Skip to main content
Glama

fow_assurance

Destructive

Record and inspect software assurance findings, reassess them against current intent, link corrective packets, and request guarded change acceptance using evidence.

Instructions

Record and inspect software assurance findings, reassess them against current intent, associate corrective packets and request guarded change acceptance using actual evidence. Route with operation: record_finding, get_finding, reassess_intent, set_finding_disposition, link_fixing_packet, request_change_acceptance. Prerequisites: Investigate current requirements/goals and evidence before classifying a finding or correction. Effects: Records findings, semantic reassessment, dispositions, fixing-packet links and guarded change acceptance. Reassessment is engineer-authored; completion, verification and acceptance remain separate. Exact help (replace operation_name with the selected route): fow_capabilities({"view":"operation","operation_tool":"fow_assurance","operation_name":"record_finding"}).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actorYesIdentity of the human or agent recording this action; retain the original identity when replaying its request.
titleNoShort human-readable title of the authored requirement, finding, packet, run step or campaign. Applies to: record_finding. Required by: record_finding.
severityNoCanonical assurance finding severity, expressing impact without implying acceptance. Applies to: record_finding. Required by: record_finding. Canonical values: info, low, medium, high, critical.
change_idNoCanonical owning change ID; when address resolution permits omission, the packet/campaign must resolve unambiguously.
operationYesOperation selector for this multiplexer; use a canonical route listed below. Canonical values: record_finding, get_finding, reassess_intent, set_finding_disposition, link_fixing_packet, request_change_acceptance.
packet_idNoCanonical packet identity returned by authoring; it identifies the bounded implementation work.
rationaleNoConcrete reasoning supporting this ordinary mutation, decision or selected authority. Applies to: record_finding, set_finding_disposition. Required by: record_finding, set_finding_disposition.
scope_refNoExisting object/reference identifying the finding's selected scope. Applies to: record_finding. Required by: record_finding.
assessmentNoEngineer-authored reassessment against current intent/finding fingerprints, classification, rationale and technical evidence. Applies to: reassess_intent. Required by: reassess_intent. Exact required/optional dotted fields and guidance: fow_capabilities(view=operation, operation_tool=fow_assurance, operation_name=<selected route>).
finding_idNoStable identity of the existing assurance finding. Applies to: get_finding, reassess_intent, set_finding_disposition, link_fixing_packet. Required by: get_finding, reassess_intent, set_finding_disposition, link_fixing_packet.
project_idYesCanonical lifecycle project ID. Select the existing project explicitly; development Markdown authorities are separate from runtime projects.
request_idNoCaller-owned retry identity. For receipted mutations replay the same actor and contents; changed contents can conflict. Inspect exact operation help for its receipt policy.
scope_kindNoKind of lifecycle/source object affected by the assurance finding. Applies to: record_finding. Required by: record_finding.
dispositionNoExplicit classification/action for the selected finding, review, packet question or campaign obligation. Applies to: set_finding_disposition. Required by: set_finding_disposition. Canonical values: open, confirmed, resolved, accepted_exception, deferred, superseded, cancelled.
finding_kindNoSemantic category of the assurance finding. Applies to: record_finding. Canonical values: semantic, engineering, informational, unspecified.unspecified
evidence_refsNoReferences to actual supporting evidence; host-declared provenance remains host-declared. Applies to: set_finding_disposition.
source_anchorNoString source locator/reference (path, section, entity or revision as applicable) linking authority to its originating material; this public input is not a structured object. Applies to: record_finding.
implementation_refNoReference to the implementation location or artifact involved in the finding. Applies to: record_finding.
expected_correctionNoBounded corrective behavior required to resolve the finding within the current intent. Applies to: record_finding, link_fixing_packet. Required by: record_finding, link_fixing_packet.
acceptance_referenceNoReference to the explicit authority accepting the governed change. Applies to: request_change_acceptance. Required by: request_change_acceptance.
disposition_referenceNoReference to the authority supporting the recorded disposition. Applies to: set_finding_disposition.
required_campaign_idsNoExisting campaigns whose successful verification remains required by this corrective packet/finding. Applies to: link_fixing_packet.
supersedes_finding_idNoExisting finding explicitly superseded by this new finding; history remains retained. Applies to: set_finding_disposition.
required_regression_evidenceNoDeclared regression evidence obligations that must remain visible until actually satisfied. Applies to: link_fixing_packet.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed25 schema fields changedv0.5.1
    • addedInput schema / properties / acceptance_reference / description
      Added value: +"Reference to the explicit authority accepting the governed change. Applies to: request_change_acceptance. Required by: request_change_acceptance."
    • addedInput schema / properties / actor / description
      Added value: +"Identity of the human or agent recording this action; retain the original identity when replaying its request."
    • addedInput schema / properties / assessment / description
      Added value: +"Engineer-authored reassessment against current intent/finding fingerprints, classification, rationale and technical evidence. Applies to: reassess_intent. Required by: reassess_intent. Exact required/optional dotted fields and guidance: fow_capabilities(view=operation, operation_tool=fow_assurance, operation_name=<selected route>)."
    • addedInput schema / properties / change_id / description
      Added value: +"Canonical owning change ID; when address resolution permits omission, the packet/campaign must resolve unambiguously."
    • addedInput schema / properties / disposition / description
      Added value: +"Explicit classification/action for the selected finding, review, packet question or campaign obligation. Applies to: set_finding_disposition. Required by: set_finding_disposition. Canonical values: open, confirmed, resolved, accepted_exception, deferred, superseded, cancelled."
    • addedInput schema / properties / disposition_reference / description
      Added value: +"Reference to the authority supporting the recorded disposition. Applies to: set_finding_disposition."
    • addedInput schema / properties / evidence_refs / description
      Added value: +"References to actual supporting evidence; host-declared provenance remains host-declared. Applies to: set_finding_disposition."
    • addedInput schema / properties / expected_correction / description
      Added value: +"Bounded corrective behavior required to resolve the finding within the current intent. Applies to: record_finding, link_fixing_packet. Required by: record_finding, link_fixing_packet."
    • addedInput schema / properties / finding_id / description
      Added value: +"Stable identity of the existing assurance finding. Applies to: get_finding, reassess_intent, set_finding_disposition, link_fixing_packet. Required by: get_finding, reassess_intent, set_finding_disposition, link_fixing_packet."
    • addedInput schema / properties / finding_kind / description
      Added value: +"Semantic category of the assurance finding. Applies to: record_finding. Canonical values: semantic, engineering, informational, unspecified."
    • addedInput schema / properties / implementation_ref / description
      Added value: +"Reference to the implementation location or artifact involved in the finding. Applies to: record_finding."
    • addedInput schema / properties / operation / description
      Added value: +"Operation selector for this multiplexer; use a canonical route listed below. Canonical values: record_finding, get_finding, reassess_intent, set_finding_disposition, link_fixing_packet, request_change_acceptance."
    • addedInput schema / properties / operation / examples
      Added value: +[
      +  "record_finding"
      +]
    • addedInput schema / properties / packet_id / description
      Added value: +"Canonical packet identity returned by authoring; it identifies the bounded implementation work."
    • addedInput schema / properties / project_id / description
      Added value: +"Canonical lifecycle project ID. Select the existing project explicitly; development Markdown authorities are separate from runtime projects."
    • addedInput schema / properties / rationale / description
      Added value: +"Concrete reasoning supporting this ordinary mutation, decision or selected authority. Applies to: record_finding, set_finding_disposition. Required by: record_finding, set_finding_disposition."
    • addedInput schema / properties / request_id / description
      Added value: +"Caller-owned retry identity. For receipted mutations replay the same actor and contents; changed contents can conflict. Inspect exact operation help for its receipt policy."
    • addedInput schema / properties / required_campaign_ids / description
      Added value: +"Existing campaigns whose successful verification remains required by this corrective packet/finding. Applies to: link_fixing_packet."
    • addedInput schema / properties / required_regression_evidence / description
      Added value: +"Declared regression evidence obligations that must remain visible until actually satisfied. Applies to: link_fixing_packet."
    • addedInput schema / properties / scope_kind / description
      Added value: +"Kind of lifecycle/source object affected by the assurance finding. Applies to: record_finding. Required by: record_finding."
    • addedInput schema / properties / scope_ref / description
      Added value: +"Existing object/reference identifying the finding's selected scope. Applies to: record_finding. Required by: record_finding."
    • addedInput schema / properties / severity / description
      Added value: +"Canonical assurance finding severity, expressing impact without implying acceptance. Applies to: record_finding. Required by: record_finding. Canonical values: info, low, medium, high, critical."
    • addedInput schema / properties / source_anchor / description
      Added value: +"String source locator/reference (path, section, entity or revision as applicable) linking authority to its originating material; this public input is not a structured object. Applies to: record_finding."
    • addedInput schema / properties / supersedes_finding_id / description
      Added value: +"Existing finding explicitly superseded by this new finding; history remains retained. Applies to: set_finding_disposition."
    • addedInput schema / properties / title / description
      Added value: +"Short human-readable title of the authored requirement, finding, packet, run step or campaign. Applies to: record_finding. Required by: record_finding."
  2. First observedv0.1.0

