[integrity] DIFC Integrity-Filtered Events Report — 2026-04-11

[github-actions[bot]]

Executive Summary

In the last 7 days, 36 DIFC integrity-filtered events were detected across 25 workflow runs. All 36 events involved the same pattern: the pull_request_read tool on the GitHub MCP server was blocked because the PR being read had an integrity label below the approved threshold. The dominant workflow triggering these events was Design Decision Gate 🏗️ (31 events, 86%), with Smoke Claude accounting for the remaining 5 (14%).

The volume is rising: 12 events on Apr 10 vs. 24 on Apr 11, a 2× increase in a single day. This spike is concentrated in the Apr 11 13:00 UTC hour (7 events) and correlates with a burst of Design Decision Gate runs triggered by PR activity. Since all events share an identical filter pattern (pull_request_read → integrity → min-level approved), this is a systematic and expected behavior of the integrity guard, not a misconfiguration. However, the increasing rate warrants monitoring.

Key Metrics

Metric	Value
Total filtered events	36
Unique tools filtered	1 (pull_request_read)
Unique workflows affected	2 (Design Decision Gate 🏗️, Smoke Claude)
Most common filter reason	integrity (100%)
Required integrity level	approved
Most active user	pelikhan (36 events, 100%)
Busiest day	2026-04-11 (24 events)
Busiest hour	2026-04-11T13:00 UTC (7 events)

📈 Events Over Time

Events doubled from Apr 10 (12) to Apr 11 (24). The pattern is intraday bursts — multiple Design Decision Gate runs firing in close succession when several PRs are opened together. There is no multi-day trend yet (only 2 days of data), but the acceleration on Apr 11 suggests sustained PR activity. No anomalous spikes from unexpected sources were detected.

🔧 Top Filtered Tools

Every single filtered event (36/36) involves pull_request_read. This is the GitHub MCP tool used by Design Decision Gate and Smoke Claude to read the body of the PR being reviewed. The filtering occurs because the PR content (authored by an external contributor or Copilot agent) has not yet been elevated to approved integrity. This is the DIFC integrity guard working exactly as designed — preventing untrusted PR content from flowing into the agent's reasoning.

🏷️ Filter Reasons and Tags

All 36 events are integrity-reason filters; zero secrecy filters. The only integrity tag in play is approved — meaning the min-integrity threshold for the github MCP server is set to approved, and the filtered resources all fall below that level. No secrecy leakage patterns were detected.

📋 Per-Workflow Breakdown

Workflow	Filtered Events
Design Decision Gate 🏗️	31
Smoke Claude	5

📋 Per-Server Breakdown

MCP Server	Filtered Events
github	36

👤 Per-User Breakdown

Author Login	Filtered Events
pelikhan	36

🔍 Per-User Analysis

All 36 events are attributed to pelikhan, the repository owner and primary contributor. This is fully expected: pelikhan is the actor who opens PRs, which in turn trigger the Design Decision Gate and Smoke Claude workflows. The DIFC system is correctly identifying that the PR content (from external contributors such as Copilot agents or community PRs) has not been promoted to approved integrity. No bot accounts or unexpected external actors are contributing to filtered events. No investigation is warranted.

💡 Tuning Recommendations

1. No misconfiguration detected — the integrity filter on pull_request_read is operating as designed. The Design Decision Gate correctly gates on PR integrity before consuming PR body content.

2. Consider a PR integrity promotion step — if Design Decision Gate is intended to review Copilot-generated PRs, add a pre-agent step that elevates the PR's integrity to approved once it has passed automated checks (CI green, no security flags). This would allow the agent to read and act on the PR content rather than seeing filtered placeholders.

3. Investigate Smoke Claude filtered reads — 5 events from Smoke Claude suggest its smoke-test PRs are also hitting the integrity guard. If Smoke Claude is reading its own PRs (which it creates), the PR content should be trusted and the integrity level promoted automatically after creation.

4. Monitor the Apr 11 burst — the 7-event spike at 13:00 UTC on Apr 11 corresponds to a cluster of Design Decision Gate runs. If PR merges are batched, consider rate-limiting the workflow trigger or using concurrency: groups to serialize runs, reducing parallel integrity-filtered attempts.

5. No secrecy issues — zero secrecy-filtered events. The information flow control for confidential data is clean. No action required on the secrecy axis.

References:

• §24285718804 — Highest-filtered individual run (Design Decision Gate)
• §24283822583 — Design Decision Gate (2 filtered events)
• §24271839277 — Smoke Claude (2 filtered events)

Generated by Daily DIFC Integrity-Filtered Events Analyzer · ● 4.2M · ◷

• expires on Apr 14, 2026, 8:55 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Daily DIFC Integrity-Filtered Events Analyzer.

A newer discussion is available at Discussion #26086.