* Add 18 more community AL/BC patterns across appsource, data-modeling, error-handling, security, style, testing, ui, upgrade, and web-services Second contribution from CURABIS ApS, generalized from patterns observed across real AppSource/PTE development. Cross-checked against the current microsoft/knowledge corpus before opening; several originally-drafted candidates were dropped as duplicates of existing files. * Address Jesper Schulz-Wedde's review on PR #157 - release-must-update-app-version.md: reframe around AppSource's actual strict full-version-ordering requirement; scope branching-policy claims as team convention, not platform rule. - pictures-must-use-media-not-blob.md: MediaSet is a collection of independent media objects, not automatic image variants/thumbnails. - log-writes-must-survive-rollback.{md,good.al}: StartSession's only data channel into the new session is its Record parameter to a TableNo-scoped codeunit; a setter called on a local instance before starting the session populates nothing in the new session. - exposed-objects-must-be-in-a-permission-set.md: correct the three exposure mechanisms (Web Services config, PageType/QueryType=API, ServiceEnabled as a method-only attribute). - pages-must-not-contain-business-logic.md: scope to persisted mutations and cross-entry-point rules; presentation-only calculations and table-owned invariants are not violations. - given-blocks-must-cover-full-precondition-chain.good.al: replace invented LibrarySales calls with the real API (CreateCustomer/CreateSalesOrderForCustomerNo/PostSalesDocument). - test-feature-scenario-tags.{md,good.al}: move [SCENARIO] inside the test procedure body to match the current BCApps corpus; keep [FEATURE] at codeunit level per Microsoft's own documented option. - ui-test-codeunit-naming.md: scope the _UT suffix and adjacent-ID pairing as an explicit team convention, not a BCApps-wide standard. - page-design-must-match-bc-page-type-conventions.md / table-design-must-match-bc-table-type-conventions.md: Card's single-key primary-key claim is a contextual heuristic, not a mandatory constraint (Ship-to Address, Customer/Vendor Bank Account are real composite-key Card pages); a Subsidiary table with its own identity commonly gets List+Card, not Worksheet/Tabular. - api-page-least-privilege-write-access.{md,good.al}: only page-placed fields are ever exposed; set InsertAllowed/DeleteAllowed=false in the good sample so a narrow field set can't still create/delete records. - source-organized-by-feature-not-object-type.md, test-one-when-per-test.md: scope as team/testing-design conventions, not Microsoft platform requirements. - upgrade-tag-logic-must-not-nest-deeply.md: add the Microsoft Learn citation that already backs the two-level nesting limit. - Wire the new articles into the testing/data-modeling/error-handling/ security/ui review skills' candidate-selection signals. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Address second round of Jesper Schulz-Wedde's review on PR #157 - log-writes-must-survive-rollback.good.al: fixed invalid trigger OnRun(var Rec: ...) declaration; Rec is implicit when TableNo is set. - exposed-objects-must-be-in-a-permission-set.md: distinguished the three exposure mechanisms (page/query web service or API, codeunit published as a web service, [ServiceEnabled] bound action on a page) and their actual permission targets (page/query "..." = X vs codeunit "..." = X). - code-must-not-change-workdate.md: scoped from an absolute "never" to "not as a side effect of unrelated logic" - verified real WorkDate(x) setter usage in BCApps demo-data generators and test codeunits. - bcpt-scenarios-must-be-app-specific.md: SingleInstance and StartScenario/EndScenario reframed as context-dependent patterns, not mandatory requirements - BCPT Create Customer uses neither. - test-feature-scenario-tags.good.al/.bad.al: replaced the invented LibrarySales.CreateCustomerWithPrice/"Item Price Mgt." calls with a real, verified price-list-line test using Library - Sales/Library - Inventory/ Library - Price Calculation. - page-design-must-match-bc-page-type-conventions.md: scoped the missing UsageCategory anti-pattern to pages intended as searchable entry points. - defensive-vs-offensive-code-must-match-blast-radius.md/.good.al/.bad.al: replaced the VAT registration number "low blast radius" example with a genuinely cosmetic field (customer home page URL). - source-organized-by-feature-not-object-type.md: anti-pattern reframed as inconsistency with a repo's own convention, not the object-type scheme itself. - pictures-must-use-media-not-blob.md: removed leftover "image variants" wording contradicting the already-corrected MediaSet description. Proactively fixed while sweeping all fixtures for invented APIs: - given-blocks-must-cover-full-precondition-chain.bad.al: PostSalesOrder called with wrong arity and referenced an undeclared variable. - ui-test-codeunit-naming.good.al/.bad.al: replaced the same fake "Item Price Mgt."