[fullsend-ai-coder]

What:

Add undefined-propagation completeness guidance to AGENTS.md in two places:

1. Rego Evaluation Model section — new "Undefined propagation" bullet explaining that accessing a missing or wrong-typed field causes a rule body to silently produce no result, effectively bypassing the policy check.

2. Review Checklist for New Policy Rules — new "Undefined-propagation completeness" checklist item with concrete guidance to verify rule behavior under (a) missing fields, (b) wrong-typed fields, and (c) malformed internal structure. References is_object/is_array/is_string guards and PR fix(EC-2235): reject malformed Pipeline and Task values #1871 examples (malformed_params, _malformed_workspaces, input_format).

Why:

PR #1871 exposed 4 undefined-propagation gaps in a single PR, all caught by a human reviewer and missed by automated review. The existing Rego Evaluation Model section (added per #1757) covers Rego semantics but does not warn about the inverse problem: false negatives from undefined propagation. This change extends both the conceptual guidance and the review checklist to cover this failure mode, following the established pattern of prior review-checklist issues (#1760, #1799, #1801, #1802).

Tickets:

• Add undefined-propagation completeness check to AGENTS.md review checklist #1946

---

Closes #1946

Post-script verification

• Branch is not main/master (agent/1946-undefined-propagation-checklist)
• Secret scan passed (gitleaks — fe20bff24b1cafdbcb92b004dacada2ea94ee825..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Final PR description secret scan passed (gitleaks — no-git)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3f612bdd-5008-457a-8b69-84f6f8db90da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

---

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

---

Powered by Qodo

[qodo-for-conforma]

PR Summary by Qodo

Document Rego undefined-propagation risks in policy reviews

📝 Documentation 🕐 Less than 10 minutes

---

AI Description

• Explain how undefined propagation can silently bypass Rego policy checks.
• Add a review checklist for missing, wrong-typed, and malformed input, with mitigation examples.

Diagram

graph TD
  A["Rego semantics"] --> B["Review checklist"] --> C{"Input malformed?"} -->|yes| D["Guard or validate"] --> E["Policy behavior"]
  F["New policy rule"] --> B
  C -->|no| E

Loading

High-Level Assessment

Adding both a semantic explanation and an actionable checklist item fits the existing AGENTS.md review guidance. A separate document would make this check less visible during policy-rule review.

Files changed (1) +15 / -0

Documentation (1) +15 / -0

AGENTS.mdAdd undefined-propagation guidance for Rego reviewers +15/-0

Add undefined-propagation guidance for Rego reviewers

• Explains that missing or wrong-typed field access can silently leave a rule body without a result. Adds a checklist to examine missing fields, unexpected types, and malformed structures in new deny/warn rules, with guard and validation options and references to PR #1871.

AGENTS.md

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 2:26 PM UTC

Commit: 2d9a94f · View workflow run →

[fullsend-ai-review]

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

A minimal docs-only bot PR adding 15 lines to AGENTS.md scores moderate (2) because AGENTS.md is a protected path with high multi-author contention (9 authors in 90d) and change-coupling history, slightly elevating risk above low despite the tiny, trivially-reversible nature of the change.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] AGENTS.md — This PR modifies AGENTS.md, a protected governance file. The PR links to issue Add undefined-propagation completeness check to AGENTS.md review checklist #1946 and provides clear rationale for the change (adding undefined-propagation guidance per review gap identified in PR fix(EC-2235): reject malformed Pipeline and Task values #1871). Human approval is always required for protected-path changes, regardless of context.

---

Labels: Documentation-only PR modifying AGENTS.md, matching the consistent labeling pattern for AGENTS.md documentation issues.

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->