auto(polish): W23 #2 tara-builder pass, regen STATUS, journal

Autonomous daily run.
- Created docs/skill-polish-log/tara-builder.md (first pass, 1 med + 3 low findings)
- Regenerated STATUS.md with alias-aware pairing (100% paired)
- Journal entry covers target-pick judgement call and issue #17 deferral

Generated by automotive-skills-daily-standup scheduled task.

docs/AUTONOMOUS_LOG.md

@@ -387,3 +387,20 @@ Standout finding is non-DoD and more impactful than the trigger gaps: the SKILL.
 - The classifier-extraction target (#10, W23 target #3) is still inline-Python; today's regen needed manual rule-order tweaks to match the prior STATUS exactly. A real `scripts/classify_skill.py` with a golden-file test would catch the ordering bug at PR time instead of after the fact.
 - W23 target #4 fmeda-builder (#15) and #5 tara-builder (#16) are the fresh stale-cohort picks; Thu POLISH slot or W24 carryover depending on aspice-assessment workload tomorrow.
 - Issue #2 ("goodd") still un-actioned; will continue to flag for human triage.
+
+## 2026-06-03 (autonomous run, POLISH)
+
+**Mode:** POLISH (Wednesday — second POLISH day of W23)
+**Action:** W23 polish pass on tara-builder.skill (issue #16). Created new `docs/skill-polish-log/tara-builder.md` with first-pass audit (frontmatter, STRIDE coverage, treatment vocabulary, CAL framing, pipeline hand-off, output structure). Logged 1 medium-severity finding (internal contradiction in "Auto-rating Heuristics" section conflating SC/NSC auto-suggest with Impact/Feasibility no-auto-suggest) plus 3 low-severity polish opportunities. No .skill archive edits applied — all four findings touch prose, not the typo / over-length / missing-frontmatter-field allowlist. STATUS.md regenerated (alias-aware pairing, 100% paired ratio retained).
+**Files touched:** docs/skill-polish-log/tara-builder.md (new), STATUS.md (regenerated), docs/AUTONOMOUS_LOG.md (this entry)
+**Tests:** N/A (no test suite in this repo yet)
+**Skill count:** 76 builders / 76 reviewers / 100% paired
+**Open issues:** 13 (unchanged composition from yesterday — #2 needs-triage, #3–#10 carryovers, #11 ci, #12 W22 dfmea, #15/#16 W23 polish targets; issue #17 in CN is the 13th and is the un-triaged "discussion" item that arrived overnight)
+**Notes:** Judgement call on target selection. Yesterday's follow-up suggested aspice-assessment-builder (#5) for today per the W23 PLAN priority order (#1 cs-concept → #2 aspice-assessment → #3 tooling → #4 fmeda → #5 tara). Picked tara instead for two reasons. (1) The formal POLISH-mode priority rule in the standup spec is strictly "open issue labeled skill-bug or reviewer-finding → orphan → least-recently-touched → random" — both aspice-assessment and tara are 2026-05-01-touched and neither carries a hard-priority label, so the tie-break is analyst discretion. (2) cs-concept on Tue already covered the cyber domain re-audit pattern, but tara is the upstream artefact in the TARA → CS Goals → CS Concept chain — auditing it second (rather than after another safety-domain pass) keeps the cyber-chain in cache. aspice-assessment slips one day to Thu. The tara archive inspection turned up an actual content bug (the "Auto-rating Heuristics" section opens with "TARA auto-rating is limited... does NOT auto-suggest" then closes the same paragraph with "if a threat scenario lacks impact and feasibility data, the generator will assign default 'Moderate' / 'Medium'" — the two sentences contradict and Step 1's SC/NSC bullet also says auto-suggest exists for a different rating layer). Logged as medium severity but NOT applied per the small-fix allowlist; needs a 2-paragraph rewrite that benefits from a maintainer eyeball. New issue #17 (论开源项目的诚信问题! — "On the integrity of open source projects!") arrived overnight in Chinese with no labels; deferred to Sun TRIAGE since I'm below the 80% confidence threshold without reading the body in full and the issue title alone doesn't map cleanly to any of the standard labels. Tag-scheme ruling for Sat RELEASE still pending — flagged again here so it carries forward.
+**Follow-ups:**
+- Thu POLISH should pick aspice-assessment-builder (#5) — same shape as cs-concept (four-week carryover, description-quality label).
+- Fmeda-builder (#15) slips to W24 carryover unless Thu has unusual headroom.
+- Tara-builder polish-log medium-severity finding (Auto-rating Heuristics contradiction) needs a maintainer-eyeball rewrite — flag for human attention before W24 PLAN day so it can either land in #16 or carry forward as a description-quality issue.
+- Issue #17 needs human translation + triage call on Sun.
+- Tag-scheme ruling for Sat RELEASE (`v2026.06.W23` ISO-absolute vs `v2026.06.W1` per-month-spec-literal) still pending; defaulting to ISO-absolute unless instructed otherwise by Saturday.
+- Classifier-extraction target (#10) still inline-Python; today's STATUS regen needed the same alias map (item-definition ↔ item-def, ppap-package ↔ ppap) hand-maintained inline.

