[pelikhan]

Why

Community reports describe unreadable URL redaction, lost HTML/code fidelity, and stripped machine-readable metadata. The issue-body builder previously combined agent content and framework wrappers into one Markdown string, losing the origin information needed for selective redaction.

Changes

• Track optional agentTainted provenance on report titles, footers, block nodes, and inline nodes. Missing provenance is tainted; only trusted builders assign framework origin. Normalization preserves provenance boundaries without merging agent content into framework structure.
• Parse agent bodies separately and insert typed slots into framework templates. Preserve framework attribution, expiration, metadata, and wrappers while keeping missing-tool, missing-data, no-op, and incomplete-report payloads tainted. Diagnostic scalar slots cannot introduce trusted Markdown structure.
• Add the internal redactReport(report, shouldRedact) helper and optional redact builder predicate. Selected agent subtrees become fixed notices; wholly agent-owned containers are replaced on descendant matches, including link destinations. Mixed-origin containers retain framework descendants, consecutive inline matches coalesce, and selected titles become fixed safe text.
• Harden rendering against credentials split across provenance and inline-formatting boundaries. Redact complete rendering runs, including singletons, before escaping or choosing code fences; preserve unrelated formatting and leave the AST unchanged.
• Require a private redaction proof before concretizing a report tree. Assert that no secret-tainted strings remain in any tree field, nested metadata key/value, encoded form, or reconstructed inline run; recheck current masks and the final title/body. Forged or stale proofs and remaining secrets fail closed without echoing rejected content. Agent-origin provenance remains independent of this safety proof.
• Automatically fit oversized issue, comment, and review bodies by replacing large agent-owned AST subtrees with explicit size-redaction notices. Measure concrete output, including escaping and attribution, and retain exact-boundary content without unnecessary redaction. Reserve actual execution-provenance overhead instead of counting replaced markers twice.
• Preserve complete framework markers, closing references, expiration, generated/configured footers, and footer diagnostics during size fitting. Trusted builders can mark embedded diagnostics sizeProtected; that flag does not bypass secret redaction or an explicit coarse security policy. Protected-content overflow fails before publication. Review fallbacks retain full inline footers and original review attribution/caller markers instead of slicing strings.
• Parse valid JSON fences into atomic structured_data AST nodes. Keep fitting payloads intact or replace the entire agent-owned node; never truncate serialized JSON or leave partial fences. Invalid JSON examples remain literal code, and protected JSON metadata remains a separate json_marker type.
• Accept bounded source bodies up to 524,288 units for the supported issue/comment/review tools while retaining final publication limits of 65,536 units (65,000 for review summaries). Preserve mention/link quotas before fitting and final-body validation; keep compiler and runtime tool schemas synchronized.
• Fail closed when wrapper fences swallow typed body or diagnostic slots. Include the Markdown parser and size fitter in the isolated safe-outputs bundle and retain legacy non-issue footer formatting when no size reduction is needed.
• Update the safe-outputs specification, changeset, and regressions for provenance, redaction promotion, hostile diagnostics, split credentials, slot isolation, serialization assertions, atomic structured data, exact size boundaries, and protected-frame overflow.

These provenance and coarse-policy controls are trusted-code runtime APIs, not new agent-controlled trust fields or workflow frontmatter options. Framework provenance never bypasses secret sanitization, validation, canonical HTTPS checks, configured URL policies, or rendering escapes. Raw HTML support is not expanded.

Related reports

Cluster	Reports
URL filtering and readable citations	#17513, #33970
HTML and code fidelity	#18829, #29009
Hidden metadata loss	#18992, #67174

These reports motivate the infrastructure; this PR does not claim to resolve every requested URL policy or HTML feature.

Validation

• make merge-main completed previously, including build and workflow recompilation.
• make fmt-cjs, make lint-cjs, and the JavaScript typecheck passed.
• Focused issue/comment/review, AST/redaction, Linear/Azure/Jira, footer, MCP-limit, and isolated-deployment suites passed.
• The final make agent-report-progress passed: 17 impacted JavaScript suites, 1,089 tests, build, and schema freshness checks; four existing lint warnings remain non-blocking.
• Focused Go compiler/runtime tool-schema checks passed.
• Regressions cover exact publication limits after provenance replacement, whole-node JSON redaction, unforgeable size protection, complete diagnostic/footer preservation, protected-only overflow before writes, unchanged mention/link quotas, and review fallback attribution.