/TestPage "Item Price" with real Library - Sales calls and the real Customer Card TestPage. Worklist completeness: added review-skill cues for the 12 of 18 new rules that had none (al-appsource-review.md, al-data-modeling-review.md, al-error-handling-review.md, al-security-review.md, al-style-review.md x3, al-testing-review.md x2, al-ui-review.md, al-upgrade-review.md, al-web-services-review.md), and fixed test-feature-scenario-tags' cue, which only matched the compliant (tagged) shape instead of the anti-pattern (untagged/generic-named test). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Fix ten focused correctness items plus sample links from Jesper's 2026-09-15 re-review Six carried-over threads: - api-page-least-privilege-write-access fixtures: added the mandatory EntityName/EntitySetName properties (AL0485). - pages-must-not-contain-business-logic fixtures: Sales Line has no "Total Amount" field; replaced with the real "Line Amount" (field 103). - test-feature-scenario-tags.good.al and test-one-when-per-test.good.al: CreatePriceHeader leaves a price list in Draft status, which price calculation ignores. Added Validate(Status, Active) + Modify before the sales line that depends on it. Verified Status field/enum against PriceListHeader.Table.al and PriceStatus.Enum.al in the BCApps clone. - exposed-objects-must-be-in-a-permission-set.md: a published codeunit is a SOAP endpoint (SOAP is deprecated), not OData - Page/Query are the OData object types. Corrected and pointed new integrations at API pages/queries instead. - al-error-handling-review.md: the log-writes-must-survive-rollback cue selected on Session.StartSession, which only appears in the compliant fix, never in the anti-pattern - the bad fixture could never be worklisted. Recued on the actual risk shape (log insert around a failed TryFunction/GetLastError* path, then raise/propagate), with StartSession as an explicit compliant discriminator instead. - page-design-must-match-bc-page-type-conventions.md: the enum value is NavigatePage, not Navigate; noted the type list is a selected subset, not an exhaustive PageType catalogue (PromptDialog, ConfigurationDialog, UserControlHost, XmlPort also exist, out of this article's scope). Four new correctness gaps: - release-must-update-app-version.md: "the version is the only identity" was backwards - id is the app's stable identity, version identifies a release/code-state of it. - defensive-vs-offensive-code-must-match-blast-radius.good.al: the "low blast radius" example had no else branch, so a failed Customer.Get() left the field at its prior/default value instead of the explicit chosen fallback the article claims to demonstrate. Added the else. - bcpt-scenarios-must-be-app-specific.good.al: InitTest and both measured StartScenario/EndScenario sections were empty/comment-only, so the "app-specific" fixture measured no actual work. Filled in a real, self-contained header+line creation path. - upgrade-tag-logic-must-not-nest-deeply.good.al: the flattened version dropped both safety conditions the bad fixture had (Discount % = 0, nonblank posting group), silently changing behavior instead of just removing nesting. Extracted the guarded update into a helper with both conditions preserved as early exits. Also converted this PR's remaining plain-backtick "See sample:" sample references (16 articles) to the READ-convention markdown-link form, matching the fix already made on #156/#158. Rebased onto upstream/main (conflicts in al-ui-review.md, al-style-review.md, al-upgrade-review.md against merged upstream PRs - all additive, both sides' worklist cues retained). * Fix four merge-critical issues from Jesper's 2026-09-22 review - pages-must-not-contain-business-logic.good.al/.bad.al: the "good" codeunit still directly assigned real Sales Line."Line Amount" and called Modify(), bypassing the field's normal Validate cascade (discount, VAT, related-amount maintenance) - persisting inconsistent document lines regardless of which object the code lived in. Replaced the real Sales Line example