Make 'never APPROVE' rule prominent in expert-reviewer prompt

[Amaury Levé (Evangelink)]

Symptom

When the Expert Code Review (on open) workflow ran on PR #8220, the agent successfully reviewed the change but tried to submit it with event: APPROVE. The safe-outputs filter (allowed-events: [COMMENT, REQUEST_CHANGES]) correctly rejected it, and the whole safe_outputs job failed:

https://github.com/microsoft/testfx/actions/runs/25860787433/job/75991405833

##[warning]Review event 'APPROVE' is not allowed. Allowed events: COMMENT, REQUEST_CHANGES
##[error]✗ Message 2 (submit_pull_request_review) failed: Review event 'APPROVE' is not allowed by safe-outputs configuration. Allowed events: COMMENT, REQUEST_CHANGES
##[error]1 safe output(s) failed

The verdict summary table — and all inline review comments bundled into that submit_pull_request_review call — were dropped on the floor as a side effect.

Root cause

submit-pull-request-review.allowed-events: [COMMENT, REQUEST_CHANGES] is intentional: this agent must not be able to count as a PR approval. The agent's prompt does say Never use APPROVE, but the rule sits ~630 lines into .github/agents/expert-reviewer.agent.md, well after 21 dimension definitions and a four-wave workflow. The model didn't carry it through to the final tool call.

Fix

Reinforce the constraint in three places to make it impossible to miss:

1. .github/agents/expert-reviewer.agent.md — Add an Absolute Rules (read first, must never be violated) section right under the title. Rule Initial commit! 🎉 #1 explicitly forbids event: ""APPROVE"" and spells out the consequence (entire review, including bundled inline comments, is dropped).
2. .github/agents/expert-reviewer.agent.md — Strengthen the existing Wave 4 step-6 reminder with a stop sign and a back-reference to the Absolute Rules section, and re-emphasise that the all-clear case is COMMENT (not APPROVE).
3. .github/workflows/shared/review-shared.md — Instruct the launcher agent to forward the same constraint to the subagent's prompt when it spawns it.

Both files are imported at runtime via gh-aw {{#runtime-import}} (verified in the lock files), so no lock-file regeneration is required and the diff is purely the two .md files. gh aw compile was still run to verify there are no warnings.

We deliberately do not add APPROVE to allowed-events — the safe-outputs filter is doing exactly what it was configured to do, and the security model (no automated approvals) should stay intact.

[Copilot]

Pull request overview

This PR reinforces the expert-review workflow’s no-automated-approval rule so reviews are submitted only as comments or change requests, preserving the intended safe-outputs security model.

Changes:

• Adds prominent “Absolute Rules” to the expert reviewer prompt forbidding APPROVE.
• Strengthens the final submission reminder to use COMMENT for clean reviews.
• Updates the shared launcher instructions to pass the same constraint to the background reviewer agent.

Show a summary per file

File	Description
.github/agents/expert-reviewer.agent.md	Adds and reinforces prompt rules preventing APPROVE review submissions.
.github/workflows/shared/review-shared.md	Updates launcher instructions to remind the subagent about allowed review events.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Amaury Levé (Evangelink)]

Expert Review — PR #8221

All 21 review dimensions assessed. No findings.

#	Dimension	Status
1	Backward Compatibility	✅ N/A — no code
2	Public API Surface	✅ N/A — no code
3	Correctness / Logic	✅ Fix accurately targets the root cause
4	Test Coverage	✅ N/A — documentation change
5	Performance	✅ N/A
6	Security	✅ Security model preserved — APPROVE remains blocked
7	Error Handling	✅ N/A
8	Null Safety	✅ N/A
9	Threading / Concurrency	✅ N/A
10	Resource Management	✅ N/A
11	Localization	✅ N/A
12	Logging / Telemetry	✅ N/A
13	Naming / Style	✅ Clear, consistent phrasing
14	Code Duplication	✅ Intentional repetition across three locations to reinforce the rule
15	Complexity	✅ Simple, targeted changes
16	Documentation	✅ This IS the documentation; wording is precise and unambiguous
17	Build / CI	✅ No lock-file changes required (runtime-import confirmed)
18	Dependencies	✅ N/A
19	Serialization	✅ N/A
20	Observability	✅ N/A
21	Design Consistency	✅ Follows existing agent-prompt conventions

All clear. The fix is well-structured — placing the constraint in an "Absolute Rules" section at the very top of the file is the right approach for prompt-level constraints that must survive a long context window. The stop-sign (⛔) in Wave 4 and the forwarding instruction in review-shared.md provide effective belt-and-suspenders reinforcement.

