Org Status — 2026-10-28

@org-leads

Org Summary — 2026-10-28

Metric	Value
Total open PRs	64
PRs needing rebase	25
Total open issues	425
PR merges (last 8 days)	157
Open discussions	0

pie title Open PRs by Status
    "CI Failing" : 23
    "Awaiting Review" : 19
    "CI Pending" : 14
    "Draft" : 6
    "Changes Requested" : 1
    "Approved" : 1

Open PRs — Why They're Unmerged (64 total)

xychart-beta
    title "Open PRs by Blocker Category"
    x-axis ["CI Failing", "Awaiting Review", "CI Pending", "Draft", "Changes Requested", "Approved"]
    y-axis "Count"
    bar [23, 19, 14, 6, 1, 1]

xychart-beta
    title "Open PRs per Repo by Category"
    x-axis [".github", ".github-private", "empower-personal-dashboard", "broodly", "TalkTerm", "broodminder-data", "google-app-scripts", "software-factory-canary", "repo-template"]
    y-axis "PRs"
    bar [0, 0, 0, 0, 0, 0, 0, 0, 0]
    bar [3, 4, 5, 0, 3, 2, 0, 2, 0]
    bar [1, 9, 6, 1, 1, 2, 2, 0, 1]
    bar [1, 0, 0, 0, 0, 0, 0, 0, 0]

PR Merge Activity — Last 8 Days

xychart-beta
    title "combsmith Merges — Last 8 Days"
    x-axis ["Oct-21","Oct-22","Oct-23","Oct-24","Oct-25","Oct-26","Oct-27","Oct-28"]
    y-axis "Merges"
    bar [40,36,4,2,29,14,18,14]

Repo	Oct-21	Oct-22	Oct-23	Oct-24	Oct-25	Oct-26	Oct-27	Oct-28	Total
combsmith/software-factory	28	24	4	0	0	7	11	5	79
combsmith/.github	3	1	0	0	3	1	0	4	12
combsmith/empower-personal-dashboard	1	1	0	0	5	1	2	2	12
combsmith/incubator	1	3	0	0	6	1	0	1	12
combsmith/bmad-bgreat-suite	0	0	0	1	5	1	0	0	7
combsmith/google-app-scripts	1	3	0	0	1	0	0	1	6
combsmith/software-factory-canary	3	0	0	0	0	0	2	1	6
combsmith/.github-private	1	3	0	0	1	0	0	0	5
combsmith/broodminder-data	0	0	0	0	2	0	3	0	5
combsmith/broodly	0	0	0	0	1	3	0	0	4
combsmith/worldchest	1	1	0	0	1	0	0	0	3
combsmith/ContentTwin	0	0	0	1	1	0	0	0	2
combsmith/TalkTerm	1	0	0	0	1	0	0	0	2
combsmith/markets	0	0	0	0	1	0	0	0	1
combsmith/repo-template	0	0	0	0	1	0	0	0	1
TOTAL	40	36	4	2	29	14	18	14	157

Grand total: 157 merges over 8 days. Trend: Decreasing.