---

---

✨ PR Review Safe Output Test - Run 39180147090

💥 [THE END] — Illustrated by Smoke Claude · claude · sonnet46 · 85.6 AIC · ⌖ 4.59 AIC · ⊞ 922 · ◷
_{Comment /smoke-claude to run again}

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · opus55 · 11.2 AIC · ⌖ 36.3 AIC · ◇ 14.3 AIC · ⊞ 1.9K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · haiku45 · 5.14 AIC · ⌖ 7.61 AIC · ◇ 2.53 AIC · ⊞ 9.2K · ◷

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · 16 AIC · ⌖ 5.3 AIC · ⊞ 14.6K · ◷

Generated by Ponytail Reviewer for #70032

[github-actions]

Comment Memory

Peek at saved memory (pr-code-quality-reviewer)

reviewed_at: 2026-10-18T23:22:54Z
review_event: REQUEST_CHANGES
top_themes:
  - provenance boundary loss during rendering
  - coarse redaction misses tainted titles
files_reviewed:
  - actions/setup/js/failure_report.cjs
  - actions/setup/js/handle_agent_failure.cjs
  - actions/setup/js/issue_body.cjs
  - actions/setup/js/issue_report.cjs
  - actions/setup/js/report_ast.cjs
  - actions/setup/js/report_footer.cjs
  - actions/setup/js/report_markdown.cjs
  - actions/setup/js/report_redaction.cjs
comment_count: 2

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 91.6 AIC · ⌖ 6.19 AIC · ⊞ 12.7K · ◷
_{Comment /review to run again}

[github-actions]

REQUEST_CHANGES

This PR introduces two blocking leaks in the new provenance and redaction path: final rendering still collapses provenance boundaries, and coarse redaction does not cover tainted titles.

Blocking themes

• Provenance is lost at render time. normalizeInlines() now preserves taint boundaries, but renderInlines() still merges adjacent text and code nodes without checking provenance. That can reconstruct a secret or control string from trusted and agent supplied fragments in the final Markdown.
• redact is incomplete for issue publication. The new helper rewrites body, preamble, footer, and footer markers, but never the title. A caller can opt into coarse redaction and still publish a sensitive agent generated title unchanged.

This was a static diff review only; I did not execute the code.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 91.6 AIC · ⌖ 6.19 AIC · ⊞ 12.7K
_{Comment /review to run again}

[github-actions]

Skills-Based Review 🧠

Applied /tdd and /grill-with-docs per pr-triage. This is a well-engineered addition — approving with one minor non-blocking suggestion.

📋 Key Themes & Highlights

Verification performed

• Traced the core invariants by reading live source (report_ast.cjs, report_markdown.cjs, report_redaction.cjs, issue_body.cjs) alongside the diff, not just the patch text.
• Confirmed normalizeReportProvenance enforces "missing = agent-tainted" and rejects non-boolean taint.
• Confirmed inline/text merging (report_ast.cjs ~line 190, report_markdown.cjs ~line 107) gates on agentTainted equality so agent fragments can't silently merge into framework text.
• Confirmed isAgentSubtree in report_redaction.cjs requires all descendants (children, list items, table cells) to be agent-origin before a node is eligible for coarse replacement, so mixed-origin subtrees are correctly traversed rather than swallowed.
• Confirmed footer marker redaction leaves a visible redactionNotice() trace rather than silently dropping markers.
• Spot-checked the docs claims in safe-outputs-specification.md ("agent delimiters cannot close framework wrappers", "does not mutate the input", "framework provenance MUST NOT bypass secret redaction") against both the implementation and the new report_redaction.test.cjs (389 lines) — all are directly exercised by tests (e.g. the </details>-injection test, the structuredClone immutability assertions, and the secret-redaction-still-applies test).