Generated by Expert Code Review (on open) for issue #8221 · ● 2.8M

[Amaury Levé (Evangelink)]

Symptom

When the Expert Code Review (on open) workflow ran on PR #8220, the agent successfully reviewed the change but tried to submit it with event: APPROVE. The safe-outputs filter (allowed-events: [COMMENT, REQUEST_CHANGES]) correctly rejected it, and the whole safe_outputs job failed:

https://github.com/microsoft/testfx/actions/runs/25860787433/job/75991405833

##[warning]Review event 'APPROVE' is not allowed. Allowed events: COMMENT, REQUEST_CHANGES
##[error]✗ Message 2 (submit_pull_request_review) failed: Review event 'APPROVE' is not allowed by safe-outputs configuration. Allowed events: COMMENT, REQUEST_CHANGES
##[error]1 safe output(s) failed

The verdict summary table — and all inline review comments bundled into that submit_pull_request_review call — were dropped on the floor as a side effect.

Root cause

submit-pull-request-review.allowed-events: [COMMENT, REQUEST_CHANGES] is intentional: this agent must not be able to count as a PR approval. The agent's prompt does say Never use APPROVE, but the rule sits ~630 lines into .github/agents/expert-reviewer.agent.md, well after 21 dimension definitions and a four-wave workflow. The model didn't carry it through to the final tool call.

Fix

Reinforce the constraint in three places to make it impossible to miss:

1. .github/agents/expert-reviewer.agent.md — Add an Absolute Rules (read first, must never be violated) section right under the title. Rule Initial commit! 🎉 #1 explicitly forbids event: ""APPROVE"" and spells out the consequence (entire review, including bundled inline comments, is dropped).
2. .github/agents/expert-reviewer.agent.md — Strengthen the existing Wave 4 step-6 reminder with a stop sign and a back-reference to the Absolute Rules section, and re-emphasise that the all-clear case is COMMENT (not APPROVE).
3. .github/workflows/shared/review-shared.md — Instruct the launcher agent to forward the same constraint to the subagent's prompt when it spawns it.

Both files are imported at runtime via gh-aw {{#runtime-import}} (verified in the lock files), so no lock-file regeneration is required and the diff is purely the two .md files. gh aw compile was still run to verify there are no warnings.

We deliberately do not add APPROVE to allowed-events — the safe-outputs filter is doing exactly what it was configured to do, and the security model (no automated approvals) should stay intact.

[Copilot]

Pull request overview

This PR reinforces the expert-review workflow’s no-automated-approval rule so reviews are submitted only as comments or change requests, preserving the intended safe-outputs security model.

Changes:

• Adds prominent “Absolute Rules” to the expert reviewer prompt forbidding APPROVE.
• Strengthens the final submission reminder to use COMMENT for clean reviews.
• Updates the shared launcher instructions to pass the same constraint to the background reviewer agent.

Show a summary per file

File	Description
.github/agents/expert-reviewer.agent.md	Adds and reinforces prompt rules preventing APPROVE review submissions.
.github/workflows/shared/review-shared.md	Updates launcher instructions to remind the subagent about allowed review events.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Amaury Levé (Evangelink)]

Expert Review — PR #8221

All 21 review dimensions assessed. No findings.

#	Dimension	Status
1	Backward Compatibility	✅ N/A — no code
2	Public API Surface	✅ N/A — no code
3	Correctness / Logic	✅ Fix accurately targets the root cause
4	Test Coverage	✅ N/A — documentation change
5	Performance	✅ N/A
6	Security	✅ Security model preserved — APPROVE remains blocked
7	Error Handling	✅ N/A
8	Null Safety	✅ N/A
9	Threading / Concurrency	✅ N/A
10	Resource Management	✅ N/A
11	Localization	✅ N/A
12	Logging / Telemetry	✅ N/A
13	Naming / Style	✅ Clear, consistent phrasing
14	Code Duplication	✅ Intentional repetition across three locations to reinforce the rule
15	Complexity	✅ Simple, targeted changes
16	Documentation	✅ This IS the documentation; wording is precise and unambiguous
17	Build / CI	✅ No lock-file changes required (runtime-import confirmed)
18	Dependencies	✅ N/A
19	Serialization	✅ N/A
20	Observability	✅ N/A
21	Design Consistency	✅ Follows existing agent-prompt conventions

All clear. The fix is well-structured — placing the constraint in an "Absolute Rules" section at the very top of the file is the right approach for prompt-level constraints that must survive a long context window. The stop-sign (⛔) in Wave 4 and the forwarding instruction in review-shared.md provide effective belt-and-suspenders reinforcement.