Open PRs — Needs Human Review

Repo	PR	Opened	CI	Approvals
combsmith/TalkTerm	#8 — feat: Epic 13 (Structured Questions) + Epic 14 (Native STT)	2026-03-24	FAIL	0
combsmith/broodly	#36 — Epic 10: Planning & Weekly Queue (Stories 10.1–10.5)	2026-03-30	FAIL	0
combsmith/TalkTerm	#468 — feat: implement issue #466 — [Fleet Monitor] petry-projects/TalkTerm — .github/workflows/pr-auto-review.yml	2026-08-31	PASS	0
combsmith/.github-private	#1730 — feat: implement issue #1713 — [#1269 split 1/2] shadow_mode input + total PR-output suppression (inert, nothing dispatched)	2026-09-08	PASS	0
combsmith/.github	#1116 — feat: implement issue #1115 — [bug] dismiss-stale-bot-reviews is missing from this repo — a stale bot CHANGES_REQUESTED blocks PRs forever (blocking #1094)	2026-09-12	PASS	1
combsmith/.github-private	#1770 — feat: implement issue #1766 — [bug] pr-review approves PRs with unresolved threads (violates its own decision gate 4) and double-reviews the same SHA	2026-09-12	FAIL	0
combsmith/.github	#1117 — feat: implement issue #1103 — cmd_rollback moves the bare / tag, not /v- — the emergency lever is a silent no-op for every v-scoped agent	2026-09-13	PENDING	0
combsmith/.github-private	#1796 — feat: implement issue #1733 — feature-ideation.yml: every run fails at 'Install Python jsonschema' — requirements file missing from the pinned tooling checkout	2026-09-13	FAIL	0
combsmith/.github	#1218 — feat: implement issue #1202 — [Phase 1] safety-checks lib with sc_description_missing	2026-10-01	PASS	0
combsmith/.github-private	#2135 — feat: implement issue #1973 — [Engine config · Phase 1] Versioned config/ai-engines.json as the single source of truth for providers, model catalog and per-task chains	2026-10-09	FAIL	0
combsmith/.github-private	#2217 — feat: implement issue #2211 — dev-lead fix-bot-comment built a commit that undoes the PR's whole diff — the no-op guard caught it, but PR #2198 was held with its fix intact	2026-10-10	PASS	0
combsmith/.github-private	#2218 — feat: implement issue #2216 — dev-lead: an agent session can leave base-branch content in the PR worktree, and the harness commits it (follow-up to #2211)	2026-10-10	PASS	0
combsmith/.github	#1299 — feat: implement issue #1296 — Standards sweep reuses a same-date sync branch as-is — a narrower second run opens a PR carrying the first run's commits	2026-10-11	PENDING	0
combsmith/.github-private	#2260 — feat: implement issue #2232 — Sync-stub guard for rebase passes: after the rebase, restore a synced stub left in a third state (check and restore, no push blocker) — the rebase half of #2212	2026-10-11	PASS	0
combsmith/.github-private	#2318 — Potential fix for code scanning alert no. 41: Checkout of untrusted code in a non-privileged context	2026-10-12	FAIL	0
combsmith/TalkTerm	#549 — feat: implement issue #548 — Compliance: verbatim-stub-drift-initiative-driver.yml	2026-10-18	PASS	0
combsmith/.github-private	#2366 — chore: sync 3 org-standard workflow stub(s) from combsmith/.github	2026-10-19	FAIL	1
combsmith/empower-personal-dashboard	#110 — feat: implement issue #108 — [Fleet Monitor] combsmith/empower-personal-dashboard — .github/workflows/pr-auto-review.yml	2026-10-22	PASS	0
combsmith/.github	#1417 — fix(security): scope SONAR_TOKEN to scan steps and fail unanalysed fork PRs (#1390, #1392)	2026-10-28	PENDING	0
combsmith/.github	#1419 — fix(security): workflow/CI hardening batch (#1384, #1391, #1396, #1405)	2026-10-28	PENDING	0
combsmith/.github	#1421 — fix(security): gate Dependabot approve/merge on check success and commit provenance (#1399, #1400)	2026-10-28	PENDING	0
combsmith/.github	#1423 — fix(security): restrict canary rollback to registered mutable channels (#1402)	2026-10-28	PENDING	0

Open PRs — Automation (Dependency Bumps)

Repo	# Dep PRs
combsmith/.github	1

Open Issues (425 total)

combsmith/.github (showing 25 of 95 issues)