with a self-contained "Sample Order Line" table and switched the codeunit to Validate()/Modify(true), so the fixture demonstrates the page-vs-codeunit separation without teaching unsafe direct field writes to a real BC document table. - bcpt-scenarios-must-be-app-specific.good.al: Customer.FindFirst() assumed a pre-existing customer (fails against an empty environment), and a session-local NextNo counter for the header key collides across concurrent BCPT sessions and repeated runs. Creates its own customer when none exists, and generates keys from CreateGuid() instead of an in-memory counter. - upgrade-tag-logic-must-not-nest-deeply: the rule conflated two different things - nesting one tag's existence check inside another (the real anti-pattern Microsoft's guidance warns against) with having business-data safety conditions inside a single tagged migration's own loop body (which Microsoft's own worked example does, and its own design guidance explicitly requires: "Implement extra safety checks to avoid data corruption, even though you're using upgrade tags"). Rewrote the Description/Best Practice/Anti Pattern to scope the rule to actual tag nesting and migrations blended under one tag, and rewrote both fixtures: good.al now shows two safety conditions correctly nested inside one migration's own loop plus a second, genuinely separate migration as its own flat tagged procedure; bad.al now shows the real anti-pattern, one tag's check nested inside another's guarded body. - table-design-must-match-bc-table-type-conventions: the rule and its worklist cue fired on any new table with a keys block, forcing buffers, queues, logs, mapping tables, and staging tables into the nearest-looking one of nine business-record archetypes. Added an explicit scope note that these nine types aren't an exhaustive table catalogue, and narrowed the al-data-modeling-review.md cue to require positive evidence (a type-specific naming suffix, key shape, or usage) before worklisting, instead of a bare keys/primary-key declaration. * Narrow upgrade-tag nesting cue to match revised article Cue now flags only nested upgrade-tag checks or functionally unrelated migrations under one tag, and explicitly excludes record loops and business-data safety guards belonging to a single migration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Jesper Schulz-Wedde <jesper.schulzwedde@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
16 KiB
| kind | id | version | title | description | inputs | outputs | bc-version | technologies | countries | application-area | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| action-skill | al-data-modeling-review | 1 | AL data-modeling review | Performs an AL data-modeling review against guidance from BCQuality. |
|
|
|
|
|
|
AL data-modeling review
Reviews AL source changes against the data-modeling knowledge domain in BCQuality and emits a findings report. This is a leaf action skill: it invokes no sub-skills. It is one of the skills composed by al-code-review.
An orchestrator invokes this skill with a pr-diff, file-path, or folder-path. Data-modeling findings are narrow by design — they apply when the review scope contains setup or master tables, their card pages, primary keys, number-series assignment, block enforcement, audit fields, dimension wiring, journal-based posting-routine structure, or Item Ledger Entry document-number lookups after a combined sales post. The skill returns not-applicable when none of those apply.
Source
Use READ's Bounded retrieval for review skills workflow with -Domain data-modeling. Consume every catalog page across enabled layers before applying this leaf's Relevance and Worklist; preserve each exact catalog path and open complete bodies only for exact paths selected by the Worklist. If the helper or prepared index is unavailable or invalid, use READ's explicit path-discovery and bounded native-read fallback.
Relevance
Apply the frontmatter matching rules defined in READ (Frontmatter matching semantics) against the task context:
bc-version— the target BC version from the PR branch'sapp.jsonor the orchestrator-supplied version. If unavailable, the dimension isunknown.technologies—[al].countries— the countries declared in the consuming app'sapp.json. Default to the orchestrator's configured context; if absent,unknown.application-area— the union of application areas declared by the changed objects. Pass the actual set; do not substitute[all]. If the area cannot be determined from the changes, the dimension isunknown.
