bcquality/microsoft/skills/review/al-style-review.md
Jesper Schulz-Wedde 31b9949235 Strengthen al-code-review execution, propagate suggested-code to leaves, two new KB articles
Driven by a parity comparison between BCAppsBCQuality PR #27 and
BCAppsCampAIRHack PR #162 on byte-identical content:

| | BCQuality | AIRHack |
|--|--|--|
| Total findings | 6 | 10 |
| Performance   | 0 | 4 |
| Security      | 0 | 5 |

Standalone runs of al-security-review and al-performance-review against
the SAME diff produced the expected matches (rimd-on-read-only via
inherent-permissions-minimal-grant; redundant-Get via
avoid-redundant-get-when-record-already-loaded). The miss in the live
run is therefore not a knowledge-coverage gap and not a worklist
filtering issue. It is attention dilution inside the al-code-review
super-skill, which the model collapses into one rolled-up generation
pass on real-size PRs.

Changes:

microsoft/skills/review/al-code-review.md
- New 'Execution discipline (mandatory)' subsection in the Action step
  that explicitly forbids collapsing leaves into one shared reasoning
  pass and requires each sub-skill to walk its Source -> Relevance ->
  Worklist -> Action steps as its own iteration before the next leaf
  starts.
- Self-review pass is now described as the final, mandatory iteration
  with a concrete candidate-category checklist (architecture-level
  smells, error-handling gaps, magic constants, privacy/telemetry,
  resource lifecycle). Returning zero agent findings on a real-size
  diff is explicitly defined as a defect.

microsoft/skills/review/al-{security,performance,privacy,style,
                              upgrade,ui}-review.md
- Each leaf skill now states that when an unambiguous .good.al
  companion exists, findings[].suggested-code should carry the
  literal replacement for the source lines. Closes the
  one-click-suggestion gap created when BCQ#19 only updated
  al-code-review.

microsoft/knowledge/security/case-must-handle-unknown-enum-values.{md,
                                                            bad.al,
                                                            good.al}
- New article: case over a security-sensitive enum (Authentication
  Type, Authorization Mode, Identity Provider, Permission Scope,
  Encryption Algorithm) MUST have an else arm. Without it, an unknown
  enum value silently falls through and the security context never
  initialises. The bad sample is lifted from the SharePoint Graph
  helper that triggered the parity finding.

microsoft/knowledge/performance/instream-length-unreliable-for-bc-
                                                   streams.{md,bad,good}
- New article: InStream.Length returns 0 / partial for HTTP-response
  streams and some file-API streams, breaking size-threshold branching
  in upload code. Bad sample is the simple-vs-chunked Graph upload
  pattern; good sample materialises into a Temp Blob first.

Companion change: microsoft/BCAppsBCQuality#28 extends the
orchestrator's bootstrap prompt with the same per-iteration execution
discipline and adds a CI warning when a >5-file PR returns zero agent
findings (regression signal).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-28 10:48:32 +02:00

6 KiB

kind id version title description inputs outputs bc-version technologies countries application-area
action-skill al-style-review 1 AL style review Reviews AL source changes against naming, labelling, and code-convention guidance from BCQuality.
pr-diff
file-path
findings-report
all
al
w1
all

AL style review

Reviews AL source changes against the style knowledge domain in BCQuality and emits a findings report. This is a leaf action skill: it invokes no sub-skills. It is one of the skills composed by al-code-review.

Style findings cover AL conventions that CodeCop and similar analyzers partially enforce — label suffixes, API page naming, temporary-variable prefixes, label properties, named invocations, FieldCaption/TableCaption in user messages, OptionCaption pairing, Error-parameter passing, this keyword, required parentheses, file-naming. Use together with a formal analyzer; this skill adds BCQuality's remedial-knowledge explanations of why each rule exists.

An orchestrator invokes this skill with either a pr-diff or a file-path. The skill produces a single JSON document conforming to the DO output contract.

Source

Collect all knowledge files under */knowledge/style/**/*.md, across every enabled layer.