Issue	Opened	Labels	Linked PR
#1410 — Allow durable repo-specific required checks (code-quality is overwritten weekly; extra rulesets are flagged as legacy)	2026-10-28		—
#1409 — sonarcloud-audit.sh cleanup closes audit issues in repos excluded from the current run's selection	2026-10-28	security, in-progress	#1422
#1408 — agents-md-lint.sh extracts cross-reference links one at a time by rebuilding the line (quadratic on link-dense lines)	2026-10-28	security, in-progress	#1422
#1407 — persona-mention.sh lets a surface allowlist replace (and widen) the persona-wide author_association allowlist	2026-10-28	security, in-progress	#1413
#1406 — dependency-audit-reusable: the required check is ecosystem discovery, not the scanners' outcome	2026-10-28	security, in-progress	—
#1405 — agent-shield-reusable runs the scanner via npm inside the PR checkout, so a PR's .npmrc can neuter the scan	2026-10-28	security, in-progress	#1419
#1403 — bootstrap-new-repo.sh .gitignore preservation check spawns a pipeline per line (quadratic, thousands of subprocesses)	2026-10-28	security, in-progress	#1422
#1402 — canary-rollout.sh rollback force-moves any destination tag, including immutable release tags, without checking it is a channel	2026-10-28	security, in-progress	#1423
#1401 — compliance-audit.sh close_resolved_issues matches check IDs as a regex and treats grep errors as resolved	2026-10-28	security, in-progress	#1416
#1400 — dependabot-automerge-reusable approves the whole PR from first-commit Dependabot metadata, including later non-Dependabot commits	2026-10-28	security, in-progress	#1421
#1399 — dependabot-rebase-reusable merges with the bypass App after checks complete without requiring successful conclusions	2026-10-28	security, in-progress	#1421
#1398 — persona-mention-reusable reads only the first page of labels, so an opt-out or human-hold label on a later page is ignored	2026-10-28	security, in-progress	#1413
#1397 — compliance-remediate.sh inserts remote action paths/tags into a sed replacement unescaped (GNU sed command injection)	2026-10-28	security, in-progress	#1416
#1396 — auto-rebase-reusable: PR base branch name is pasted unescaped into the published recovery shell command	2026-10-28	security, in-progress	#1419
#1392 — sonarcloud.yml runs the PR's Python test code with the SonarCloud token in the job environment	2026-10-28	security, in-progress	#1417
#1391 — dev-lead-retrigger.sh trusts the dev-lead/ branch prefix as proof of agent activity; fork PRs can suppress compliance retriggers	2026-10-28	security, in-progress	#1419
#1390 — standards sonarcloud.yml passes the required check when SONAR_TOKEN is unavailable, so fork PRs skip analysis permanently	2026-10-28	security, in-progress	#1417
#1389 — feature-ideation: model with Discussion-write token can bypass dry_run and the target-Discussion guard via its Bash tool	2026-10-28	security, in-progress	#1418
#1388 — fix-ruleset-bypass.sh preview uses a predictable temp dir and output files that follow pre-planted symlinks	2026-10-28	security, in-progress	#1422
#1387 — compliance-remediate.sh writes to fixed /tmp/_cr_jq_err path, which follows a pre-planted symlink	2026-10-28	security, in-progress	#1416
#1386 — automerge-standards-sync.sh grants code-owner approval from PR author/label/branch without verifying the diff is still standards-only	2026-10-28	security, in-progress	#1414
#1385 — compliance-audit.sh splices a workflow-filename-derived title into jq program source (jq injection)	2026-10-28	security, in-progress	#1416
#1384 — classify-initiative.sh echoes untrusted issue/PR titles raw to runner stdout, so a title can inject workflow commands	2026-10-28	security, in-progress	#1419
#1382 — Org Status — 2026-10-27	2026-10-27	daily-report	—
#1380 — Scorecard: Vulnerabilities (7/10)	2026-10-26	scorecard	—

combsmith/.github-private (showing 25 of 150 issues)