Discard files that are not applicable. Retain conditionally applicable files (any dimension unknown) only when the orchestrator's configuration permits them; findings derived from those files MUST have confidence no higher than medium, AND the finding's message MUST name the dimension or dimensions that were unknown.
Worklist
Narrow the relevant files to the subset that applies to the changes under review. For each relevant file, compute overlap against:
- The changed AL object names and types — especially
* Setupsingleton tables and Card pages, custom master tables, tableextensions that add master-data fields, and document or journal lines that reference a master. - The changed fields, keys, triggers, and procedures, weighted toward
Primary Key,No.,No. Series,Blocked,Last Date Modified,OnInsert,OnModify,OnRename, reference-fieldOnValidate, and posting validation. - Tokens extracted from the diff that relate to data modeling (
setup,master,Primary Key,Code[10],Code[20],AutoIncrement,SystemId,No.,No. Series,NoSeriesManagement,Codeunit "No. Series",GetNextNo,IsManual,TestManual,Blocked,TestField,Last Date Modified,Today,WorkDate,InsertAllowed,DeleteAllowed,PageType = Card,OnOpenPage,GetRecordOnce,OnInsert,OnModify,OnRename,InitRecord,Round,Precision,Direction,TableRelation,tableextension,enumextension,Media,MediaSet,Item,Count).
A file enters the candidate worklist when its keywords intersect the extracted tokens or its topic (derived from the index entry's path, title, and description) matches a changed object type. Read an article's full file — its ## Best Practice / ## Anti Pattern bodies — only after it makes the worklist; candidate selection uses the index alone. When the diff contains no data-modeling changes by any of the above signals, return outcome: "not-applicable" without evaluating files.
The following targeted checks cover every current data-modeling article. Treat each as a candidate-selection cue: when the signal appears in changed code, add the named article to the worklist and evaluate it in Action.
- A
* Setuptable or its page changes singleton structure, uses a nonblank or generated key, permits insert/delete, uses a List page, or does not ensure the blank-keyed row exists —setup-table-is-a-singleton. - A new field is typed
Media,MediaSet, orBLOBand the field's caption/name suggests a picture or image —pictures-must-use-media-not-blob. - Code outside a test codeunit or a demo-data generator calls
WorkDate(NewDate)(the assignment form, not a bareWorkDate()read) as part of logic whose purpose is unrelated to the work date itself —code-must-not-change-workdate. A test deliberately setting a date context, or a demo-data routine that saves, sets, and restores the work date to backdate the data it creates, is not this anti-pattern. - A new or extended table's name, fields, or usage positively establish it as one of Business Central's nine business-record types — a name ending
Ledger Entry/Register/Journal Line/Header/Line/Setup, an auto-generatedEntry No./No.key posted from elsewhere, aTemplate Name+Batch Name+Line No.key, or a singletonPrimary Keyfield —table-design-must-match-bc-table-type-conventions. Do not worklist it from a barekeysblock or primary-key declaration alone: a temporary/buffer table, a work queue, a log, a cross-reference/mapping table, or a process-local staging table is not one of the nine types and is out of this rule's scope entirely, not an unresolved case. - Code reads
Item Ledger Entry."Document No."(or"Last Shipping No."/"Last Posting No.") after a combined Ship+Invoice sales post —item-ledger-entry-document-no-follows-last-shipping-no. This is a sales-specific rule: purchase combined posting is Receive+Invoice and uses receiving fields such as"Last Receiving No.", not the shipment/document-number behavior this article describes. Do not worklist it from purchase posting code. - A custom master table changes its primary key,
No./No. Seriesfields, orOnInsertwithout assigning a blankNo.from setup through a number series —master-table-no-from-number-series-in-oninsert. - BC v22 or later code introduces or retains
NoSeriesManagement,InitSeries,SelectSeries, orSetSeries, or number assignment/manual-entry checks do not use codeunit"No. Series"methods such asGetNextNo,IsManual, orTestManual—use-no-series-codeunit-not-noseriesmanagement. - A master gains or changes