Generated by Expert Code Review (on open) for issue #8221 · ● 2.8M

[Amaury Levé (Evangelink)]

Symptom

When the Expert Code Review (on open) workflow ran on PR #8220, the agent successfully reviewed the change but tried to submit it with event: APPROVE. The safe-outputs filter (allowed-events: [COMMENT, REQUEST_CHANGES]) correctly rejected it, and the whole safe_outputs job failed:

https://github.com/microsoft/testfx/actions/runs/25860787433/job/75991405833

##[warning]Review event 'APPROVE' is not allowed. Allowed events: COMMENT, REQUEST_CHANGES
##[error]✗ Message 2 (submit_pull_request_review) failed: Review event 'APPROVE' is not allowed by safe-outputs configuration. Allowed events: COMMENT, REQUEST_CHANGES
##[error]1 safe output(s) failed

The verdict summary table — and all inline review comments bundled into that submit_pull_request_review call — were dropped on the floor as a side effect.

Root cause

submit-pull-request-review.allowed-events: [COMMENT, REQUEST_CHANGES] is intentional: this agent must not be able to count as a PR approval. The agent's prompt does say Never use APPROVE, but the rule sits ~630 lines into .github/agents/expert-reviewer.agent.md, well after 21 dimension definitions and a four-wave workflow. The model didn't carry it through to the final tool call.

Fix

Reinforce the constraint in three places to make it impossible to miss:

1. .github/agents/expert-reviewer.agent.md — Add an Absolute Rules (read first, must never be violated) section right under the title. Rule Initial commit! 🎉 #1 explicitly forbids event: ""APPROVE"" and spells out the consequence (entire review, including bundled inline comments, is dropped).
2. .github/agents/expert-reviewer.agent.md — Strengthen the existing Wave 4 step-6 reminder with a stop sign and a back-reference to the Absolute Rules section, and re-emphasise that the all-clear case is COMMENT (not APPROVE).
3. .github/workflows/shared/review-shared.md — Instruct the launcher agent to forward the same constraint to the subagent's prompt when it spawns it.

Both files are imported at runtime via gh-aw {{#runtime-import}} (verified in the lock files), so no lock-file regeneration is required and the diff is purely the two .md files. gh aw compile was still run to verify there are no warnings.

We deliberately do not add APPROVE to allowed-events — the safe-outputs filter is doing exactly what it was configured to do, and the security model (no automated approvals) should stay intact.

[Copilot]

Pull request overview

This PR reinforces the expert-review workflow’s no-automated-approval rule so reviews are submitted only as comments or change requests, preserving the intended safe-outputs security model.

Changes:

• Adds prominent “Absolute Rules” to the expert reviewer prompt forbidding APPROVE.
• Strengthens the final submission reminder to use COMMENT for clean reviews.
• Updates the shared launcher instructions to pass the same constraint to the background reviewer agent.

Show a summary per file

File	Description
.github/agents/expert-reviewer.agent.md	Adds and reinforces prompt rules preventing APPROVE review submissions.
.github/workflows/shared/review-shared.md	Updates launcher instructions to remind the subagent about allowed review events.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Amaury Levé (Evangelink)]

Expert Review — PR #8221

All 21 review dimensions assessed. No findings.

#	Dimension	Status
1	Backward Compatibility	✅ N/A — no code
2	Public API Surface	✅ N/A — no code
3	Correctness / Logic	✅ Fix accurately targets the root cause
4	Test Coverage	✅ N/A — documentation change
5	Performance	✅ N/A
6	Security	✅ Security model preserved — APPROVE remains blocked
7	Error Handling	✅ N/A
8	Null Safety	✅ N/A
9	Threading / Concurrency	✅ N/A
10	Resource Management	✅ N/A
11	Localization	✅ N/A
12	Logging / Telemetry	✅ N/A
13	Naming / Style	✅ Clear, consistent phrasing
14	Code Duplication	✅ Intentional repetition across three locations to reinforce the rule
15	Complexity	✅ Simple, targeted changes
16	Documentation	✅ This IS the documentation; wording is precise and unambiguous
17	Build / CI	✅ No lock-file changes required (runtime-import confirmed)
18	Dependencies	✅ N/A
19	Serialization	✅ N/A
20	Observability	✅ N/A
21	Design Consistency	✅ Follows existing agent-prompt conventions

All clear. The fix is well-structured — placing the constraint in an "Absolute Rules" section at the very top of the file is the right approach for prompt-level constraints that must survive a long context window. The stop-sign (⛔) in Wave 4 and the forwarding instruction in review-shared.md provide effective belt-and-suspenders reinforcement.