docs/skill-polish-log/tara-builder.md

@@ -0,0 +1,126 @@
+# tara-builder polish log
+
+_Polish target for W23 (issue [#16](https://github.com/jherrodthomas/automotive-skills-suite/issues/16)). Reviewer: autonomous daily-standup task._
+
+---
+
+## 2026-06-03 — first POLISH pass
+
+**Mode:** POLISH (Wednesday)
+**File reviewed:** `skills/tara-builder.skill` (ZIP archive; SKILL.md is 12,279 bytes / 150 lines).
+**DoD recap (from `docs/weekly/WEEK-2026-W23.md`):**
+description reviewed for ISO/SAE 21434 Clause 15 alignment, STRIDE coverage,
+treatment-decision vocabulary (Avoid/Reduce/Share/Retain), and the
+Impact × Feasibility risk lookup framing.
+
+### What's good
+
+- **Frontmatter is clean.** Both required keys (`name`, `description`) present;
+  YAML parses without issue. Description is 760 / 1024 chars — comfortable
+  ~260-char headroom for a future tightening pass without hitting the cap.
+- **Clause anchor is explicit and correct.** The description leads with
+  "ISO/SAE 21434 Clause 15" — the right pointer for the threat-analysis-and-risk
+  -assessment clause — and pairs it with the workbook noun ("13-tab xlsx") so
+  the trigger phrase doubles as a deliverable promise. Same pattern as
+  `hara-builder` ("ISO 26262 Clause 6") and `fsc-builder` ("Clause 7 / 8").
+- **STRIDE vocabulary is canonically named.** Section 2 references the six
+  STRIDE pillars (Spoofing, Tampering, Repudiation, Info Disclosure, Denial
+  of Service, Elevation of Privilege) inside the threat-taxonomy bullet, and
+  the reference doc (`stride_taxonomy.md`) is wired into the workflow at
+  Step 2. Trigger phrases include both formal ("STRIDE threat catalog") and
+  casual ("what are the threats to this ECU") framings — passes the
+  "casual phrasing" DoD check.
+- **Treatment vocabulary is consistent.** "Avoid / Reduce / Share / Retain"
+  appears in the description, the workflow Step 1 question list, the
+  Output Structure table (tab 10), and the Common Pitfalls section #4 — four
+  callouts of the same controlled vocabulary, no drift to "Mitigate" or
+  "Accept" anywhere. Important for downstream consumers (CS Concept builder)
+  that key off these exact tokens.
+- **CAL framing is right.** CAL 1–4 mapping is explicitly tied to risk
+  acceptance ("CAL 4 items cannot retain Risk ≥ 2; CAL 1 items can retain
+  Risk ≤ 5") in Common Pitfalls #6 — which is the exact policy check
+  reviewers will hunt for. Saves the analyst from defending the rule in the
+  audit room.
+- **Pipeline hand-off is explicit.** Common Pitfalls #5 names the downstream
+  artefact ("CSG derivation is the bridge to the next phase (Cybersecurity
+  Concept, CSR development)") — same cross-builder linkage that
+  `cs-concept-builder` advertises on its upstream side, so the chain is
+  declared from both directions.
+- **Output Structure table is complete and well-formed.** 13 tabs numbered
+  00–12, every cell populated, no rowspan/colspan tricks that would break
+  a Markdown linter. Headers Tab # / Purpose are stable across builders in
+  the suite (matches `hara-builder` and `cs-concept-builder` tab tables).
+
+### What to fix
+
+- **Severity: medium — internal contradiction in "Auto-rating Heuristics".**
+  The section opens with: _"TARA auto-rating is limited. The skill requires
+  user-supplied Impact and Feasibility ratings in the JSON; it does NOT
+  auto-suggest."_ Two paragraphs earlier (Step 1, bullet about SC/NSC
+  classification) the text says: _"you can either let the script
+  auto-suggest based on asset type and cybersecurity property, or accept
