[Schema Consistency] 🔍 Schema Consistency Check - 2026-11-03

[github-actions[bot]]

Overview

Found 2 actionable inconsistencies across schema, compiler and documentation. Inspected project workflows for the confirmed patterns. Strategy: documentation rejection reduction with positive controls; new exploration strategy (day-of-year 307 modulo 10 = 7). Previously cached findings were excluded.

Key Issues

1. Higher priority — documented refusal-labels cannot be configured. docs/src/content/docs/reference/mcp-gateway.md:1620 advertises label-based integrity demotion; examples at lines 1628 and 1639 configure tools.github.refusal-labels. The local frontmatter schema rejects that property. The compiler parses approval labels at pkg/workflow/tools_parser.go:345, but has no refusal-label counterpart; guard-policy serialization at pkg/workflow/mcp_github_config.go:497 emits blocked users, trusted users and approval labels only. Users following the documented review gate get a validation error; the documented configuration is unavailable. This is a static contract finding, not evidence of a runtime bypass. Fix: mark this feature as unsupported/planned in current frontmatter documentation, or implement its schema, parser, variable handling and serialization together with acceptance tests before advertising support.

2. Medium — FAQ custom MCP example has two invalid configuration choices. docs/src/content/docs/reference/faq.md:225 nests mcp-servers under tools and uses image for its server image. The schema defines mcp-servers at the root (pkg/parser/schemas/main_workflow_schema.json:4943); moving the block alone still fails because the server needs container, not image. The compiler merges top-level MCP servers into tools at pkg/workflow/tools.go:443; the MCP schema defines container at pkg/parser/schemas/mcp_config_schema.json:67. Fix: move mcp-servers to the root and replace image with container, retaining the server network allowlist. This corrected configuration passes local schema validation.

Evidence, coverage and limitations

Validation

Used inert JSON fixtures with on: workflow_dispatch against the local main schema using Draft7 validation. No workflow code or runtime was executed.

Fixture	Result
FAQ example with tools.mcp-servers	Rejected: unexpected property mcp-servers
FAQ moved to root, retaining image	Rejected: unexpected property image
Root MCP server with container and original network allowlist	Pass
GitHub configuration with min-integrity: approved and refusal-labels array	Rejected: unexpected property refusal-labels
Corresponding supported approval-labels control	Pass

Schema and parser review

The precomputed top-level gaps docker-image-pull-policy and work-queue-policy are false positives from typed-field enumeration: both have RawFrontmatter consumers (pkg/workflow/docker.go:294, pkg/workflow/work_queue_policy.go:184). No correction is recommended for those gaps.

Workflow coverage

Precomputed data reports no workflow root keys absent from schema. A targeted scan parsed 473 workflow/shared frontmatter mappings and found zero uses of tools.mcp-servers or tools.github.refusal-labels. This does not establish complete compilation or schema validity of every workflow, particularly imported fragments. No workflow changes are indicated by these findings.

AWF availability warning — non-authoritative

/tmp/gh-aw/agent/awf-config-drift.json reports degraded: true: canonical AWF source retrieval failed. No AWF config-source drift conclusion is made from that incomplete comparison, and no required-check failure, corrective PR or drift issue is requested. Neither finding above relies on the unavailable canonical AWF comparison.

Strategy performance

Findings: 2. Effectiveness: high for focused documentation contract checks. Reuse: yes. Cached the strategy and validation results for future runs. Repository source files were unchanged.

Next Actions

• Correct and schema-check the FAQ MCP example.
• Align the refusal-label documentation with currently supported frontmatter, or implement the complete contract before documenting it as available.
• Add documentation-example validation for these configuration shapes.

References: §41583680892

Generated by ✅ Schema Consistency Checker · codex · gpt61 · ~17 AIC · ⌖ ~9 AIC · ⊞ 20.2K · ◷

• expires on Nov 3, 2026, 9:30 PM UTC-08:00