Generated by Expert Code Review (on open) for issue #8221 · ● 2.8M

[Amaury Levé (Evangelink)]

Symptom

When the Expert Code Review (on open) workflow ran on PR #8220, the agent successfully reviewed the change but tried to submit it with event: APPROVE. The safe-outputs filter (allowed-events: [COMMENT, REQUEST_CHANGES]) correctly rejected it, and the whole safe_outputs job failed:

https://github.com/microsoft/testfx/actions/runs/25860787433/job/75991405833

##[warning]Review event 'APPROVE' is not allowed. Allowed events: COMMENT, REQUEST_CHANGES
##[error]✗ Message 2 (submit_pull_request_review) failed: Review event 'APPROVE' is not allowed by safe-outputs configuration. Allowed events: COMMENT, REQUEST_CHANGES
##[error]1 safe output(s) failed

The verdict summary table — and all inline review comments bundled into that submit_pull_request_review call — were dropped on the floor as a side effect.

Root cause

submit-pull-request-review.allowed-events: [COMMENT, REQUEST_CHANGES] is intentional: this agent must not be able to count as a PR approval. The agent's prompt does say Never use APPROVE, but the rule sits ~630 lines into .github/agents/expert-reviewer.agent.md, well after 21 dimension definitions and a four-wave workflow. The model didn't carry it through to the final tool call.

Fix

Reinforce the constraint in three places to make it impossible to miss:

1. .github/agents/expert-reviewer.agent.md — Add an Absolute Rules (read first, must never be violated) section right under the title. Rule Initial commit! 🎉 #1 explicitly forbids event: ""APPROVE"" and spells out the consequence (entire review, including bundled inline comments, is dropped).
2. .github/agents/expert-reviewer.agent.md — Strengthen the existing Wave 4 step-6 reminder with a stop sign and a back-reference to the Absolute Rules section, and re-emphasise that the all-clear case is COMMENT (not APPROVE).
3. .github/workflows/shared/review-shared.md — Instruct the launcher agent to forward the same constraint to the subagent's prompt when it spawns it.

Both files are imported at runtime via gh-aw {{#runtime-import}} (verified in the lock files), so no lock-file regeneration is required and the diff is purely the two .md files. gh aw compile was still run to verify there are no warnings.

We deliberately do not add APPROVE to allowed-events — the safe-outputs filter is doing exactly what it was configured to do, and the security model (no automated approvals) should stay intact.

[Copilot]

Pull request overview

This PR reinforces the expert-review workflow’s no-automated-approval rule so reviews are submitted only as comments or change requests, preserving the intended safe-outputs security model.

Changes:

• Adds prominent “Absolute Rules” to the expert reviewer prompt forbidding APPROVE.
• Strengthens the final submission reminder to use COMMENT for clean reviews.
• Updates the shared launcher instructions to pass the same constraint to the background reviewer agent.

Show a summary per file

File	Description
.github/agents/expert-reviewer.agent.md	Adds and reinforces prompt rules preventing APPROVE review submissions.
.github/workflows/shared/review-shared.md	Updates launcher instructions to remind the subagent about allowed review events.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Amaury Levé (Evangelink)]

Expert Review — PR #8221

All 21 review dimensions assessed. No findings.

#	Dimension	Status
1	Backward Compatibility	✅ N/A — no code
2	Public API Surface	✅ N/A — no code
3	Correctness / Logic	✅ Fix accurately targets the root cause
4	Test Coverage	✅ N/A — documentation change
5	Performance	✅ N/A
6	Security	✅ Security model preserved — APPROVE remains blocked
7	Error Handling	✅ N/A
8	Null Safety	✅ N/A
9	Threading / Concurrency	✅ N/A
10	Resource Management	✅ N/A
11	Localization	✅ N/A
12	Logging / Telemetry	✅ N/A
13	Naming / Style	✅ Clear, consistent phrasing
14	Code Duplication	✅ Intentional repetition across three locations to reinforce the rule
15	Complexity	✅ Simple, targeted changes
16	Documentation	✅ This IS the documentation; wording is precise and unambiguous
17	Build / CI	✅ No lock-file changes required (runtime-import confirmed)
18	Dependencies	✅ N/A
19	Serialization	✅ N/A
20	Observability	✅ N/A
21	Design Consistency	✅ Follows existing agent-prompt conventions

All clear. The fix is well-structured — placing the constraint in an "Absolute Rules" section at the very top of the file is the right approach for prompt-level constraints that must survive a long context window. The stop-sign (⛔) in Wave 4 and the forwarding instruction in review-shared.md provide effective belt-and-suspenders reinforcement.