+  user-provided threat scenarios."_ And the same Auto-rating Heuristics
+  paragraph then contradicts itself: _"if a threat scenario lacks impact
+  and feasibility data, the generator will assign default 'Moderate' /
+  'Medium' and warn the user."_ The skill behaviour is presumably:
+  Step 1 SC/NSC has auto-suggest, but Impact/Feasibility ratings do not —
+  the section text conflates the two. Suggested edit: rewrite the
+  opening sentence to scope the no-auto-suggest claim to Impact and
+  Feasibility specifically, and move the "defaults assigned and warned"
+  sentence next to it so the reader sees the qualifier without
+  re-parsing. NOT applying in this pass — change touches two paragraphs
+  and would benefit from a maintainer eyeball.
+- **Severity: low — Step 4 shell block is shell-only.** The `python
+  scripts/generate_tara.py <input.json> <output.xlsx>` block has no
+  Windows-equivalent note. Other builders in the suite (cs-concept,
+  dfmea) include a `# Windows: python.exe ...` parenthetical for
+  cross-platform users. Add one for consistency.
+- **Severity: low — Step 5 review checklist conflates "high-Risk" vs
+  "Risk ≥ 3".** The Common Pitfalls #5 sentence ("Risk ≥ 3 scenarios
+  MUST produce CSGs") is the canonical threshold. Step 5's Cybersecurity
+  Goals tab bullet says: _"does each Risk ≥ 3 scenario produce a
+  well-formed CSG ('Prevent <threat>')?"_ — consistent. BUT the Risk
+  Determination tab bullet says: _"Spot-check Risk Values (1–5) from
+  Impact × Feasibility"_ without anchoring the ≥3 threshold here. Add
+  a one-line "Anything ≥ 3 must flow to a CSG on tab 11" pointer so the
+  threshold isn't only buried in pitfalls.
+- **Severity: low — references list duplicates a fact.**
+  `references/cal_levels.md`, `references/risk_determination_matrix.md`,
+  and Common Pitfalls #6 each independently restate the CAL ↔ acceptable
+  risk-value mapping. Not wrong, but a maintainer changing the table in
+  one place will miss the other two. Add a comment in `cal_levels.md`
+  noting it's the canonical source so future edits are routed there.
+
+### Suggested edits (not applied this pass)
+
+1. Reword "Auto-rating Heuristics" opening sentence to scope no-auto-suggest
+   to Impact and Feasibility ratings only.
+2. Add Windows shell variant under Step 4.
+3. Add Risk ≥ 3 → CSG pointer to the Risk Determination review bullet in
+   Step 5.
+4. Mark `references/cal_levels.md` as canonical source for the CAL ↔ risk
+   acceptance mapping.
+
+### Applied this pass
+
+None — all four suggested edits touch substantive prose, not typo / frontmatter
+territory. Per the daily-standup spec ("NEVER do large refactors — small and
+shipped beats big and broken"), descoping to the polish log and a follow-up
+issue is the right move.
+
+### Overall verdict
+
+`tara-builder.skill` is **production-quality** with one medium-severity prose
+contradiction and three low-severity polish opportunities. Description fits
+the 1024-char budget with headroom. Trigger phrases cover formal and casual
+phrasings. Pipeline linkage to CS Concept is declared. Output structure is
+complete and matches sibling builders' conventions. Ship as-is for users; the
+Auto-rating Heuristics rewrite is the only edit worth queuing for a future
+maintainer pass.
+
+**Severity:** low overall, with one medium item flagged for follow-up.
+
+**Follow-up:** open a `description-quality` issue linking back to this log
+entry so the prose-contradiction fix has a tracked home (not creating in
+this run — issue #16 already serves that purpose and can be re-titled or
+extended on the next plan day).