[q] q: set min-integrity to none, cookie guard, and spam detection

[github-actions]

Changes

Applied updates to the Q workflow as requested by @pelikhan:

1. min-integrity: none

Added min-integrity: none to the GitHub tools configuration so Q can read data from any integrity level (e.g., unreviewed discussions and issues).

2. Cookie label guard

Added prompt instruction: do not add the cookie label unless ai-inspected is already present on the issue. Prevents prematurely marking AI-generated issues as approved work-queue items before they've been moderation-reviewed.

3. Spam detection

Added prompt instruction: detect malicious or suspicious trigger content and flag with spam before taking any other action. Also added add-labels: allowed: [spam] to the safe-outputs configuration so Q has permission to apply the label.

Files changed

• .github/workflows/q.md

Validation

✅ q compiled successfully with no errors or warnings.

---

Warning

🛡️ Protected Files — Push Permission Denied

This was originally intended as a pull request, but the patch modifies protected files: .github/workflows/q.md.

The push was rejected because GitHub Actions does not have workflows permission to push these changes, and is never allowed to make such changes, or other authorization being used does not have this permission. A human must create the pull request manually.

To create a pull request with the changes:

# Download the patch from the workflow run
gh run download 23386038991 -n agent -D /tmp/agent-23386038991

# Create a new branch
git checkout -b q/update-min-integrity-and-prompt-4277e69a9ac601cb main

# Apply the patch (--3way handles cross-repo patches)
git am --3way /tmp/agent-23386038991/aw-q-update-min-integrity-and-prompt.patch

# Push the branch and create the pull request
git push origin q/update-min-integrity-and-prompt-4277e69a9ac601cb
gh pr create --title '[q] q: set min-integrity to none, cookie guard, and spam detection' --base main --head q/update-min-integrity-and-prompt-4277e69a9ac601cb --repo github/gh-aw

Note

🔒 Integrity filter blocked 1 item

The following item were blocked because they don't meet the GitHub min-integrity level.

• get_discussion get_discussion: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

See Integrity Filtering for more information.

🎩 Equipped by Q · ◷

• expires on Mar 23, 2026, 6:40 PM UTC