Enforce replace-label post-update response checks#50625
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds post-update validation to replace_label and aligns related specifications and fixtures.
Changes:
- Rejects incomplete
setLabelsresponses and adds regression tests. - Updates replace-label and intent-attribution compliance documentation.
- Consolidates OTel reliability safeguards and implementation references.
Show a summary per file
| File | Description |
|---|---|
actions/setup/js/replace_label.cjs |
Validates resulting label state. |
actions/setup/js/replace_label.test.cjs |
Tests partial-success rejection. |
specs/replace-label-compliance/README.md |
Updates enforcement and parity notes. |
specs/intent-attribution-compliance/README.md |
Documents policy/report structure. |
specs/otel-observability-spec.md |
Adds safeguards and implementation references. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 5/5 changed files
- Comments generated: 3
- Review effort level: Balanced
| | MCP access-control fixture contract | `specs/github-mcp-access-control-compliance/README.md` | | ||
| | Replace-label fixture contract | `specs/replace-label-compliance/README.md` | |
| `traced_root_url` from the resolved artifact relationship; its | ||
| `attribution_status` and `attribution_source` preserve the attribution | ||
| context that was supplied to policy compilation. |
| | Edge: duplicate transition entries | `TestFormalTransitionEdge_DuplicateTransitionEntriesIdempotent` | Duplicate entries in the list don't change the allow/deny decision | | ||
|
|
||
| Coverage parity check (2026-08-03): verified Behavioral Coverage Map entries | ||
| Coverage parity check (2026-08-05): verified Behavioral Coverage Map entries |
|
/matt |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /diagnosing-bugs and /tdd — approving. The implementation correctly closes the RL-057/RL-058/RL-059 spec gap and the new tests cover both partial-success cases cleanly.
📋 Key Themes & Highlights
Positive Highlights
- ✅ Both validation checks guard the right states (
label_to_addabsent,label_to_removeretained) and are evaluated in a safe order — thelabelToRemove !== labelToAddguard prevents false positives on self-transitions. - ✅ Test names read as specifications and follow clear Arrange / Act / Assert structure.
- ✅
core.error()+{ success: false, error }keeps the error shape consistent with the rest of the handler. - ✅ Compliance README update is precise: removes the gap note and replaces it with the concrete enforcement statement.
- ✅ OTel safeguards addition is correctly scoped under its own
### Safeguardsheading with appropriate MUST-level normative language.
Minor Observation (non-blocking)
The labelToRemoveIsPresent variable referenced by the new guard is defined earlier in the function (outside the diff). Worth confirming it correctly captures the pre-update label presence and is not stale across retries — but the naming is clear and the logic reads correctly.
PR Triage: #50625Category: feature | Risk: medium | Priority Score: 62/100 (impact 25, urgency 20, quality 17)
|
The SPDD review identified that
replace_labelaccepted HTTP 200 responses without verifying the resulting label state. It also identified documentation gaps around observability safeguards and intent-attribution fixture structure.Replace-label enforcement
setLabelsresponses when the added label is absent.core.error()with the existing{ success: false, error }result shape.Coverage and compliance fixtures
Specification alignment
PolicyCompiler/CLI-reporting structure note.