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag the mutation profile (readOnlyHint=false, destructiveHint=true, idempotentHint=false), but the description adds real context beyond them: it lists what effects are produced and stresses that 'reassessment is engineer-authored; completion, verification and acceptance remain separate,' which prevents the agent conflating these stages. It does not, however, describe reversibility or the receipt/retry behavior (only the schema's request_id field hints at that).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight blocks — purpose, route list, prerequisites/effects — plus one help pointer, all front-loaded with the capability statement first. Density is justified for a six-operation multiplexer, though the 'Effects' sentence is somewhat compressed and could be clearer.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the description covers routing, prerequisites, mutation effects and a mechanism for per-operation detail. For a 24-parameter, 6-route multiplexer it is close to complete, but it leaves the receipt/replay policy and success criteria implicit in the schema only.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 24 parameters and 100% schema description coverage, the schema already carries per-field meaning, including 'Applies to' / 'Required by' routing annotations, so the baseline is 3. The description contributes only the operation enumeration and a pointer to fow_capabilities for dotted-field help, adding nothing about field formats or constraints beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource set — recording/inspecting software assurance findings, reassessing intent, linking fixing packets, requesting guarded change acceptance — and enumerates the six routing operations that scope the tool. It is clearly distinguishable in domain from siblings like fow_campaign_author or fow_record_verification, but it never explicitly contrasts itself against those neighbors.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit prerequisite ('Investigate current requirements/goals and evidence before classifying a finding or correction') and names the operation routes for each intended behavior, so an agent knows which route to select. It stops short of when-not-to-use guidance or pointing to an alternative sibling tool for overlapping work.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.