[Schema Consistency] 🔍 Schema Consistency Check - 2026-10-23

[github-actions[bot]]

Overview

Found 3 new actionable inconsistencies across schema, compiler, and documentation. Reviewed workflow usage as well. Used the cached Schema-def spot checks + targeted parser/doc/workflow verification strategy; day 296 modulo 10 = 6 selects a proven strategy. No source files changed.

Key issues

1. High: documented refusal-labels configuration is unsupported. docs/src/content/docs/reference/mcp-gateway.md:1617 describes a label-based integrity downgrade and gives examples at lines 1625 and 1636. Local Draft7 validation rejects tools.github.refusal-labels as an additional property. The GitHub tool schema closes properties at pkg/parser/schemas/main_workflow_schema.json:5244; compiler guard configuration at pkg/workflow/tools_types.go:427–448 and parsing at pkg/workflow/tools_parser.go:345 support blocked users, trusted users, and approval labels, but no refusal-labels consumer exists in workflow production Go files. Impact: the advertised configuration cannot compile; users cannot configure the promised exclusion through this field. This is a configuration/documentation gap, not evidence of a runtime bypass. Action: mark the feature unavailable or remove the example until schema acceptance, compiler forwarding, and runtime semantics ship together.

2. Medium: FAQ MCP server example uses an invalid location and field. docs/src/content/docs/reference/faq.md:209 nests mcp-servers under tools and uses image. Validation rejects the nested key. The supported top-level mcp-servers schema is at pkg/parser/schemas/main_workflow_schema.json:4909; extraction reads that top-level section at pkg/workflow/frontmatter_extraction_metadata.go:343. The MCP guide shows top-level servers with container at docs/src/content/docs/guides/mcps.md:83. Impact: copying the FAQ snippet fails validation. Action: replace it with a complete validated top-level server example using container and the required transport fields.

3. Medium: reusable-worker example advertises unsupported choice inputs. docs/src/content/docs/reference/safe-outputs.md:1507 declares on.workflow_call.inputs.environment.type: choice and options; the following prose lists choice as supported. The schema at pkg/parser/schemas/main_workflow_schema.json:2248 permits only string, number, and boolean; its closed input object also rejects options. Impact: the documented worker fails frontmatter validation. Action: use type string, remove options, and document any application-level value checking separately. Review pkg/workflow/call_workflow_compilation_test.go:201, which also contains a choice declaration, so helper-level coverage does not imply the worker passes schema validation.

Analysis evidence, scope, and limitations

Method and coverage

• Started from the supplied precomputed schema diff. Both apparent schema-to-struct gaps were false positives: docker-image-pull-policy is read from RawFrontmatter in pkg/workflow/docker.go:294, and work-queue-policy in pkg/workflow/work_queue_policy.go:184.
• Validated YAML examples in reference documentation with the local Draft7 schema, preserving the YAML on key and boolean values. Checked nested validation failures separately from missing on in partial snippets. Traced the three findings to compiler structures or extraction code.
• Parsed 461 workflow/shared frontmatter mappings: zero unknown top-level keys, consistent with the precomputed used-field diff. Standalone validation produced 125 error records, including missing on in import fragments; these are not 125 confirmed violations. Import resolution and full compilation were outside this static screen. No confirmed workflow violation is reported.
• Excluded previously cached findings, including tools.qmd, slash-command placeholder, allowed-repos current, close-issue allow-body, update-release token, and update-project examples.
• Executed no workflow code and performed no runtime security tests. No confirmed critical runtime defect was established.

AWF canonical-source warning — non-authoritative

The supplied /tmp/gh-aw/agent/awf-config-drift.json has degraded=true: canonical-source retrieval failed. AWF config-source drift is therefore unassessed. This warning is not a drift finding; no corrective PR, drift issue, or required-check failure is requested from this comparison.

Schema and parser follow-up

• For refusal-labels, align the documented contract with schema and compiler support before advertising availability. Do not add schema acceptance alone.
• Keep workflow_call input types constrained to the supported reusable-workflow types and correct the example.
• Add targeted documentation-example validation for these three examples, including the worker file itself rather than only its caller.

Strategy performance

• Strategy: cached targeted parser/doc/workflow verification; new strategy: no.
• Findings: 3; effectiveness: high; reuse: yes.
• Updated the existing strategy entry with this run and the three findings.

Next actions

• Correct the refusal-labels availability claim or implement the complete contract.
• Replace the FAQ MCP example with valid frontmatter.
• Correct choice/options in reusable-worker documentation and inspect related test fixtures.
• Validate the corrected documentation snippets through frontmatter validation.

References: §39906205804

Generated by ✅ Schema Consistency Checker · codex · gpt61 · ~15 AIC · ⌖ ~7 AIC · ⊞ 19.6K · ◷

• expires on Oct 23, 2026, 9:36 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Schema Consistency Checker.

A newer discussion is available at Discussion #71568.