---
id: change/bcquality/218
type: change
title: "#218 Harden findings-report producer constraints"
summary: Findings reports now enforce stricter validation rules for finding IDs, confidence levels, and severity values to prevent contract failures. Finding IDs must not contain citation fragments, uncited findings are restricted to medium/low confidence and minor/info severity, and a checklist clarifies proper handling of citation paths and line numbering.
tier: official
language: en
tags:
  - fix
  - main
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:03:02.004Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: 7726d5d8d8dbcb146489f0e65e76e9cc9b976db0
evidence:
  - kind: code
    url: https://github.com/microsoft/BCQuality/pull/218
    title: "microsoft/BCQuality#218: Harden findings-report producer constraints"
    date: "2026-10-05"
    commit: 7726d5d8d8dbcb146489f0e65e76e9cc9b976db0
    t: null
    quote: Require every finding ID to match `^[^#]+$`, rejecting citation paths with appended `#location` fragments.
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 218
repo: microsoft/BCQuality
source_id: bcquality-prs
url: https://github.com/microsoft/BCQuality/pull/218
kind: pr
base_branch: main
major: null
merged_at: "2026-10-05T13:01:05Z"
author: gggdttt
author_type: User
community_contribution: false
labels: []
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 3
  additions: 153
  deletions: 5
  al: 1
apps: []
objects_touched: []
objects_unjoined:
  - path: skills/do.md
    status: modified
    reason: not-in-snapshot
obsoletions: []
backports: []
fixes_issues: []
work_items: []
systems:
  - development
  - platform
quote: Require every finding ID to match `^[^#]+$`, rejecting citation paths with appended `#location` fragments.
joined_against:
  major: null
  commit: null
---

# #218 Harden findings-report producer constraints

> Findings reports now enforce stricter validation rules for finding IDs, confidence levels, and severity values to prevent contract failures. Finding IDs must not contain citation fragments, uncited findings are restricted to medium/low confidence and minor/info severity, and a checklist clarifies proper handling of citation paths and line numbering.

[Pull request](https://github.com/microsoft/BCQuality/pull/218) · merged into `main` on 2026-10-05 by gggdttt · 3 files (+153 -5), 1 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Finding IDs must match a pattern rejecting citation paths with hash fragments
- Uncited findings limited to medium/low confidence and minor/info severity levels
- Knowledge-backed findings retain all existing confidence and severity combinations
- Added pre-emission checklist for proper citation ID copying and line number validation
- Semantic validation gates remain responsible for source file bounds and exact citation equality
- Behaviour changes for users or extensions.

## AL objects touched

- `skills/do.md`: modified, not in the BC? snapshot

## Context

- Systems: development, platform
- From the description: "Require every finding ID to match `^[^#]+$`, rejecting citation paths with appended `#location` fragments."

Source: metadata of a merged pull request in microsoft/BCQuality (bcquality): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).