Generated by Expert Code Review (on open) for issue #8221 · ● 2.8M

[Amaury Levé (Evangelink)]

Symptom

When the Expert Code Review (on open) workflow ran on PR #8220, the agent successfully reviewed the change but tried to submit it with event: APPROVE. The safe-outputs filter (allowed-events: [COMMENT, REQUEST_CHANGES]) correctly rejected it, and the whole safe_outputs job failed:

https://github.com/microsoft/testfx/actions/runs/25860787433/job/75991405833

##[warning]Review event 'APPROVE' is not allowed. Allowed events: COMMENT, REQUEST_CHANGES
##[error]✗ Message 2 (submit_pull_request_review) failed: Review event 'APPROVE' is not allowed by safe-outputs configuration. Allowed events: COMMENT, REQUEST_CHANGES
##[error]1 safe output(s) failed

The verdict summary table — and all inline review comments bundled into that submit_pull_request_review call — were dropped on the floor as a side effect.

Root cause

submit-pull-request-review.allowed-events: [COMMENT, REQUEST_CHANGES] is intentional: this agent must not be able to count as a PR approval. The agent's prompt does say Never use APPROVE, but the rule sits ~630 lines into .github/agents/expert-reviewer.agent.md, well after 21 dimension definitions and a four-wave workflow. The model didn't carry it through to the final tool call.

Fix

Reinforce the constraint in three places to make it impossible to miss:

1. .github/agents/expert-reviewer.agent.md — Add an Absolute Rules (read first, must never be violated) section right under the title. Rule Initial commit! 🎉 #1 explicitly forbids event: ""APPROVE"" and spells out the consequence (entire review, including bundled inline comments, is dropped).
2. .github/agents/expert-reviewer.agent.md — Strengthen the existing Wave 4 step-6 reminder with a stop sign and a back-reference to the Absolute Rules section, and re-emphasise that the all-clear case is COMMENT (not APPROVE).
3. .github/workflows/shared/review-shared.md — Instruct the launcher agent to forward the same constraint to the subagent's prompt when it spawns it.

Both files are imported at runtime via gh-aw {{#runtime-import}} (verified in the lock files), so no lock-file regeneration is required and the diff is purely the two .md files. gh aw compile was still run to verify there are no warnings.

We deliberately do not add APPROVE to allowed-events — the safe-outputs filter is doing exactly what it was configured to do, and the security model (no automated approvals) should stay intact.

[Copilot]

Pull request overview

This PR reinforces the expert-review workflow’s no-automated-approval rule so reviews are submitted only as comments or change requests, preserving the intended safe-outputs security model.

Changes:

• Adds prominent “Absolute Rules” to the expert reviewer prompt forbidding APPROVE.
• Strengthens the final submission reminder to use COMMENT for clean reviews.
• Updates the shared launcher instructions to pass the same constraint to the background reviewer agent.

Show a summary per file

File	Description
.github/agents/expert-reviewer.agent.md	Adds and reinforces prompt rules preventing APPROVE review submissions.
.github/workflows/shared/review-shared.md	Updates launcher instructions to remind the subagent about allowed review events.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Amaury Levé (Evangelink)]

Expert Review — PR #8221

All 21 review dimensions assessed. No findings.

#	Dimension	Status
1	Backward Compatibility	✅ N/A — no code
2	Public API Surface	✅ N/A — no code
3	Correctness / Logic	✅ Fix accurately targets the root cause
4	Test Coverage	✅ N/A — documentation change
5	Performance	✅ N/A
6	Security	✅ Security model preserved — APPROVE remains blocked
7	Error Handling	✅ N/A
8	Null Safety	✅ N/A
9	Threading / Concurrency	✅ N/A
10	Resource Management	✅ N/A
11	Localization	✅ N/A
12	Logging / Telemetry	✅ N/A
13	Naming / Style	✅ Clear, consistent phrasing
14	Code Duplication	✅ Intentional repetition across three locations to reinforce the rule
15	Complexity	✅ Simple, targeted changes
16	Documentation	✅ This IS the documentation; wording is precise and unambiguous
17	Build / CI	✅ No lock-file changes required (runtime-import confirmed)
18	Dependencies	✅ N/A
19	Serialization	✅ N/A
20	Observability	✅ N/A
21	Design Consistency	✅ Follows existing agent-prompt conventions

All clear. The fix is well-structured — placing the constraint in an "Absolute Rules" section at the very top of the file is the right approach for prompt-level constraints that must survive a long context window. The stop-sign (⛔) in Wave 4 and the forwarding instruction in review-shared.md provide effective belt-and-suspenders reinforcement.

