From f06c4b8788a134af4c798aa03f8aabc1134b7f9b Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 15:44:07 +0000 Subject: [PATCH 1/4] docs: recommend scope filters when authoring factory automations --- resources/bundled/skills/factory-files/SKILL.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/resources/bundled/skills/factory-files/SKILL.md b/resources/bundled/skills/factory-files/SKILL.md index bcd561c6942..aa71e66f4e3 100644 --- a/resources/bundled/skills/factory-files/SKILL.md +++ b/resources/bundled/skills/factory-files/SKILL.md @@ -161,6 +161,13 @@ read them. its canonical key, and declaring both is an error. The Linear and Slack ones name objects the server looks up at apply time, so they take a plain list of names rather than an `in`/`not_in` matcher. +- When creating automations, recommend scope filters to avoid unrelated runs: + GitHub/GitLab `repos`, Linear `teams` and/or `projects`, Jira `project_keys`, + and Slack `channels`. Choose values from the user's intended scope and only + use filters supported by the trigger's `(provider, event)` schema. +- If scope is unclear, ask before creating the automation. Explain the reach + of an unscoped trigger and confirm that broad matching is intentional; + missing scope filters are not necessarily schema errors. - A webhook never carries secret material. `secretName` is required in every `authMode` and names an existing managed secret; the server does not generate a secret for a file-declared source, because nothing could then read it back From 7b5ed7b7c696f10308511e8604f77b81d4873ff3 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 15:48:08 +0000 Subject: [PATCH 2/4] docs: align scope guidance with factory client recommendations --- resources/bundled/skills/factory-files/SKILL.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/resources/bundled/skills/factory-files/SKILL.md b/resources/bundled/skills/factory-files/SKILL.md index aa71e66f4e3..7ed8a2f86fe 100644 --- a/resources/bundled/skills/factory-files/SKILL.md +++ b/resources/bundled/skills/factory-files/SKILL.md @@ -161,13 +161,16 @@ read them. its canonical key, and declaring both is an error. The Linear and Slack ones name objects the server looks up at apply time, so they take a plain list of names rather than an `in`/`not_in` matcher. -- When creating automations, recommend scope filters to avoid unrelated runs: - GitHub/GitLab `repos`, Linear `teams` and/or `projects`, Jira `project_keys`, - and Slack `channels`. Choose values from the user's intended scope and only - use filters supported by the trigger's `(provider, event)` schema. -- If scope is unclear, ask before creating the automation. Explain the reach - of an unscoped trigger and confirm that broad matching is intentional; - missing scope filters are not necessarily schema errors. +- When creating automations, recommend non-empty inclusive scope filters: + GitHub `labels` for events that support labels, Linear `teams` (or + `team_ids`), Jira `project_keys`, and Microsoft Teams `team_ids`. + Exclusions alone do not satisfy these recommendations; neither do Microsoft + Teams channel filters alone. Use the trigger's `(provider, event)` schema. +- Suggest the Factory's GitHub label when available; for Linear/Jira, suggest + the teams/projects from its enabled agent-session routing automation. + If scope is unclear, ask rather than inventing values. Explain and confirm + intentional broad matching; these are recommendations, not save-blocking + validation requirements. - A webhook never carries secret material. `secretName` is required in every `authMode` and names an existing managed secret; the server does not generate a secret for a file-declared source, because nothing could then read it back From 97343fbd6dd7ff38f7eb6448542f6cd8826d55a5 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 15:57:03 +0000 Subject: [PATCH 3/4] docs: condense automation scope guidance into one bullet --- resources/bundled/skills/factory-files/SKILL.md | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/resources/bundled/skills/factory-files/SKILL.md b/resources/bundled/skills/factory-files/SKILL.md index 7ed8a2f86fe..91a09395edd 100644 --- a/resources/bundled/skills/factory-files/SKILL.md +++ b/resources/bundled/skills/factory-files/SKILL.md @@ -164,13 +164,11 @@ read them. - When creating automations, recommend non-empty inclusive scope filters: GitHub `labels` for events that support labels, Linear `teams` (or `team_ids`), Jira `project_keys`, and Microsoft Teams `team_ids`. - Exclusions alone do not satisfy these recommendations; neither do Microsoft - Teams channel filters alone. Use the trigger's `(provider, event)` schema. -- Suggest the Factory's GitHub label when available; for Linear/Jira, suggest - the teams/projects from its enabled agent-session routing automation. - If scope is unclear, ask rather than inventing values. Explain and confirm - intentional broad matching; these are recommendations, not save-blocking - validation requirements. + Prefer the Factory's GitHub label and its enabled Linear/Jira agent-session + routing scope when available. Exclusions alone and Microsoft Teams channel + filters alone do not satisfy these recommendations. Follow the event's + schema, ask if scope is unclear, and confirm intentional broad matching; + these recommendations do not block saving. - A webhook never carries secret material. `secretName` is required in every `authMode` and names an existing managed secret; the server does not generate a secret for a file-declared source, because nothing could then read it back From 0b4f421ef4597bc79bca6ab6d95d0ebe51269492 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Wed, 28 Oct 2026 16:21:38 +0000 Subject: [PATCH 4/4] docs: explain rationale for automation scope filters --- resources/bundled/skills/factory-files/SKILL.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/resources/bundled/skills/factory-files/SKILL.md b/resources/bundled/skills/factory-files/SKILL.md index 91a09395edd..de378761769 100644 --- a/resources/bundled/skills/factory-files/SKILL.md +++ b/resources/bundled/skills/factory-files/SKILL.md @@ -161,14 +161,12 @@ read them. its canonical key, and declaring both is an error. The Linear and Slack ones name objects the server looks up at apply time, so they take a plain list of names rather than an `in`/`not_in` matcher. -- When creating automations, recommend non-empty inclusive scope filters: - GitHub `labels` for events that support labels, Linear `teams` (or - `team_ids`), Jira `project_keys`, and Microsoft Teams `team_ids`. - Prefer the Factory's GitHub label and its enabled Linear/Jira agent-session - routing scope when available. Exclusions alone and Microsoft Teams channel - filters alone do not satisfy these recommendations. Follow the event's - schema, ask if scope is unclear, and confirm intentional broad matching; - these recommendations do not block saving. +- When creating automations, recommend non-empty inclusive scope filters to + focus on intended work and avoid noisy, unnecessary agent runs and resource + use from unrelated activity: GitHub `labels` for events that support labels, + Linear `teams` (or `team_ids`), Jira `project_keys`, and Microsoft Teams + `team_ids`. Follow the event's schema, ask if scope is unclear, and confirm + intentional broad matching; these recommendations do not block saving. - A webhook never carries secret material. `secretName` is required in every `authMode` and names an existing managed secret; the server does not generate a secret for a file-declared source, because nothing could then read it back