/tdd assessment

Test coverage is unusually thorough for a first pass: provenance preservation through normalization, cross-boundary merge prevention, slot insertion independence, forged/non-boolean provenance rejection, mixed-origin non-swallowing, and footer/marker protection are all covered with descriptive spec-style test names. No genuine gaps found worth blocking on.

/grill-with-docs assessment

New vocabulary (agentTainted, isAgentSubtree, coarse redaction) is introduced consistently between code, JSDoc, and the spec doc, and the spec's community-issue-cluster table maps cleanly to the implemented boundary. No vocabulary drift found.

Minor finding (posted inline)

• report_markdown.cjs:241 — block-slot insertion doesn't shallow-copy nodes the way the inline-slot path does at line 133. Currently safe (no in-place mutation elsewhere, and tests assert slot immutability), but worth aligning for consistency/future-proofing.

Scope caveat

The sandbox for this review had no installed vitest/node_modules under actions/setup/js and no network access to fetch them, so I could not dynamically execute the test suite. The review is based on careful static reading of the diff and live source cross-referenced against the new tests; confidence is high but not runtime-verified.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 202 AIC · ⌖ 14 AIC · ⊞ 10.1K
_{Comment /matt to run again}

[Copilot]

🔵 Needs a closer look

Security-sensitive provenance and publication changes have unresolved correctness issues and need human review.

3 open issues

• Preserve provenance for agent-authored footer diagnostics · New
• Handle body slots wrapped by paired fenced code blocks · New
• Collapse consecutive redacted inline notices · New

What changed in this PR

Introduces provenance tracking in issue-report trees so internal redaction policies can distinguish agent content from framework structure without relaxing existing sanitization.

Changes:

• Preserve provenance through parsing, normalization, and report assembly.
• Add optional subtree redaction to issue builders.
• Document the contract and expand regression coverage.

File	Description
docs/​src/​content/​docs/​specs/​safe-outputs-specification.md	Defines provenance and redaction requirements.
actions/​setup/​js/​report_redaction.test.cjs	Tests provenance, redaction, and wrapper isolation.
actions/​setup/​js/​report_redaction.cjs	Implements subtree redaction.
actions/​setup/​js/​report_markdown.cjs	Adds provenance tagging and typed block slots.
actions/​setup/​js/​report_footer.test.cjs	Updates footer provenance expectations.
actions/​setup/​js/​report_footer.cjs	Tags framework-generated footer nodes.
actions/​setup/​js/​report_ast.cjs	Preserves provenance during normalization and rendering.
actions/​setup/​js/​messages_footer_work_queue.test.cjs	Updates claim-footer provenance assertions.
actions/​setup/​js/​issue_report.cjs	Exposes provenance and redaction options.
actions/​setup/​js/​issue_body.cjs	Separates agent bodies from framework templates.
actions/​setup/​js/​handle_agent_failure.cjs	Tags the framework caution preamble.
actions/​setup/​js/​failure_report.test.cjs	Updates failure-heading provenance expectations.
actions/​setup/​js/​failure_report.cjs	Distinguishes diagnostic content from framework scaffolding.
.changeset/​patch-issue-redaction-provenance.md	Records the patch release change.

_{Review effort: Max}

[pelikhan]

Reply to the design gate result: No code change is requested by this notification. I have not treated its reported_no_action result as proof of correctness; the concrete review findings have been evaluated and validated separately.

[pelikhan]

Reply to the code quality completion notice: This notification does not itself request a code change. The rendering-provenance and title-redaction findings from the associated review are addressed in their individual threads.

[pelikhan]

Reply to the skills review completion notice: No separate code change is needed for this completion notice. The associated block-slot copying suggestion is addressed in its inline thread with regression coverage.

[pelikhan]

Reply to the test quality result: No specific test change is requested by this notification, and reported_no_action is not a substitute for validation. The concrete fixes in this batch have focused regression coverage and passed the final local validation gate.

[pelikhan]

Reply to the Ponytail review result: No actionable code change is specified by this notification. I have addressed the concrete inline findings and used local validation rather than this reported_no_action result as evidence.