Generated by Expert Code Review (on open) for issue #8221 · ● 2.8M

[Amaury Levé (Evangelink)]

Symptom

When the Expert Code Review (on open) workflow ran on PR #8220, the agent successfully reviewed the change but tried to submit it with event: APPROVE. The safe-outputs filter (allowed-events: [COMMENT, REQUEST_CHANGES]) correctly rejected it, and the whole safe_outputs job failed:

https://github.com/microsoft/testfx/actions/runs/25860787433/job/75991405833

##[warning]Review event 'APPROVE' is not allowed. Allowed events: COMMENT, REQUEST_CHANGES
##[error]✗ Message 2 (submit_pull_request_review) failed: Review event 'APPROVE' is not allowed by safe-outputs configuration. Allowed events: COMMENT, REQUEST_CHANGES
##[error]1 safe output(s) failed

The verdict summary table — and all inline review comments bundled into that submit_pull_request_review call — were dropped on the floor as a side effect.

Root cause

submit-pull-request-review.allowed-events: [COMMENT, REQUEST_CHANGES] is intentional: this agent must not be able to count as a PR approval. The agent's prompt does say Never use APPROVE, but the rule sits ~630 lines into .github/agents/expert-reviewer.agent.md, well after 21 dimension definitions and a four-wave workflow. The model didn't carry it through to the final tool call.

Fix

Reinforce the constraint in three places to make it impossible to miss:

1. .github/agents/expert-reviewer.agent.md — Add an Absolute Rules (read first, must never be violated) section right under the title. Rule Initial commit! 🎉 #1 explicitly forbids event: ""APPROVE"" and spells out the consequence (entire review, including bundled inline comments, is dropped).
2. .github/agents/expert-reviewer.agent.md — Strengthen the existing Wave 4 step-6 reminder with a stop sign and a back-reference to the Absolute Rules section, and re-emphasise that the all-clear case is COMMENT (not APPROVE).
3. .github/workflows/shared/review-shared.md — Instruct the launcher agent to forward the same constraint to the subagent's prompt when it spawns it.

Both files are imported at runtime via gh-aw {{#runtime-import}} (verified in the lock files), so no lock-file regeneration is required and the diff is purely the two .md files. gh aw compile was still run to verify there are no warnings.

We deliberately do not add APPROVE to allowed-events — the safe-outputs filter is doing exactly what it was configured to do, and the security model (no automated approvals) should stay intact.

[Copilot]

Pull request overview

This PR reinforces the expert-review workflow’s no-automated-approval rule so reviews are submitted only as comments or change requests, preserving the intended safe-outputs security model.

Changes:

• Adds prominent “Absolute Rules” to the expert reviewer prompt forbidding APPROVE.
• Strengthens the final submission reminder to use COMMENT for clean reviews.
• Updates the shared launcher instructions to pass the same constraint to the background reviewer agent.

Show a summary per file

File	Description
.github/agents/expert-reviewer.agent.md	Adds and reinforces prompt rules preventing APPROVE review submissions.
.github/workflows/shared/review-shared.md	Updates launcher instructions to remind the subagent about allowed review events.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Amaury Levé (Evangelink)]

Expert Review — PR #8221

All 21 review dimensions assessed. No findings.

#	Dimension	Status
1	Backward Compatibility	✅ N/A — no code
2	Public API Surface	✅ N/A — no code
3	Correctness / Logic	✅ Fix accurately targets the root cause
4	Test Coverage	✅ N/A — documentation change
5	Performance	✅ N/A
6	Security	✅ Security model preserved — APPROVE remains blocked
7	Error Handling	✅ N/A
8	Null Safety	✅ N/A
9	Threading / Concurrency	✅ N/A
10	Resource Management	✅ N/A
11	Localization	✅ N/A
12	Logging / Telemetry	✅ N/A
13	Naming / Style	✅ Clear, consistent phrasing
14	Code Duplication	✅ Intentional repetition across three locations to reinforce the rule
15	Complexity	✅ Simple, targeted changes
16	Documentation	✅ This IS the documentation; wording is precise and unambiguous
17	Build / CI	✅ No lock-file changes required (runtime-import confirmed)
18	Dependencies	✅ N/A
19	Serialization	✅ N/A
20	Observability	✅ N/A
21	Design Consistency	✅ Follows existing agent-prompt conventions

All clear. The fix is well-structured — placing the constraint in an "Absolute Rules" section at the very top of the file is the right approach for prompt-level constraints that must survive a long context window. The stop-sign (⛔) in Wave 4 and the forwarding instruction in review-shared.md provide effective belt-and-suspenders reinforcement.

