Overall, looks good. I have one question which might be relevant to security, but I'm not sure.

Sections 5.2.1.1, 5.2.2.2, and 5.2.3.1 say "The BGP-LS-SPF Node NLRI Attribute SPF Status TLV, Link NLRI Attribute SPF Status TLV, and Prefix NLRI Attribute SPF Status TLV use the same TLV Type (1184). This implies that a BGP Update will include a single NLRI." Is it possible to have multiple NLRI of different types in the same update? Maybe it's worth adding a MUST NOT about that, and adding something to section 7 about how to handle that case?