Issue	Opened	Labels	Linked PR
#2411 — combsmith — workflow failures detected 2026-10-28	2026-10-28	health-check, automated-report	—
#2410 — Stalled PR candidate(s) detected 2026-10-28	2026-10-28	health-check, automated-report	—
#2409 — Runaway PR candidate(s) detected 2026-10-28	2026-10-28	health-check, automated-report	—
#2396 — Skill eval infra error — `triage` (holdout)	2026-10-23	eval-infra	—
#2395 — Engine-token preflight — FLEET-WIDE OUTAGE (#1587)	2026-10-23	dev-lead, engine-outage	—
#2379 — PR Review Agent — failures detected 2026-10-21	2026-10-21	health-check, automated-report	—
#2367 — Scorecard: SAST (9/10)	2026-10-19	enhancement, scorecard	—
#2358 — Docs Health Check — stale files detected 2026-10-18	2026-10-18	health-check, automated-report	—
#2353 — Compliance: open_secret_alerts	2026-10-16	compliance-audit, dev-lead, compliance-finding	—
#2329 — Budget breaker: a 404 from a delete the operator already made turns a successful resume or roll-back into a red run with a wrong message, and the resume notice is never posted	2026-10-14	bug	—
#2327 — [ADR-0007] Record the markets pilot's measured baseline and post-collapse cost in the package (§1, §7, §11)	2026-10-14	documentation, dev-lead	#2328
#2315 — Give the dev-lead sidecar directory a per-session default in the suite hooks, so a suite that forgets the export does not write to shared /tmp	2026-10-12	enhancement	—
#2309 — dev-lead and CodeRabbit reply to each other without end on a thread dev-lead has declined (44 rounds on PR #1796; stopped only by the API rate limit)	2026-10-11	bug	—
#2306 — Budget breaker: wake it only when there is something to decide, instead of on every Dev-Lead Agent run	2026-10-11	enhancement	—
#2302 — review-one-pr.sh keeps its working files in the fixed directory /tmp/cascade, so concurrent test sessions (and concurrent reviews on one machine) share it	2026-10-11	bug	—
#2301 — Freeze the orphaned dev-lead/v1-* channel tags with a tombstone release, so a wrong repin fails loudly at startup instead of running a September build	2026-10-11	enhancement	—
#2294 — dev-lead pushes to a pull request opened with dev-lead:hands-off: the pr-opened path classifies review-changes before the label is visible	2026-10-11	bug	—
#2282 — fleet-paused notice jobs print the pause variables with their line breaks, so a multi-line value starts a second workflow command	2026-10-11	enhancement, security	—
#2280 — Auto-rebase health report: the base-merge necessity counters always read 0, so the report cannot show whether base merges are happening	2026-10-11	bug	—
#2276 — Epic: fixes to the current factory that are worth making whatever is rebuilt (lessons from the factory MVP review)	2026-10-11	enhancement	—
#2273 — dev-lead issue runs fail in repos with commitlint when the issue title is long — the commit header is the full title and exceeds 100 characters	2026-10-11	bug	—
#2258 — Nine of nine persona manifests are still status: draft — decide and record what advances business-analyst (and the rest) now that the router reaches a stable-ring repo	2026-10-11	enhancement	—
#2253 — qa-lead never advises a PR that was opened with merge conflicts — pull_request.opened does not run, and synchronize is deliberately not subscribed	2026-10-11	enhancement	—
#2251 — Budget breaker: close the gaps found in review before it is armed (race with a human pause, pagination, hold on a bad timestamp, lost notice, live API checks)	2026-10-11	enhancement	—
#2247 — Stale-disposition retry cap does not count a fix-reviews pass that dies before posting any marker (follow-up to the edited-comment deadlock fix)	2026-10-11	bug, dev-lead	#2290

combsmith/ContentTwin (4 issues)

Issue	Opened	Labels	Linked PR
#482 — dev-lead: deferred review findings	2026-10-09		—
#465 — Compliance: stub-surface-drift-agent-shield.yml-on	2026-09-25	compliance-audit, dev-lead, dev-lead:needs-human, compliance-finding	—
#158 — Scorecard: Code-Review (6/10)	2026-05-17	scorecard	—
#157 — Scorecard: Branch-Protection (8/10)	2026-05-17	scorecard	—

combsmith/TalkTerm (13 issues)