Relevance

Apply the frontmatter matching rules defined in READ against the task context:

  • bc-version — the target BC version from the PR branch's app.json or the orchestrator-supplied version. If unavailable, the dimension is unknown.
  • technologies[al].
  • countries — the countries declared in the consuming app's app.json. If absent, unknown.
  • application-area — pass the actual set declared by the changed objects; do not substitute [all].

Discard files that are not applicable. Retain conditionally applicable files only when the orchestrator's configuration permits them; findings derived from those files MUST have confidence no higher than medium and MUST name the unknown dimensions in message.

Worklist

Narrow the relevant files to the subset that applies to the changes under review. For each relevant file, compute overlap against:

  • Changed AL objects — especially API pages (PageType = API), tables and pages declaring Labels/TextConsts, codeunits issuing Error/Message/Confirm, and any file whose name violates the <ObjectName>.<ObjectType>.al convention.
  • Changed declarations, weighted toward : Label '...', : TextConst '...', temporary record variables, option fields, error-handling call sites, and codeunit-internal method calls.
  • Tokens extracted from the diff (Label, TextConst, Locked, Comment, MaxLength, temporary, OptionMembers, OptionCaption, APIPublisher, APIGroup, APIVersion, EntityName, EntitySetName, DelayedInsert, FieldCaption, TableCaption, FieldName, TableName, Page.RunModal, Report.Run, this., StrSubstNo).

A file enters the candidate worklist when its keywords intersect the extracted tokens or its topic matches a changed object or declaration.

Once the candidate worklist is known, resolve layer-precedence conflicts per READ and record suppressions.

When the post-conflict worklist is empty because no applicable style knowledge exists, or because configuration suppressed every candidate, emit outcome: "no-knowledge". When the worklist is empty because no applicable style knowledge matched the changes, emit outcome: "completed" with an empty findings array.

Action

For each worklist entry, evaluate the diff against the file's ## Best Practice and ## Anti Pattern sections. Style findings rarely reach blocker — reserve it for cases where the knowledge file documents a platform-level requirement (for example, API page property constraints the OData runtime rejects). Most style findings are minor or info; egregious misuse (Error with pre-built Text losing translation and telemetry classification) may reach major.

Set confidence to:

  • high when the detection is based on an unambiguous pattern match.
  • medium when detection relies on heuristics or when any frontmatter dimension was unknown.
  • low when the finding is an advisory derived only from applicability.

When the knowledge file ships an unambiguous .good.al companion that names exactly the correction the finding requires (and the diff context makes the substitution mechanical), set findings[].suggested-code to the literal replacement for the source lines indicated by location. The payload must be a verbatim replacement — no diff markers, no fences, no commentary — that the consumer can render as a one-click suggestion. Skip the field when the appropriate fix depends on context the skill cannot determine, or when more than one defensible replacement exists. See skills/do.md for the full contract.

Outcome selection:

  • completed — the skill evaluated every worklist item.
  • no-knowledge — no applicable style knowledge survived filtering.
  • not-applicable — no AL changes in the diff.
  • partial — a budget was hit before the worklist was exhausted.
  • failed — an unrecoverable error occurred.

Output

Output conforms to the DO output contract. A populated example:

{
  "skill": { "id": "al-style-review", "version": 1 },
  "outcome": "completed",
  "summary": {
    "counts": { "blocker": 0, "major": 0, "minor": 1, "info": 0 },
    "coverage": { "worklist-size": 1, "items-evaluated": 1 }
  },
  "findings": [
    {
      "id": "microsoft/knowledge/style/apply-approved-label-suffixes.md",
      "severity": "minor",
      "message": "A Label named Text000 has no approved suffix (Msg/Err/Qst/Tok/Lbl/Txt). Per the referenced CodeCop AA0074 guidance, every Label and TextConst carries a suffix indicating its consuming call.",
      "location": {
        "file": "src/Sales/PostingRoutines.Codeunit.al",
        "line": 42
      },
      "references": [
        { "path": "microsoft/knowledge/style/apply-approved-label-suffixes.md" }
      ],
      "confidence": "high"
    }
  ],
  "suppressed": []
}