Spec tooling registry is a local copy that may diverge

[ahouseholder]

Summary

metadata/specs/schema.py and metadata/specs/registry.py both carry inline TODOs about extracting the spec-registry subsystem into a shared package. Until that extraction happens, SSVC owns a local implementation that is likely to diverge from sibling projects.

Category

• Top risk
• Technical debt
• Security
• Performance / scaling
• Fragile / high-churn area
• Other

Severity

medium

Evidence

• metadata/specs/schema.py
• metadata/specs/registry.py

Impact if Ignored

Bug fixes or improvements made in sibling projects' spec tooling will not flow back to SSVC. Over time the implementations diverge and a future extraction becomes more costly.

Suggested Action

Extract the spec-registry subsystem into a shared package (as indicated by the existing TODOs). Until extraction is feasible, at minimum document the known divergence and track it explicitly.