Issue	Opened	Labels	Linked PR
#556 — [Fleet Monitor] combsmith/TalkTerm — .github/workflows/ci.yml	2026-10-26	dev-lead, fleet-tracker, health-check	—
#548 — Compliance: verbatim-stub-drift-initiative-driver.yml	2026-10-16	compliance-audit, dev-lead, compliance-finding	#549
#540 — Scorecard: Code-Review (6/10)	2026-10-12	scorecard	—
#527 — Remove classic branch protection requiring 'Analyze (python)' — blocks PRs CodeQL skips; standard requires rulesets only	2026-10-02		—
#443 — Adopt canonical apply-repo-settings stub; delete diverged fork (org std .github#984)	2026-08-19		—
#358 — 🧭 Idea Promotion Queue	2026-07-13	idea-triage	—
#338 — [Phase 4] Onboarding activation instrumentation and funnel report	2026-07-01	initiative	—
#337 — [Phase 4] Role-adaptive tutorial content with a safe default	2026-07-01	initiative	—
#336 — [Phase 3] The five tutorial steps producing a real persisted 3-item artifact	2026-07-01	initiative	—
#335 — [Phase 2] Scripted tutorial step engine driving avatar prompts and awaiting user interaction	2026-07-01	initiative	—
#334 — [Phase 1] Gated tutorial session type: first-launch detection, skip, and replay	2026-07-01	initiative	—
#333 — Guided Interactive Onboarding: avatar-led learn-by-doing first session	2026-07-01	initiative	—
#177 — Scorecard: Branch-Protection (8/10)	2026-05-17	scorecard	—

combsmith/bmad-bgreat-suite (3 issues)

Issue	Opened	Labels	Linked PR
#521 — Scorecard: Branch-Protection (0/10)	2026-10-26	scorecard	—
#369 — 🧭 Idea Promotion Queue	2026-07-13	idea-triage	—
#336 — Scorecard: Code-Review (8/10)	2026-06-22	scorecard	—

combsmith/broodly (13 issues)

Issue	Opened	Labels	Linked PR
#623 — [Fleet Monitor] combsmith/broodly — .github/workflows/pr-auto-review.yml	2026-10-27	health-check, dev-lead, fleet-tracker	—
#622 — [Fleet Monitor] combsmith/broodly — dynamic/dependabot/dependabot-updates	2026-10-27	health-check, dev-lead, fleet-tracker	—
#618 — [Fleet Monitor] combsmith/broodly — .github/workflows/ci.yml	2026-10-25	health-check, dev-lead, fleet-tracker	—
#617 — [Fleet Monitor] combsmith/broodly — .github/workflows/dependency-audit.yml	2026-10-25	health-check, dev-lead, fleet-tracker	—
#614 — SonarCloud: miscellaneous findings	2026-10-20	security, dev-lead, sonarcloud-audit, priority:blocker	#624
#591 — PR #34 follow-ups: SonarCloud new-code coverage & duplication quality gate	2026-10-09		—
#589 — Scorecard: Code-Review (7/10)	2026-10-05	scorecard	—
#568 — Compliance: ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	2026-09-18	compliance-audit, compliance-finding, dev-lead:hands-off	—
#567 — Compliance: ruleset-drift-pr-quality-require_code_owner_review	2026-09-18	compliance-audit, compliance-finding, dev-lead:hands-off	—
#556 — Compliance: ruleset-drift-pr-quality-require_last_push_approval	2026-09-11	compliance-audit, compliance-finding, dev-lead:hands-off	—
#447 — Scorecard: Vulnerabilities (5/10)	2026-07-27	scorecard	—
#395 — Scorecard: Pinned-Dependencies (5/10)	2026-07-14	scorecard	—
#196 — Scorecard: Branch-Protection (0/10)	2026-05-17	scorecard	—

combsmith/broodminder-data (11 issues)

