Fleet rollout: standardized deps.yml across all 81 remaining bounded-systems repos

[bdelanghe]

Execution tracker for the org-wide fan-out (infra#104). Decision: maximum coverage, predictable and standardized — the byte-identical templates/deps.yml goes to every non-archived, attachable repo, landed as PRs auto-merged when green.

Why no lockfile survey first: the lane passes cleanly on repos with nothing scannable (--allow-no-lockfiles), so eligibility is universal — the org-wide code search that blocked this earlier became prioritization, not a gate. Wave order favors npm/deno-heavy repos so findings arrive early and in triageable volume.

Red PRs do not auto-merge. Under the hard-fail posture, a red osv check on an adoption PR is a real pre-existing finding (front-desk#70's maiden scan caught GHSA-frvp-7c67-39w9 exactly this way). Those get triaged individually: relock if an upstream fix exists, osv-scanner.toml with a written reason if not.

Inventory (90 org repos): 3 covered (front-desk-scheduler, infra, ci-workflows self-test) · 4 archived (dev-contracts-{validate,spec,transform,extract}) · 2 dotfile repos no agent session can attach (.github, .github-private — human-only) · 81 to adopt.

Standing recommendation once coverage lands: delete (or mark inert) bounded-systems/.github/required-baseline.yml — it claims to be an org-wide injected floor, has never run (no workflows ruleset rule exists on Free), and its report-only posture contradicts the fleet's hard-fail. Human-only, since .github is unattachable.

Waves

• 1 (npm/deno-heavy): guest-room, gh-project-room, prx, site-mcp, static-mcp, verbspec, verbspec-mcp, claude-token-tools
• 2: door-kit, door-keeper, agent-memory, scout-wire, door-scout, site, repo-health, await-approval
• 3: conformance, ocap-provenance, facilities, door-peercred, door-net, door-concierge, claude-box, brand, synoptic
• 4: trellis, trellis-kit, drift-gate, trellis-private, fleet, descriptor-kit, conformance-kit, keeper-wire, trust
• 5: concierge-wire, deploy, dev-contracts, mint, baobab, string-audit, gh-action-brand-checks, gh-action-node-uniqueness, gh-action-contracts
• 6: cas, lone, hooksmith, git-ast, installer, cf-oidc-token-broker, env, anchored-chain-sqlite, anchored-chain
• 7: audit-context, fs, gh, auth, git, github-budget, bd, machine-schema, policy
• 8: proc, repo-root, disposition, host, schema-gen, scout, slack, surface-sync, seam-check
• 9: fold-engine, bounded-tools-mcp, bounded.tools, verify, content-catalog, schema-bridge, lobby, lima-devshell, frond, dev-registry

Per repo: attach → branch claude/deps-osv-scan → push template → PR → checks → merge green / triage red. Findings and exceptions get logged here as they happen.

[bdelanghe]

Wave 1 results — the fan-out is finding real vulnerabilities at scale

8 PRs opened, all with the byte-identical template pinned to 8b7d8a8.

repo	PR	osv	finding
guest-room	#62	✅	clean — merged
verbspec	#16	✅	clean
claude-token-tools	#9	✅	clean
gh-project-room	#88	❌	GHSA-frvp-7c67-39w9 — @hono/node-server 1.19.14 (from deno.lock)
prx	#1027	❌	4 findings in bun.lock: hono 4.12.19, qs 6.15.1, ws 8.20.0 (×2, incl. CVSS 7.5 GHSA-96hv-2xvq-fx4p)
site-mcp	#9	❌	pending triage
static-mcp	#9	❌	pending triage
verbspec-mcp	#2	❌	pending triage

5 of 8 repos carry pre-existing advisories. Every one is a genuine finding, not a lane defect — and bun.lock extraction works out of the box, which widens the ecosystem story beyond npm/deno.

Two things worth recording:

• The deno.lock converter is earning its keep beyond front-desk. gh-project-room's finding came from deno-lock.cdx.json — invisible to any scanner before today.
• Unrelated red: gh-project-room's dry-run (jsr-check) failure is pre-existing (deno publish --dry-run, 28 source files; this PR adds only a workflow file JSR doesn't publish, and the same check failed on another branch on 07-26). Noted on the PR, not fixed here.

Implication for the remaining 73 repos

At this hit rate, hard-fail means most adoption PRs will land red on a real pre-existing advisory, each needing its own relock (deno / bun / npm, then tests). That's the control working exactly as specified — but it makes adoption and remediation the same task, so the rollout pace is set by remediation, not by pushing files.

---

Generated by Claude Code

[bdelanghe]

Grace shipped broken, then fixed — worth recording why

The first report-only implementation silently did nothing. GitHub invokes run steps as bash -e {0}, so errexit arrives on the command line; the step's set -uo pipefail never cleared it, and the shell exited the instant osv-scanner returned 1 — before reaching the code that reads the flag. Every graced caller still hard-failed. Confirmed live on 5 PRs.

The local test passed against that broken code, because it ran the extracted step with plain bash script.sh and never reproduced the -e. That's the more important defect.

Fixed in 62990dd: one-line set +e, plus test/test_scan_posture.py, which extracts the step and runs it through bash -e exactly as GitHub does. Verified load-bearing — with the fix removed, 6 cases fail; restored, all pass. Now part of self-test.

The property it pins, which matters more than the convenience: grace downgrades vulnerability findings and nothing else. A scanner that could not run (exit 2, 127, …) fails hard in both modes, because a lane that cannot run must never report green. That distinction is exactly what a bare continue-on-error: true would have destroyed — it would swallow "found vulns" and "scanner crashed" identically.

Wave 1 final

repo	PR	outcome
guest-room	#62	✅ merged, clean, hard-fail
verbspec	#16	✅ merged, clean, hard-fail
claude-token-tools	#9	✅ merged, clean, hard-fail
site-mcp	#9	🟡 grace applied, osv green — merging when remaining checks land
static-mcp	#9	🟡 grace applied, osv green — merging when remaining checks land
verbspec-mcp	#2	🟡 grace applied, checks running
prx	#1027	🟡 grace applied, checks running
gh-project-room	#88	🟠 osv green under grace, but dry-run (jsr-check) is red — pre-existing, unrelated to this PR (noted); not merging over someone else's broken check

Template pin for waves 2–9: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@62990dd15f1b0deba21e597bebd1512970544c15.

Remediation queue (separate from adoption, per the split decision)

• gh-project-room — GHSA-frvp-7c67-39w9, @hono/node-server 1.19.14 → 2.0.5 (deno.lock relock)
• prx — 4 findings in bun.lock: hono 4.12.19→4.12.21, qs 6.15.1→6.15.2, ws 8.20.0→8.21.0 (two advisories, incl. CVSS 7.5)
• site-mcp / static-mcp / verbspec-mcp — findings to be enumerated from their run logs

Each is cleared by relock + tests, then deleting the report-only: true line to restore hard-fail.

---

Generated by Claude Code