From 95587d3855d8810ae1a47bd355a8bded29858b8a Mon Sep 17 00:00:00 2001 From: MuchoRio Date: Sat, 10 Oct 2026 19:55:32 +0700 Subject: [PATCH] refactor(agents): refine subagent filing directive and observation notice Addresses code review feedback from Greptile: 1. In child_initial_input, clarify that subagents authorized to report findings should file confirmed vulnerabilities via create_vulnerability_report (or ensure their reporting specialist has filed them) before calling agent_finish, preserving specialist delegation roles. 2. In agent_finish and completion report, soften wording to a structured notice/advisory so that clean assessments with negative observations (e.g. findings=['ruled out X']) do not produce false alarms while still alerting parents to unfiled vulnerabilities. --- strix/core/inputs.py | 9 +++++---- strix/tools/agents_graph/tools.py | 17 +++++++++-------- tests/test_agent_graph_coordination.py | 6 +++--- 3 files changed, 17 insertions(+), 15 deletions(-) diff --git a/strix/core/inputs.py b/strix/core/inputs.py index 45707b15..13aa0624 100644 --- a/strix/core/inputs.py +++ b/strix/core/inputs.py @@ -364,10 +364,11 @@ def child_initial_input( ) parts.append( f"You are agent {name} ({child_id}); your parent is {parent_id}. " - "Maintain your own identity. File any confirmed vulnerabilities using " - "create_vulnerability_report (or create_dependency_report) BEFORE calling " - "agent_finish — passing findings to agent_finish does not file reports. " - "Call agent_finish when your task is complete.", + "Maintain your own identity. If authorized to report findings, file any " + "confirmed vulnerabilities using create_vulnerability_report (or " + "create_dependency_report) BEFORE calling agent_finish (or ensure your " + "reporting specialist has filed them) — passing findings to agent_finish " + "does not file reports. Call agent_finish when your task is complete.", ) parts.append(task) return [{"role": "user", "content": "\n\n".join(parts)}] diff --git a/strix/tools/agents_graph/tools.py b/strix/tools/agents_graph/tools.py index 0c4ddbd9..64d71673 100644 --- a/strix/tools/agents_graph/tools.py +++ b/strix/tools/agents_graph/tools.py @@ -103,9 +103,9 @@ def _render_completion_report( lines.append("- (none)") if findings: lines.append( - " [WARNING: This agent reported narrative findings above but filed 0 " - "authoritative vulnerability reports. Unreported findings are not included " - "in scan results or SARIF unless filed via create_vulnerability_report.]" + " [NOTICE: This agent noted narrative findings above with 0 formal " + "reports filed. If any finding represents an unfiled vulnerability, ensure it " + "is reported via create_vulnerability_report.]" ) lines.append("") lines.append("Open items (unresolved, need follow-up):") @@ -744,8 +744,8 @@ async def agent_finish( parent_notified, ) if unfiled_findings: - logger.warning( - "agent_finish: %s reported %d narrative finding(s) but filed 0 vulnerability reports", + logger.info( + "agent_finish: %s reported %d narrative finding(s) with 0 reports filed", me, len(findings or []), ) @@ -762,10 +762,11 @@ async def agent_finish( "has_recommendations": bool(final_recommendations), } if unfiled_findings: - response_payload["warning"] = ( - f"Reported {len(findings or [])} finding(s) but filed 0 vulnerability reports. " + response_payload["notice"] = ( + f"Reported {len(findings or [])} finding(s)/observation(s) with 0 reports filed. " "Narrative findings in agent_finish do not register vulnerabilities in the scan " - "report. Verified findings must be filed via create_vulnerability_report." + "report. If any finding represents an unfiled vulnerability, ensure it is filed " + "via create_vulnerability_report." ) return json.dumps( diff --git a/tests/test_agent_graph_coordination.py b/tests/test_agent_graph_coordination.py index 495c5dc4..7ce82abd 100644 --- a/tests/test_agent_graph_coordination.py +++ b/tests/test_agent_graph_coordination.py @@ -276,13 +276,13 @@ async def test_agent_finish_warns_when_findings_reported_without_filing() -> Non assert result["success"] is True assert result["filed_report_ids"] == [] - assert "warning" in result - assert "Reported 1 finding(s) but filed 0 vulnerability reports" in result["warning"] + assert "notice" in result + assert "Reported 1 finding(s)/observation(s) with 0 reports filed" in result["notice"] delivered = coordinator.runtimes["root"].mailbox assert len(delivered) == 1 assert delivered[0]["unfiled_findings"] is True body = delivered[0]["content"] - assert "authoritative vulnerability reports" in body + assert "0 formal reports filed" in body assert "create_vulnerability_report" in body