[Schema Consistency] Schema Consistency Check — 2026-06-11

[github-actions[bot]]

Summary

• Inconsistencies found: 1 low-priority (naming convention)
• Previously-standing findings resolved this run: 2 (one of them a security-relevant documentation gap)
• Categories analyzed: Schema ↔ Parser ↔ Documentation ↔ Workflows
• Strategy mode: Proven strategies (day-of-year mod 10 = 2)
• Overall health: ✅ Schema / parser / documentation consistency is currently very healthy

This run focused on re-verifying the established standing findings from the strategy cache and probing two fresh leads (a deprecation flag and an enum-vs-docs comparison). The headline result is positive: the two strongest open findings have been fixed upstream since the last run, and both fresh leads turned out to be fully consistent.

Critical Issues

None. No correctness-affecting schema/parser mismatches were found.

Resolved Since Last Run ✅

These were long-standing findings in the strategy cache and are now cleared:

1. roles: exact-match behavior is now documented (was a security-relevant gap)

   • The permission check at actions/setup/js/check_permissions_utils.cjs:254 uses exact equality (normalizedRequired === effectiveRole) with no privilege hierarchy — so roles: [write] rejects admin and maintainer actors.
   • This non-obvious behavior is now explicitly documented in docs/src/content/docs/reference/compilation-process.md:217 and frontmatter-full.md:953-954 ("matching is exact, not a minimum threshold. List every role you want to accept.").
   • Note for future audits: the file moved from pkg/workflow/js/ → actions/setup/js/.

2. IgnoredFrontmatterFields undocumented entry cleared

   • Previously user-invokable lived in IgnoredFrontmatterFields but was documented nowhere. The slice is now empty (pkg/constants/constants.go:321: var IgnoredFrontmatterFields = []string{}), so the finding no longer applies.

Verified-consistent checks (no action needed)

• create-agent-task deprecation is fully consistent: the property carries deprecated: true + x-deprecation-message inside its oneOf branch (main_workflow_schema.json:5104-5105), the compiler emits a runtime warning (pkg/workflow/create_agent_session.go:52), and it is wired as an alias of create-agent-session (pkg/workflow/safe_output_handlers.go:36).
  • Audit tip recorded in cache: deprecated: true frequently lives inside a oneOf/anyOf sub-schema rather than the property root — traversal scripts must descend into branches before flagging a property as "missing deprecation".
• experiments.*.analysis_type enum vs docs: schema enum [t_test, mann_whitney, proportion_test, bayesian_ab] matches the documentation table exactly (experiments-specification.md:657-660).
• analysis_type decorative-enum concern downgraded: the bundled analyzer stores and prints the value but never branches on it (the only switch at pkg/cli/experiments_analyze_statistics.go:345 is on Recommendation). However, the spec explicitly documents this — experiments-specification.md:1184 states analysis_type is "advisory only" and R-STAT-003 uses normative SHOULD. So this is documented behavior, not a gap.

Documentation Gaps

None newly found.

Schema Improvements Needed

Low priority — naming-convention inconsistency in dispatch-workflow safe-output

The dispatch-workflow safe-output (kebab-case, main_workflow_schema.json:9013) uses snake_case for its child properties, unlike every sibling safe-output which uses kebab-case:

• dispatch_repository (main_workflow_schema.json:9095)
• allowed_repositories (main_workflow_schema.json:9121)
• event_type

This is internally consistent (the Go handler yaml tags and the docs both use snake_case), so it is not a functional bug — but it diverges from the kebab-case convention used across the rest of the safe-outputs surface. Aligning it would require an alias to preserve backward compatibility, so this is genuinely low priority.

Parser Updates Required

None.

Workflow Violations

None. No workflow files use fields absent from the schema (the in_used_not_schema gaps in the pre-computed diff are all nested keys or expression fragments, not top-level frontmatter keys).

Recommendations

1. Optional, low priority: Consider adding kebab-case aliases (dispatch-repository, allowed-repositories, event-type) for the dispatch-workflow child keys to match the convention used by sibling safe-outputs, while keeping the snake_case forms for backward compatibility.
2. No urgent action otherwise — the schema, parser, and documentation are well aligned this cycle.

Strategy Performance

• Strategies used: S23 (enum/API reachability), S17 (IgnoredFrontmatterFields audit), S20 (enum behavioral completeness), S19 (safe-output naming), S8/S10 (deprecation enforcement & flag), S22 (enum vs docs drift)
• Findings: 1 standing (S19), 2 resolved (S17, S23), 1 downgraded (S20)
• Effectiveness: HIGH — proven-strategy re-verification confirmed real upstream fixes and pruned stale findings
• Should reuse: YES — these re-verification strategies efficiently track the resolution of known issues

Next Steps

• (Optional) Add kebab-case aliases for dispatch-workflow child keys
• Confirm roles: exact-match documentation — already present
• Confirm IgnoredFrontmatterFields cleanup — already empty
• Confirm create-agent-task deprecation wiring — fully consistent

References: §27329587938

Generated by ✅ Schema Consistency Checker · 130.3 AIC · ⌖ 25.6 AIC · ⊞ 9.5K · ◷

• expires on Jun 11, 2026, 11:04 PM UTC-08:00

[github-actions[bot]]

Smoke bot grunt. Run 27329723424 stomp here. Fire still warm.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• safebrowsingohttpgateway.googleapis.com
• www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 141.4 AIC · ⌖ 16.5 AIC · ◷

[github-actions[bot]]

Smoke ping: discussion comment path works. ✅

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• safebrowsingohttpgateway.googleapis.com
• www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 263.8 AIC · ⌖ 22.4 AIC · ◷

[github-actions[bot]]

This discussion has been marked as outdated by Schema Consistency Checker.

A newer discussion is available at Discussion #38798.