[pelikhan]

Reply to the saved code quality review summary: Partially accepted: tainted titles now pass through the redaction predicate and selected titles become fixed framework text. The rendering merge guard was declined because serialization re-normalizes and redacts combined runs before escaping; added regressions cover split secrets, mentions, controls, and code spans without changing AST provenance.

[github-actions]

💥 [THE END] — Illustrated by Smoke Claude · claude · sonnet46 · 85.6 AIC · ⌖ 4.59 AIC · ⊞ 922
_{Comment /smoke-claude to run again}

[Copilot]

🟡 Changes recommended

Blocking deployment and redaction defects remain unresolved.

3 open issues

• Add report_markdown.cjs to SAFE_OUTPUTS_FILES · New
• Assemble complete runs before redaction to prevent secret leakage · New
• Replace wholly agent-owned containers on descendant matches · New

3 resolved since last review

• Preserve provenance for agent-authored footer diagnostics
• Collapse consecutive redacted inline notices
• Handle body slots wrapped by paired fenced code blocks

_{Review effort: Max}

[pelikhan]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

[Copilot]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the s...

Fixed the review findings in commit HASH: added the Markdown parser to the safe-outputs bundle, redacted completed inline runs before rendering, and promoted wholly agent-owned inline containers after descendant matches. Added regression coverage; focused tests and typecheck pass.

[pelikhan]

Reply to the earlier design-gate response: No additional code change is requested here. The current batch uses executed local checks rather than reported_no_action as correctness evidence.

[pelikhan]

Reply to the earlier quality-review response: No separate code change is needed for this historical response. The newer completed-run rendering finding is verified, covered by additional regressions, and resolved in its own thread.

[pelikhan]

Reply to the earlier skills-review response: The block-slot copying fix and its coverage remain in place. This response adds no further actionable request.

[pelikhan]

Reply to the earlier test-quality response: No code change is needed for this historical status message. Current focused coverage and the local publishing gate passed after updating the branch.

[pelikhan]

Reply to the earlier Ponytail response: No new actionable finding is specified here. The current concrete review findings have been verified and all five listed inline threads are resolved.

[pelikhan]

Reply to the earlier rendering explanation: The newer review correctly identified that incremental prefix redaction was insufficient; the existing fix now redacts completed runs, including singletons, and the expanded credential-tail regressions pass. AST provenance remains separate, and the safe-outputs specification now states the stronger serialization contract.

[pelikhan]

Reply to the linked-review fix request: Verified all three linked fixes already present in 125e83e: the parser deployment dependency, completed-run redaction, and agent-container promotion. Added focused regressions without duplicating those runtime changes, and resolved the corresponding threads.

[pelikhan]

Reply to the prior implementation report: Verified the described fixes in the actual code and commit 125e83e rather than relying on the literal HASH placeholder. Deployment, rendering, and redaction coverage pass; no additional runtime fix was needed.

[pelikhan]

Reply to the outstanding-work request: Updated using make merge-main, integrated concurrent bot edits without overwriting history, and published the smoke-comment clarifications plus regression and specification updates. All five listed inline threads now have substantive replies and are resolved; no workflow runs were triggered.

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Review (actions/setup/js/report_redaction.cjs:106): A wholly agent-origin details node is traversed rather than promoted when only a descendant matches, so its agent-authored summary string survives redaction. The summary is never offered to shouldRedact either (it is a plain string, not a node), so a policy has no way to remove it: for agent markdown such as
   token hunter2

   \n\nbody\n\n
   , selecting the inner paragraph publishes
   token hunter2
   with only the body replaced. This is the same class... - Track agent provenance and support coarse issue-body redaction #70032 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 6b721f1
Sous-chef work: c803d9e30ad3c306a6355b998e7b7e359e85091d33fb03c4af50332341f26118
Sous-chef state: 2ddda5303736d05ef4369c26a3d5f5d76c3eee641800b069af5c085a60211cec

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 3.5 AIC · ⌖ 10.2 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.92.6