Blocked, or a document line, journal line, reference-fieldOnValidate, or posting routine uses that master withoutTestField(Blocked, false)at the point of use; also cue when the check is placed only in the master's own triggers —check-blocked-in-referencing-code-not-in-master. - A master table adds or changes
Last Date Modified,OnModify, orOnRename, but the non-editable field is not assignedToday()in both triggers —set-last-date-modified-in-onmodify-and-onrename. - A
tableextensionappends a conditionalTableRelationas if it overrides an earlier unconditional relation, or relation branches are otherwise designed without accounting for additive top-down evaluation —table-relation-extensions-are-additive-and-top-down. - A
MediaorMediaSetfield is assigned directly between different table types or different field IDs instead of registering each shared item withMediaSet.Insert—share-mediaset-items-with-insert-not-field-assignment. - A custom document header assigns defaults outside an
InitRecordboundary, callsInitRecordbefore assigning its number, or places UI-independent defaults only in a page trigger —initialize-document-defaults-in-initrecord. - Directed
Roundcalls use'<'as mathematical floor or'>'as mathematical ceiling, especially where negative amounts are possible —round-direction-symbols-use-magnitude. - A new field is typed
Code/Textand itsOnValidatecallsDimensionManagement/DimMgt, or a table adds Shortcut Dimension fields, aDimension Set IDfield, orAddDimSource/GetDefaultDimID—dimension-management-wiring. A master table callingSaveDefaultDimand a document/journal table computing its ownDimension Set IDare two different valid shapes; do not flag a master table for lacking aDimension Set IDfield or a document for lackingSaveDefaultDim. - A journal-based posting codeunit is added or changed and validation, Journal-table access, ledger writes, and user-interaction (
Confirm/dialogs) all occur in one procedure or one codeunit, rather than split acrossCheck Line/Post Line/Post Batch-shaped companions —check-post-line-batch-pattern. A document posting routine callingPost Linedirectly without aPost Batchcompanion is not this anti-pattern. - An existing, already-published table's
keysblock adds, removes, or reorders a field in its primary key or anyClustered = truekey —do-not-change-primary-key. A new table defining its own key for the first time is not this anti-pattern; requires repository/publication context to know the table has already shipped. - Code reads a setup/configuration-table field inside a branch that has already decided the value is required, and blank/zero is handled with a fallback to a default rather than
TestField/an equivalent guard —testfield-required-setup-field. A read that is genuinely optional in that branch, or one already guarded byTestField, is not this anti-pattern.
Once the candidate worklist is known, resolve layer-precedence conflicts per READ. Drop lower-precedence files whose normative guidance (## Best Practice or ## Anti Pattern) directly contradicts a higher-precedence candidate, and record each dropped file in suppressed with reason: "layer-precedence". Files that would have been candidates but are hidden because their layer is disabled in consumer configuration are recorded with reason: "configuration". Files that never became candidates are NOT recorded in suppressed.
When the post-conflict worklist is empty because no applicable data-modeling knowledge exists, or because configuration suppressed every candidate, emit outcome: "no-knowledge". When the worklist is empty because no applicable data-modeling knowledge matched the changes, emit outcome: "completed" with an empty findings array.
Action
For each worklist entry, evaluate the diff against the file's ## Best Practice and ## Anti Pattern sections. Emit findings as follows:
- When the diff contains a clear match for an Anti Pattern, emit a finding with severity
majororblocker, a message summarizing the anti-pattern,locationpointing to the offending line or range, and areferencesentry pointing to the knowledge file. Useblockeronly when the model can create ambiguous setup state, incompatible business identifiers, or silently stale synchronization data; otherwise the ceiling ismajor. - When the diff contains code that contradicts a Best Practice without being a full anti-pattern, emit
minorwith the same reference shape. - Applicability alone is not a finding. Emit
infoonly for a concrete, non-actionable observation the article explicitly defines; otherwise emit nothing when no violation is present.
