[Safe Outputs Conformance] MCE-001: add_comment tool description missing required CONSTRAINTS/IMPORTANT disclosure keyword
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 78/100
Research direction
Open pkg/workflow/js/safe_outputs_tools.json and locate the add_comment tool description. Check whether this file is generated from another source, then add the required constraint disclosure while preserving the listed limits. Run bash scripts/check-safe-outputs-conformance.sh; done means MCE-001 passes.
Written by the indexing model from the issue text.
Description
Conformance Check Failure
Check ID: MCE-001
Severity: MEDIUM
Category: Specification (Section 8.3 MCE2 - Tool Description Constraint Disclosure)
Problem Description
Spec Section 8.3 MCE2 requires that tool descriptions surfacing enforced constraints make that disclosure unambiguous, using a recognizable marker (CONSTRAINTS, or IMPORTANT ... constraint, or validation constraint). The add_comment tool description in pkg/workflow/js/safe_outputs_tools.json already states all three numeric limits (524288/65536 character limits, 10 mentions, configured max-links default 50) in prose, but does not contain any of the required marker keywords, so an automated or quick-scanning consumer of the tool description cannot reliably detect that these are hard-enforced constraints versus descriptive text.
Affected Components
- Files:
pkg/workflow/js/safe_outputs_tools.json(theadd_commenttool entry, line ~531)
🔍 Current vs Expected Behavior
Current Behavior
Current description (relevant excerpt):
\"...Input is limited to 524288 characters, 10 mentions, and configured max-links URL occurrences (default: 50). Oversized agent content is automatically replaced by notices to fit the complete 65536-character published comment...\"
This correctly lists the limits but never uses the word CONSTRAINTS or an IMPORTANT ...constraint / validation constraint phrase, so the checker (and a human skimming many tool descriptions) cannot pattern-match it as an explicit constraint-disclosure block.
Expected Behavior
Per spec Section 8.3 MCE2, the description should clearly flag the limits as enforced constraints, e.g. by prefixing the limits sentence with CONSTRAINTS: so it reads something like:
\"...CONSTRAINTS: input is limited to 524288 characters, 10 mentions, and configured max-links URL occurrences (default: 50)...\"
Remediation Steps
This task can be assigned to a Copilot coding agent with the following steps:
- Open
pkg/workflow/js/safe_outputs_tools.jsonand locate theadd_commenttool entry. - Edit the
descriptionfield to prefix the constraint-limits sentence withCONSTRAINTS:(or otherwise insert the literal wordCONSTRAINTSadjacent to the limits), without changing the actual documented limit values (524288, 65536, 10 mentions, max-links default 50) or any other wording/behavior. - If
pkg/workflow/js/safe_outputs_tools.jsonis generated/synced from another source (check for a generator script), apply the same edit at the source of truth so it round-trips correctly, and regenerate. - Run
make fmtif any Go-side generation templates were touched.
Verification
After remediation, verify the fix by running:
bash scripts/check-safe-outputs-conformance.sh
The check MCE-001 should pass without errors.
References
- Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md (Section 8.3 MCE2)
- Conformance Checker: scripts/check-safe-outputs-conformance.sh
- Run ID: 39907463914
- Date: 2026-10-23
Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · ~67 AIC · ⌖ ~1 AIC · ⊞ 5.4K · ◷
- expires on Oct 23, 2026, 9:51 PM UTC-08:00
- Dominant language
- Go
- Stars
- 5.4k
- Forks
- 596
- Avg merge
- 3h 40m
- Merged PRs (30d)
- 830
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/gh-aw
-
automation models
Difficulty 1/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
automated-analysis code-quality cookie testing
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
automated conformance safe-outputs
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
wgdonenotdeferred: parenthesized Done() statement escapes non-deferred detection (paren_unwrap_gap)Opencookie sergo
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
cookie eslint
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
Similar issues
-
[BUG] deploy.restart_policy without condition drops the restart policyPossibly taken @akshat-lakhera claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
docker/compose#14383 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
AvengeMedia/dank-greeter#39 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
dokku/dokku-datastore#367 ·
Maintainers usually reply within 1 day
-
[Bug]: ap gateway image build cannot find local policies on WindowsPossibly taken @Jayzilva claimed this today. OpenAspect/Configuration Severity/Major
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
wso2/api-platform#3912 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 2 days