field for explicit disambiguation.

Generated by PR Review for issue #1497 · ● 5M

Reviewed for cross-agent consistency, packaging sync, schema accuracy, and prompt-builder repetition rules. Detailed inline comments above; high-level summary below.

Findings

Strengths

• Footer-with-review rename (human-facing-with-disclaimer → rai-handoff-with-disclaimer) is clean — zero stale references repo-wide, tests and config updated together.
• Sign-PlannerArtifacts.ps1 parameter sets (ByProjectSlug vs BySessionPath) are backward-compatible; the new sessionPath manifest field uses an OS-agnostic forward-slash relative path.
• pester-tests.yml correctly adds actions/setup-node + npm ci because the new Format-MarkdownTables.ps1 depends on node_modules. Action SHA pinning with version comment respected.
• SSSC standards rename (SLSA v1.0, NTIA SBOM minimum elements, Sigstore (cosign)) propagates consistently through frontmatter, three collection manifests, and three plugin READMEs.
• sssc-full-disclaimer wording correctly substitutes "OpenSSF Scorecard evaluators / SLSA auditors / supply chain security review boards" for the RAI legal/compliance equivalents.
• Tests cover the new SSSC handoff tier (pass + fail) and the sessionPath manifest field.

Advisory review — this PR is from a maintainer. Findings are informational only.

Overview

This PR brings the SSSC Planner to parity with the RAI Planner by adding disclaimer gating, a formal JSON Schema for state.json, BySessionPath signing support, footer-with-review classification, and restructured entry-mode prompts. The scope is well-described, testing evidence is thorough, and the implementation is consistent with existing RAI Planner patterns.

Issue Alignment

⚠️ No linked issue. The Related Issue(s) section is marked "N/A". For a change of this scope (46 files, cross-cutting agent/schema/script/test/collection changes), a tracking issue or epic would aid future auditability and release notes. This is informational only for a maintainer PR.

PR Template Compliance

⚠️ The AI Artifact Contributions checklist items — "Used /prompt-analyze to review contribution" and "Addressed all feedback from prompt-builder review" — are both unchecked. The PR description doesn't explain why these were skipped. Per the template, contributions checking AI artifact boxes should complete this workflow.

Coding Standards

✅ PowerShell follows powershell.instructions.md conventions (copyright header, #Requires -Version 7.0, CmdletBinding, [OutputType], comment-based help).

✅ JSON Schema uses draft 2020-12 and is structurally correct. The additionalProperties: false on the root object and on $defs entries prevents schema drift.

✅ Prompt frontmatter uses description, agent fields correctly and the ${input:project-slug} variable syntax is consistent.

Code Quality

Three advisory observations are posted as inline comments:

1. disclaimerShownAt absent from schema required (sssc-state.schema.json:23) — signingRequested is required but disclaimerShownAt is not, creating an asymmetry. Legacy sessions without the key may behave differently from sessions with null, depending on LLM key-missing interpretation.

2. git ls-files --others includes untracked files (Format-MarkdownTables.ps1:44) — undocumented behaviour; CI -Check mode could flag drift on uncommitted drafts.

3. BySessionPath parameter set lacks dedicated tests (Sign-PlannerArtifacts.Tests.ps1:215) — relative path resolution, absolute path branching, and custom ManifestName are not exercised.

Action Items

None are blocking for a maintainer PR. If you'd like to address any of the inline observations:

• Add disclaimerShownAt to the schema required array (or explicitly document the absent-vs-null equivalence in the schema description).
• Drop --others in CI or document the untracked-file scope in .DESCRIPTION.
• Add a BySessionPath test block to Sign-PlannerArtifacts.Tests.ps1.

Generated by PR Review for issue #1497 · ● 2.6M

Read through the PR. Solid parity work overall — the Sign-PlannerArtifacts parameter-set split with the new sessionPath test coverage is clean, the footer-with-review tier rename (human-facing-with-disclaimer → rai-handoff-with-disclaimer plus the new sssc-handoff-with-disclaimer) is a clear taxonomy improvement, and the disclaimer protocol is now consistent across agent, identity and all four entry prompts.

A few things should be addressed before merge — inline comments cover the concrete defects:

• Schema parity gap on sssc-state.schema.json (open root vs RAI's strict root; missing phaseGates).
• Two duplications in sssc-identity.instructions.md (H2 section, and a duplicate JSON key in the state example).
• Redundant Activate the SSSC Planner sentence in the three from-* prompts.
• agent: frontmatter inconsistency between the SSSC prompts and the rest of .github/prompts/security/.
• Naming clarity on Sign-PlannerArtifacts manifest projectSlug under -SessionPath.

Meta — PR scope: the title says SSSC parity + signing + validation, but the diff also bundles:

• three new gh-code-scanning workflows + Get-CodeScanningAlerts.ps1 deletion + skill migration,
• a new scripts/linting/Format-MarkdownTables.ps1 (+131) and a 322-line Pester test for it,
• the mass markdown-table reflow across eight OWASP indexes, secure-by-design, jql-reference and pr-reference references (presumably produced by that new formatter),
• .cspell.json, README touches, pull-request.instructions.md edits.

That is roughly a third of the 56 files and not in scope. Would prefer three separate PRs:

1. Keep here: SSSC parity (agent, identity, schema, prompts, signing, footer, coaching-patterns).
2. New PR: gh-code-scanning workflows + script-to-skill migration.
3. New PR: Format-MarkdownTables.ps1 followed by the reflow it produced (ideally tool first, reflow second, so the history is bisectable).

If a split is not feasible at this point, at minimum carve out the workflows — they are operationally the riskiest piece and want their own review by the workflows owner.

Two lower-severity notes I did not file inline:

• userPreferences.* are all required in the schema, so the agent must write the full block (with documented defaults) at state creation. The agent file documents this, just confirm the init path never writes a partial block.
• coaching-patterns.instructions.md applyTo targets .copilot-tracking/{rai,security,sssc}-plans/** — matches the existing convention used by disclaimer-language.instructions.md, so consistent with the project. Worth revisiting in a future docs cleanup whether something like appliesToAgents: would model the intent more directly, but no change for this PR.

Nothing blocking from my side once the schema gap, the two duplications and the scope conversation are settled. Thanks for the work.

Thanks for the quick turnaround on the previous round — the schema parity (phaseGates in both states, additionalProperties: false, clean hardGate/summaryGate $defs), the duplicate disclaimer cleanup, the merged Activate sentences, and the new .NOTES block documenting projectSlug under -SessionPath all landed exactly as discussed. Really nice work.

One small nit left on the agent: frontmatter convention (see inline) — non-blocking, can absolutely be a follow-up. Approving. 🚀

Looks good overall. Found a couple of high/medium issues that might need to be addressed.