Set confidence to:
highwhen the detection is based on an unambiguous pattern match (object type, field, key, trigger, or API name).mediumwhen detection relies on heuristics or when any frontmatter dimension wasunknown.lowwhen the finding is an advisory derived only from applicability.
After evaluating each worklist entry, also consider whether the diff exhibits a data-modeling defect the agent recognises from its general AL knowledge that no knowledge file in the worklist covers. Such candidates are agent findings within this skill's domain — emit them with references: [], an id slug prefixed with agent:, confidence capped at medium, severity capped at minor (agent findings are advisory and non-gating), and a message that is self-contained (describing both the issue and a concrete recommendation, since there is no knowledge-file footer for the consumer to fall back on). Hold every candidate to the precision bar in skills/do.md (Agent findings): emit only a concrete, material data-modeling defect a knowledgeable BC reviewer would agree is wrong — steelman it first and drop anything stylistic, speculative, dependent on code outside the diff, or merely a valid alternative; when in doubt, omit. The scope is strictly data modeling; defects outside this domain belong to other leaves and MUST NOT be emitted here. Before emitting, check the worklist for a knowledge file that matches the candidate — if one exists, upgrade the candidate to a knowledge-backed finding instead. See skills/do.md for the full contract.
For every emitted finding, decide whether the fix is mechanical. A fix is mechanical when it is small, local, and unambiguous from the diff context (for example: add InsertAllowed = false or DeleteAllowed = false; replace WorkDate() with Today(); add the same audit-field assignment to OnRename; or replace an obsolete number-series codeunit declaration). For mechanical findings, emit findings[].suggested-code with the literal replacement for the source lines indicated by location. The payload must be a verbatim replacement — no diff markers, no fences, no commentary — that the consumer can render as a one-click suggestion. When a .good.al companion exists and the diff context matches the .bad.al shape, adapt the .good.al replacement into suggested-code.
Omit suggested-code only when the appropriate fix depends on context the skill cannot determine, when multiple defensible replacements exist, or when the fix spans non-contiguous code. If a finding is mechanical-looking but you omit suggested-code, set findings[].suggested-code-omission-reason to a short explanation. See skills/do.md for the full contract.
Outcome selection:
completed— the skill evaluated every worklist item.no-knowledge— no applicable data-modeling knowledge survived filtering.not-applicable— the diff touches no setup/master table, page, key, numbering, block-check, audit-field, dimension-wiring, posting-routine-structure, or Item-Ledger-Entry-document-number surface.partial— a budget was hit before the worklist was exhausted.failed— an unrecoverable error occurred.
Output
Output conforms to the DO output contract. Every finding this skill emits MUST set findings[].domain to "Data Modeling". A populated example:
{
"skill": { "id": "al-data-modeling-review", "version": 1 },
"outcome": "completed",
"summary": {
"counts": { "blocker": 0, "major": 1, "minor": 0, "info": 0 },
"coverage": { "worklist-size": 1, "items-evaluated": 1 }
},
"findings": [
{
"id": "microsoft/knowledge/data-modeling/set-last-date-modified-in-onmodify-and-onrename.md",
"severity": "major",
"message": "The table updates Last Date Modified in OnModify but not OnRename, so renaming the primary key leaves the audit date stale and can hide the record from incremental integrations.",
"location": {
"file": "src/LoyaltyMember.Table.al",
"line": 74
},
"references": [
{ "path": "microsoft/knowledge/data-modeling/set-last-date-modified-in-onmodify-and-onrename.md" }
],
"confidence": "high",
"domain": "Data Modeling",
"suggested-code": "trigger OnRename()\nbegin\n \"Last Date Modified\" := Today();\nend;"
}
],
"suppressed": []
}
The empty-corpus case produces:
{
"skill": { "id": "al-data-modeling-review", "version": 1 },
"outcome": "no-knowledge",
"summary": {
"counts": { "blocker": 0, "major": 0, "minor": 0, "info": 0 },
"coverage": { "worklist-size": 0, "items-evaluated": 0 }
},
"findings": [],
"suppressed": []
}