#218 Harden findings-report producer constraints
Findings reports now enforce stricter validation rules for finding IDs, confidence levels, and severity values to prevent contract failures. Finding IDs must not contain citation fragments, uncited findings are restricted to medium/low confidence and minor/info severity, and a checklist clarifies proper handling of citation paths and line numbering.
- 3files
- 1AL files
- 0objects
Pull request · merged into main on 2026-10-05 by gggdttt · 3 files (+153 -5), 1 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Finding IDs must match a pattern rejecting citation paths with hash fragments
- Uncited findings limited to medium/low confidence and minor/info severity levels
- Knowledge-backed findings retain all existing confidence and severity combinations
- Added pre-emission checklist for proper citation ID copying and line number validation
- Semantic validation gates remain responsible for source file bounds and exact citation equality
- Behaviour changes for users or extensions.
AL objects touched
skills/do.md: modified, not in the BC? snapshot
Context
- Systems: development, platform
- From the description: “Require every finding ID to match
^[^#]+$, rejecting citation paths with appended#locationfragments.”
Source: metadata of a merged pull request in microsoft/BCQuality (bcquality): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).