Generated by Expert Code Review (on open) for issue #8221 · ● 2.8M

[Amaury Levé (Evangelink)]

Symptom

When the Expert Code Review (on open) workflow ran on PR #8220, the agent successfully reviewed the change but tried to submit it with event: APPROVE. The safe-outputs filter (allowed-events: [COMMENT, REQUEST_CHANGES]) correctly rejected it, and the whole safe_outputs job failed:

https://github.com/microsoft/testfx/actions/runs/25860787433/job/75991405833

##[warning]Review event 'APPROVE' is not allowed. Allowed events: COMMENT, REQUEST_CHANGES
##[error]✗ Message 2 (submit_pull_request_review) failed: Review event 'APPROVE' is not allowed by safe-outputs configuration. Allowed events: COMMENT, REQUEST_CHANGES
##[error]1 safe output(s) failed

The verdict summary table — and all inline review comments bundled into that submit_pull_request_review call — were dropped on the floor as a side effect.

Root cause

submit-pull-request-review.allowed-events: [COMMENT, REQUEST_CHANGES] is intentional: this agent must not be able to count as a PR approval. The agent's prompt does say Never use APPROVE, but the rule sits ~630 lines into .github/agents/expert-reviewer.agent.md, well after 21 dimension definitions and a four-wave workflow. The model didn't carry it through to the final tool call.

Fix

Reinforce the constraint in three places to make it impossible to miss:

1. .github/agents/expert-reviewer.agent.md — Add an Absolute Rules (read first, must never be violated) section right under the title. Rule Initial commit! 🎉 #1 explicitly forbids event: ""APPROVE"" and spells out the consequence (entire review, including bundled inline comments, is dropped).
2. .github/agents/expert-reviewer.agent.md — Strengthen the existing Wave 4 step-6 reminder with a stop sign and a back-reference to the Absolute Rules section, and re-emphasise that the all-clear case is COMMENT (not APPROVE).
3. .github/workflows/shared/review-shared.md — Instruct the launcher agent to forward the same constraint to the subagent's prompt when it spawns it.

Both files are imported at runtime via gh-aw {{#runtime-import}} (verified in the lock files), so no lock-file regeneration is required and the diff is purely the two .md files. gh aw compile was still run to verify there are no warnings.

We deliberately do not add APPROVE to allowed-events — the safe-outputs filter is doing exactly what it was configured to do, and the security model (no automated approvals) should stay intact.

[Copilot]

Pull request overview

This PR reinforces the expert-review workflow’s no-automated-approval rule so reviews are submitted only as comments or change requests, preserving the intended safe-outputs security model.

Changes:

• Adds prominent “Absolute Rules” to the expert reviewer prompt forbidding APPROVE.
• Strengthens the final submission reminder to use COMMENT for clean reviews.
• Updates the shared launcher instructions to pass the same constraint to the background reviewer agent.

Show a summary per file

File	Description
.github/agents/expert-reviewer.agent.md	Adds and reinforces prompt rules preventing APPROVE review submissions.
.github/workflows/shared/review-shared.md	Updates launcher instructions to remind the subagent about allowed review events.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Amaury Levé (Evangelink)]

Expert Review — PR #8221

All 21 review dimensions assessed. No findings.

#	Dimension	Status
1	Backward Compatibility	✅ N/A — no code
2	Public API Surface	✅ N/A — no code
3	Correctness / Logic	✅ Fix accurately targets the root cause
4	Test Coverage	✅ N/A — documentation change
5	Performance	✅ N/A
6	Security	✅ Security model preserved — APPROVE remains blocked
7	Error Handling	✅ N/A
8	Null Safety	✅ N/A
9	Threading / Concurrency	✅ N/A
10	Resource Management	✅ N/A
11	Localization	✅ N/A
12	Logging / Telemetry	✅ N/A
13	Naming / Style	✅ Clear, consistent phrasing
14	Code Duplication	✅ Intentional repetition across three locations to reinforce the rule
15	Complexity	✅ Simple, targeted changes
16	Documentation	✅ This IS the documentation; wording is precise and unambiguous
17	Build / CI	✅ No lock-file changes required (runtime-import confirmed)
18	Dependencies	✅ N/A
19	Serialization	✅ N/A
20	Observability	✅ N/A
21	Design Consistency	✅ Follows existing agent-prompt conventions

All clear. The fix is well-structured — placing the constraint in an "Absolute Rules" section at the very top of the file is the right approach for prompt-level constraints that must survive a long context window. The stop-sign (⛔) in Wave 4 and the forwarding instruction in review-shared.md provide effective belt-and-suspenders reinforcement.

