[Schema Consistency] 🔍 Schema Consistency Check - 2026-11-01

[github-actions[bot]]

Overview

Found 3 confirmed inconsistencies across documentation, schema, and compiler contracts. Reviewed all four areas, including a targeted scan of 470 workflow/shared frontmatter blocks. No occurrences of the three affected patterns were found in that scan. Source files were unchanged.

Key Issues

1. MCP FAQ example cannot validate — docs/src/content/docs/reference/faq.md:224 nests mcp-servers under tools and uses image. The schema rejects the nested key. Its supported server field is container. Fix: move mcp-servers to the top level and replace image with container, retaining the domain allowlist.
2. Gateway reference advertises unsupported refusal-labels configuration — docs/src/content/docs/reference/mcp-gateway.md:1617 describes label-based demotion and examples at lines 1625 and 1636 configure tools.github.refusal-labels. The schema rejects that field; compiler guard construction serializes blocked users, trusted users, and approval labels, with no refusal-labels path found. Fix: clearly mark this contract as unavailable in the current authoring interface, or implement schema acceptance, parsing, validation, and policy forwarding together. This is a static configuration-contract finding; runtime gateway enforcement was not tested.
3. Sandbox example uses unsupported network.firewall — docs/src/content/docs/reference/sandbox.md:115 shows network.firewall: true, which the schema rejects. Fix: remove that line while retaining sandbox.agent: awf and the existing network.allowed entries. The corrected fragment passes local schema constraints. This finding uses the local frontmatter schema, not the unavailable canonical AWF config source.

Critical Issues

No critical runtime bug established. The refusal-labels documentation mismatch deserves priority because it describes a policy control that users cannot configure through the documented example.

Evidence, validation, and coverage

Schema and Parser Evidence

• MCP definitions: pkg/parser/schemas/main_workflow_schema.json:4934; tools properties: line 4966. The compiler merges separately supplied top-level MCP servers in pkg/workflow/tools.go:443. A minimal rejected FAQ fragment becomes schema-valid after moving the block and using container.
• GitHub guard fields: schema approval-labels definition at pkg/parser/schemas/main_workflow_schema.json:5188; parsing at pkg/workflow/tools_parser.go:345; typed approval labels at pkg/workflow/tools_types.go:445; emitted policy fields at pkg/workflow/mcp_github_config.go:497. A minimal min-integrity plus refusal-labels fragment fails with an unexpected-property error. The min-integrity-only baseline passes; removing refusal-labels is a validation control, not an equivalent policy replacement.
• Network schema: pkg/parser/schemas/main_workflow_schema.json:3947. pkg/workflow/engine.go:187 has an internal FirewallConfig pointer, which does not establish support for the documented public boolean syntax. Removing only the obsolete boolean makes the fragment pass local schema constraints.

Validation Method

Used inert Python YAML parsing and local Draft7 JSON Schema validation only. Three minimal bad fragments failed; three corrected or baseline fragments passed local constraints. Root required-field errors were excluded for these partial fragments, so these are not claims of full compilation success. No workflow code was executed.

Workflow Violations

No selected-pattern occurrences in 470 parsed frontmatter blocks under .github/workflows/, including shared components. The precomputed diff also reports no used top-level keys absent from the schema. Neither result establishes full workflow validity.

Leads Ruled Out

The precomputed docker-image-pull-policy and work-queue-policy typed-field gaps are not confirmed bugs: raw-frontmatter consumers exist at pkg/workflow/docker.go:294 and pkg/workflow/work_queue_policy.go:184. Previously cached findings were excluded from this report.

AWF Comparison Warning — Non-authoritative

/tmp/gh-aw/agent/awf-config-drift.json reports degraded: true because canonical source retrieval failed. No authoritative config-source drift conclusion is possible. No required check failure, corrective PR, or drift issue is proposed from that incomplete comparison.

Recommendations and Next Steps

• Correct the FAQ server location and container field.
• Align refusal-labels documentation with current compiler support; if implemented, update schema, parser, forwarding, and meaningful acceptance tests together.
• Remove the obsolete network.firewall boolean from the sandbox example.
• Validate these corrected documentation fragments in the documentation validation process.

Strategy Performance

Strategy: Schema-def spot checks + targeted parser/doc/workflow verification (proven strategy-2). New strategy: No. Day 305 modulo 10 = 5 selected reuse. Findings: 3. Effectiveness: High. Should reuse: Yes. Updated the strategy cache with these findings and bounded validation results.

References: §41276757586

Generated by ✅ Schema Consistency Checker · codex · gpt61 · ~15 AIC · ⌖ ~8 AIC · ⊞ 20K · ◷

• expires on Nov 1, 2026, 9:28 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Schema Consistency Checker.

A newer discussion is available at Discussion #74042.