Skip to content

Add abbreviated mode to investigation-report format#191

Merged
Alan-Jowett merged 3 commits intomicrosoft:mainfrom
Alan-Jowett:abbreviated-investigation-report
Apr 6, 2026
Merged

Add abbreviated mode to investigation-report format#191
Alan-Jowett merged 3 commits intomicrosoft:mainfrom
Alan-Jowett:abbreviated-investigation-report

Conversation

@Alan-Jowett
Copy link
Copy Markdown
Member

Closes #112

Summary

Add a conditional abbreviated format to investigation-report for routine, low-severity audits. Saves ~500-1000 response tokens per audit by omitting sections that add overhead without analytical value.

Changes

  • Abbreviated format (4 sections): Executive Summary, Findings, Remediation Plan, Coverage. Triggers when finding count is 5 or fewer AND no findings are Critical/High severity.
  • Section 9 (Revision History) marked optional: Omit for single-pass automated audits.
  • Full format unchanged: Still mandatory for incident response, security audits, and any investigation with >5 findings or Critical/High severity.
  • Auto-escalation: If any finding is upgraded to Critical/High during investigation, switch to full format.

Evidence (from issue)

Session profiling of three PromptKit audit prompts found ~500 response tokens (~15-25% of response) spent on formulaic sections (Problem Statement, Prevention, Revision History) in audits with only 3 low-severity findings.

…#112)

Add conditional abbreviated format for routine, low-severity audits:
- Triggers when finding count <= 5 AND no Critical/High findings
- Abbreviated format: Executive Summary, Findings, Remediation Plan,
  Coverage (4 sections vs. 9)
- Saves ~500-1000 response tokens per low-finding audit
- Auto-escalates to full format if any finding is Critical/High

Also mark section 9 (Revision History) as optional — omit for
single-pass automated audits.

Full format unchanged for incident response, security audits, and
any investigation with >5 findings or Critical/High severity.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 6, 2026 21:20
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds conditional guidance to the investigation-report format so routine, low-severity audits can use a shorter report structure (reducing prompt/response overhead) while preserving the existing full format for higher-risk investigations.

Changes:

  • Introduces an abbreviated format path (Executive Summary, Findings, Remediation Plan, Coverage) when there are ≤5 findings and none are Critical/High.
  • Adds auto-escalation guidance to switch back to the full format if severity increases.
  • Marks Revision History as optional for single-pass automated audits.

- Resolve MUST/optional contradiction: sections 1-8 required, section 9
  included only for versioned reports
- Remove '(optional)' from section 9 heading to prevent it leaking
  into generated report output; express optionality in instructions
- Add zero-findings rule: state 'None identified' in Findings and
  'No remediation required' in Remediation Plan; Coverage still required

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett Alan-Jowett requested a review from Copilot April 6, 2026 21:29
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

- Add explicit 'enumerate findings first, then choose format' step
  to avoid circular instructions (can't know finding count before
  analysis)
- Add compatibility escape: if invoking template requires full
  9-section structure, honor that over abbreviation rules
- Dismiss §9 '(Optional)' heading request — contradicts previous
  round's resolved comment that removed it to prevent leaking into
  generated output

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Alan-Jowett Alan-Jowett merged commit 8c0845f into microsoft:main Apr 6, 2026
3 checks passed
@Alan-Jowett Alan-Jowett deleted the abbreviated-investigation-report branch April 6, 2026 21:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Investigation-report format: add abbreviated mode for routine audits

2 participants