code change · fixAL Developmentofficial - Microsoftreviewed - checked by Opus

#218 Harden findings-report producer constraints

Findings reports now enforce stricter validation rules for finding IDs, confidence levels, and severity values to prevent contract failures. Finding IDs must not contain citation fragments, uncited findings are restricted to medium/low confidence and minor/info severity, and a checklist clarifies proper handling of citation paths and line numbering.

Pull request · merged into main on 2026-10-05 by gggdttt · 3 files (+153 -5), 1 AL · fix · tier official · reviewed (checked by Opus)

What changed

  • Finding IDs must match a pattern rejecting citation paths with hash fragments
  • Uncited findings limited to medium/low confidence and minor/info severity levels
  • Knowledge-backed findings retain all existing confidence and severity combinations
  • Added pre-emission checklist for proper citation ID copying and line number validation
  • Semantic validation gates remain responsible for source file bounds and exact citation equality
  • Behaviour changes for users or extensions.

AL objects touched

  • skills/do.md: modified, not in the BC? snapshot

Context

  • Systems: development, platform
  • From the description: “Require every finding ID to match ^[^#]+$, rejecting citation paths with appended #location fragments.”

Source: metadata of a merged pull request in microsoft/BCQuality (bcquality): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).