Merge current main into development guidance

Reconcile the read-only guidance output with the machine-readable skill index,
adopt linked sample references required by bounded retrieval, and update the
guidance regression fixture for the retrieval helper dependency. Permit only
the known endpoint-DLP metadata stream during read-only evidence capture.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 638b66d2-9f06-4f60-8781-808709e1485c

docs/contributing.md

@@ -161,12 +161,15 @@ If PyYAML is not installed in your development environment, install it with
 ```powershell
 python .github\scripts\validate_frontmatter.py --root .
 pwsh .\tools\Test-ReviewFixtures.ps1 -Root .
+pwsh .\tools\Test-ReviewContract.ps1 -Root .
 ```
 
 The first command checks schema, sections, naming, sample references, and
 skill registration. The second checks that every review leaf has a valid
-positive/clean sample pair. Neither proves a model will find every defect.
-See [evaluation](../evaluation/README.md) for optional model-based scoring.
+positive/clean sample pair. The third checks the cross-surface findings-report
+contract and its bounded range-normalization cases. None proves a model will
+find every defect. See [evaluation](../evaluation/README.md) for optional
+model-based scoring.
 
 In the PR description, explain the mistake being prevented, supporting
 evidence, applicable BC versions, and why the chosen domain owns it. For a

docs/standalone-runner.md

@@ -52,10 +52,17 @@ only result.
 4. When an action skill declares `sub-skills`, execute every relevant leaf as a
    discrete invocation. Leaves are independent and may be scheduled serially
    or concurrently.
-5. Collect each complete findings-report into `sub-results` in the declared
+5. Capture the exact Task return as the immutable raw audit payload and primary
+   transport. Preserve it unchanged in private artifacts or host logs. Before
+   the full DO acceptance gate, create a normalized candidate only for DO's
+   bounded optional-range case, record that normalization separately in private
+   telemetry, and accept the candidate only if the entire copy passes the
+   unchanged strict gate. The accepted report contains no undeclared telemetry
+   fields.
+6. Collect each accepted findings-report into `sub-results` in the declared
    `sub-skills` order, not completion order. Run the super-skill self-review
    only after all leaves have finished.
-6. Apply the DO composition, failure, deduplication, reference-integrity, and
+7. Apply the DO composition, failure, deduplication, reference-integrity, and
    outcome rules. Return strict JSON before rendering it for people or another
    system.
 
@@ -86,6 +93,15 @@ A compatible runner:
 - invokes every worklisted leaf exactly once unless a documented retry replaces
   a failed attempt;
 - keeps leaf contexts isolated and passes only the inputs they declare;
+- preserves each raw Task return unchanged for audit and distinguishes it from
+  any normalized accepted copy;
+- removes only an optional range whose positive integer bounds contain the
+  primary line but start before it, and only when the complete report has no
+  other defect and the finding has no `suggested-code`;
+- records normalization only in private runner telemetry and never adds fields
+  to the findings-report;
+- rejects reversed, invalid, or out-of-bounds ranges, range mismatches attached
+  to `suggested-code`, and every repair outside DO's bounded exception;
 - preserves every leaf report, including failed reports, in `sub-results`;
 - excludes unreliable findings from failed leaves and returns `partial` when
   only part of the review is reliable;

docs/using-bcquality.md

@@ -183,7 +183,7 @@ using your normal compilation, analyzer, test, and human-review workflow.
 
 ## Coverage and limits
 
-The Microsoft broad review composes the 16 Microsoft domains listed below.
+The Microsoft broad review composes the 17 Microsoft domains listed below.
 The Community Agents review is a separate skill selected by the request, not
 a nested part of that coordinator. All current review leaves accept app
 folders, files, and diffs; request an Agent SDK review explicitly when that
@@ -219,6 +219,7 @@ Each article describes one concern. Where samples exist, use its linked
 | Performance | [Performance](../microsoft/knowledge/performance/) |
 | Privacy | [Privacy](../microsoft/knowledge/privacy/) |
 | Query objects | [Query](../microsoft/knowledge/query/) |
+| Reporting | [Reporting](../microsoft/knowledge/reporting/) |
 | Security | [Security](../microsoft/knowledge/security/) |
 | Style | [Style](../microsoft/knowledge/style/) |
 | Telemetry | [Telemetry](../microsoft/knowledge/telemetry/) |