[Schema Consistency] 🔍 Schema Consistency Check - 2026-10-17

[github-actions[bot]]

Overview

Found 3 actionable inconsistencies across schema, compiler and reference documentation. Reviewed project workflow frontmatter as well: 337 statically checkable workflows passed the main schema; 123 templates, fragments or redirects were excluded. This is a static analysis, not a full compilation or runtime test.

Key findings

1. Schema rejects documented, implemented sandbox.mcp.trusted-bots (medium). The frontmatter example in docs/src/content/docs/reference/mcp-gateway.md:405 fails Draft 7 validation against the main schema. The compiler explicitly extracts both trustedBots and trusted-bots at pkg/workflow/frontmatter_extraction_security.go:621, stores the value at pkg/workflow/tools_types.go:588, and forwards it at pkg/workflow/mcp_gateway_config.go:243. Neither spelling is declared in the main schema. Add the supported public spelling to the MCP sandbox schema with array/string constraints matching the documented contract; add a schema-level regression case. This is an authoring/schema blocker, not evidence of a runtime security bypass.

2. Documentation promises unsupported tools.github.refusal-labels behavior (medium). docs/src/content/docs/reference/mcp-gateway.md:1584 describes label-based downgrades to integrity none; examples at lines 1592 and 1603 fail schema validation. The main schema declares approval labels at pkg/parser/schemas/main_workflow_schema.json:4976 but no refusal-labels property. Repository searches found no refusal-labels compiler extraction or configuration field; the existing guard fields are defined in pkg/workflow/tools_types.go:435–446. Authors cannot configure the documented behavior through these examples. Mark the feature as unavailable in workflow frontmatter or implement schema, extraction, propagation and tests together. Do not imply that the documented label suppression is currently active.

3. OIDC MCP frontmatter example uses the wrong parent key (low). docs/src/content/docs/reference/mcp-gateway.md:1307 nests mcp-servers under tools. The schema rejects it with an additional-property error. ValidateToolsSection at pkg/workflow/mcp_config_validation.go:123–134 accepts only built-in tool names and explicitly directs custom servers to top-level mcp-servers. Move the entire mcp-servers block to the root in this example and validate the corrected example. This finding concerns the nesting; it does not claim that every nested OIDC option was independently verified.

Analysis evidence, exclusions and strategy performance

Started from the precomputed schema diff and cached strategies. Day 290 modulo 10 is 0, selecting the proven strategy Schema-def spot checks + targeted parser/doc/workflow verification. Both high-signal top-level gaps were ruled out: docker-image-pull-policy is consumed by pkg/workflow/docker.go:294, and work-queue-policy is consumed by pkg/workflow/work_queue_policy.go:184. Missing typed-frontmatter members alone are not parser defects.

Validated YAML reference snippets against the local Draft 7 main schema while preserving YAML on keys. Triangulated reported failures against compiler consumers and validation branches. Kubernetes runner-pod env examples were excluded because they are not workflow frontmatter. No workflow code was executed and no source files were changed.

Workflow checks included root workflows and shared markdown recursively, with incomplete/template/redirect inputs excluded. Passing these checks does not establish import resolution, compiler success or semantic correctness.

AWF warning — non-authoritative: /tmp/gh-aw/agent/awf-config-drift.json reports degraded: true: canonical source retrieval failed. No AWF drift conclusion is made, and no corrective PR, drift issue or required-check failure is proposed from that comparison.

Strategy performance: 3 findings; high effectiveness; reuse recommended; no new strategy introduced. Updated the existing strategy cache with this run and finding count.

Next actions

• Add schema coverage for the implemented trusted-bots frontmatter option.
• Reconcile the refusal-labels documentation with supported workflow capabilities.
• Correct the MCP example nesting and validate reference examples in documentation checks.

No source changes or corrective pull request were made by this analysis.

References: §39006419774

Generated by ✅ Schema Consistency Checker · codex · gpt61 · 15.6 AIC · ⌖ 6.86 AIC · ⊞ 19.5K · ◷

• expires on Oct 17, 2026, 9:34 PM UTC-08:00