Generated by Expert Code Review (on open) for issue #8221 · ● 2.8M

[Amaury Levé (Evangelink)]

Symptom

When the Expert Code Review (on open) workflow ran on PR #8220, the agent successfully reviewed the change but tried to submit it with event: APPROVE. The safe-outputs filter (allowed-events: [COMMENT, REQUEST_CHANGES]) correctly rejected it, and the whole safe_outputs job failed:

https://github.com/microsoft/testfx/actions/runs/25860787433/job/75991405833

##[warning]Review event 'APPROVE' is not allowed. Allowed events: COMMENT, REQUEST_CHANGES
##[error]✗ Message 2 (submit_pull_request_review) failed: Review event 'APPROVE' is not allowed by safe-outputs configuration. Allowed events: COMMENT, REQUEST_CHANGES
##[error]1 safe output(s) failed

The verdict summary table — and all inline review comments bundled into that submit_pull_request_review call — were dropped on the floor as a side effect.

Root cause

submit-pull-request-review.allowed-events: [COMMENT, REQUEST_CHANGES] is intentional: this agent must not be able to count as a PR approval. The agent's prompt does say Never use APPROVE, but the rule sits ~630 lines into .github/agents/expert-reviewer.agent.md, well after 21 dimension definitions and a four-wave workflow. The model didn't carry it through to the final tool call.

Fix

Reinforce the constraint in three places to make it impossible to miss:

1. .github/agents/expert-reviewer.agent.md — Add an Absolute Rules (read first, must never be violated) section right under the title. Rule Initial commit! 🎉 #1 explicitly forbids event: ""APPROVE"" and spells out the consequence (entire review, including bundled inline comments, is dropped).
2. .github/agents/expert-reviewer.agent.md — Strengthen the existing Wave 4 step-6 reminder with a stop sign and a back-reference to the Absolute Rules section, and re-emphasise that the all-clear case is COMMENT (not APPROVE).
3. .github/workflows/shared/review-shared.md — Instruct the launcher agent to forward the same constraint to the subagent's prompt when it spawns it.

Both files are imported at runtime via gh-aw {{#runtime-import}} (verified in the lock files), so no lock-file regeneration is required and the diff is purely the two .md files. gh aw compile was still run to verify there are no warnings.

We deliberately do not add APPROVE to allowed-events — the safe-outputs filter is doing exactly what it was configured to do, and the security model (no automated approvals) should stay intact.

[Copilot]

Pull request overview

This PR reinforces the expert-review workflow’s no-automated-approval rule so reviews are submitted only as comments or change requests, preserving the intended safe-outputs security model.

Changes:

• Adds prominent “Absolute Rules” to the expert reviewer prompt forbidding APPROVE.
• Strengthens the final submission reminder to use COMMENT for clean reviews.
• Updates the shared launcher instructions to pass the same constraint to the background reviewer agent.

Show a summary per file

File	Description
.github/agents/expert-reviewer.agent.md	Adds and reinforces prompt rules preventing APPROVE review submissions.
.github/workflows/shared/review-shared.md	Updates launcher instructions to remind the subagent about allowed review events.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[Amaury Levé (Evangelink)]

Expert Review — PR #8221

All 21 review dimensions assessed. No findings.

#	Dimension	Status
1	Backward Compatibility	✅ N/A — no code
2	Public API Surface	✅ N/A — no code
3	Correctness / Logic	✅ Fix accurately targets the root cause
4	Test Coverage	✅ N/A — documentation change
5	Performance	✅ N/A
6	Security	✅ Security model preserved — APPROVE remains blocked
7	Error Handling	✅ N/A
8	Null Safety	✅ N/A
9	Threading / Concurrency	✅ N/A
10	Resource Management	✅ N/A
11	Localization	✅ N/A
12	Logging / Telemetry	✅ N/A
13	Naming / Style	✅ Clear, consistent phrasing
14	Code Duplication	✅ Intentional repetition across three locations to reinforce the rule
15	Complexity	✅ Simple, targeted changes
16	Documentation	✅ This IS the documentation; wording is precise and unambiguous
17	Build / CI	✅ No lock-file changes required (runtime-import confirmed)
18	Dependencies	✅ N/A
19	Serialization	✅ N/A
20	Observability	✅ N/A
21	Design Consistency	✅ Follows existing agent-prompt conventions

All clear. The fix is well-structured — placing the constraint in an "Absolute Rules" section at the very top of the file is the right approach for prompt-level constraints that must survive a long context window. The stop-sign (⛔) in Wave 4 and the forwarding instruction in review-shared.md provide effective belt-and-suspenders reinforcement.

Generated by Expert Code Review (on open) for issue #8221 · ● 2.8M