Issue	Opened	Labels	Linked PR
#232 — [Fleet Monitor] combsmith/broodminder-data — .github/workflows/ci.yml	2026-10-28	dev-lead, fleet-tracker, health-check	—
#231 — [Fleet Monitor] combsmith/broodminder-data — .github/workflows/sonarcloud.yml	2026-10-28	dev-lead, fleet-tracker, health-check	—
#229 — LocalStore materializes every uncovered 180-day window for an unbounded caller-supplied interval	2026-10-28	security	#230
#228 — Gzip readers in bm/battery.py and LocalStore have no bound on decompressed size or line length (decompression bomb)	2026-10-28	security	#230
#216 — Scorecard: Vulnerabilities (7/10)	2026-10-26	scorecard	—
#215 — [Fleet Monitor] combsmith/broodminder-data — .github/workflows/dependency-audit.yml	2026-10-25	dev-lead, fleet-tracker, health-check	—
#210 — SonarCloud: shell script hygiene	2026-10-20	dev-lead, sonarcloud-audit, priority:major	#227
#208 — Scorecard: Branch-Protection (8/10)	2026-10-19	scorecard	—
#204 — Compliance: stub-surface-drift-persona-mention.yml-on	2026-10-16	dev-lead, compliance-audit, compliance-finding	#207
#181 — dev-lead: deferred review findings	2026-10-10		—
#173 — Scorecard: Code-Review (6/10)	2026-10-05	scorecard	—

combsmith/empower-personal-dashboard (showing 25 of 27 issues)

Issue	Opened	Labels	Linked PR
#156 — [Fleet Monitor] combsmith/empower-personal-dashboard — .github/workflows/dependency-audit.yml	2026-10-28	dev-lead, fleet-tracker, health-check	—
#148 — Beancount append guard trusts a window marker substring found anywhere in ledger text, including transaction descriptions	2026-10-28	security	#150
#147 — Beancount include directives interpolate filenames without escaping quotes or newlines	2026-10-28	security	#152
#145 — Beancount append planning reclassifies all transactions once per traded position (quadratic)	2026-10-28	security	#151
#144 — Beancount map loader stringifies non-scalar YAML values, so alias-expanded collections can exhaust memory	2026-10-28	security	#151
#143 — Beancount export inserts account currency into commodity positions without validation (directive injection)	2026-10-28	security	#152
#142 — Beancount mapper inserts configured account targets into open directives and postings without account-name validation	2026-10-28	security	#152
#141 — Existing-holdings parser classifies reconciliation blocks by a phrase anywhere in the block, misreading ordinary payees	2026-10-28	security	#150
#140 — MCP transaction cache never evicts entries and keys equivalent unlimited-export requests differently	2026-10-28	security	#151
#139 — Beancount export inserts date fields without canonical date validation (directive injection)	2026-10-28	security	#152
#138 — Session load follows symlinks and lets the session file override the auth origin, redirecting password submission	2026-10-28	security	#153
#137 — Beancount append dedup compares escaped metadata to raw transaction IDs, so IDs needing escaping are re-posted	2026-10-28	security	#150
#136 — MCP server has no client authentication when served over HTTP/SSE, exposing the owner's financial session	2026-10-28	security	#149
#135 — CSV exports don't neutralize formula-leading cells (CSV/formula injection)	2026-10-28	security	#154
#134 — Detailed financial log file is created without owner-only (0600) permissions	2026-10-28	security	#153
#133 — MCP export_data checks export-root containment before fetching but re-resolves the path at write time (TOCTOU)	2026-10-28	security	#153
#132 — Session save re-resolves validated directory paths at write time (TOCTOU on ancestor rename)	2026-10-28	security	#153
#131 — Balance report prints imported account/institution names without stripping terminal control sequences	2026-10-28	security	#154
#127 — CLI JSONL transaction summary emits schema-invalid mode="historical"	2026-10-27		#128
#126 — Promote mutation testing to a required CI check (post-#124 validation cycle)	2026-10-27		—
#125 — Mutation threshold checker: key modules by path, not file basename	2026-10-27		#129
#122 — Scorecard: Vulnerabilities (7/10)	2026-10-26	scorecard	—
#121 — [Fleet Monitor] combsmith/empower-personal-dashboard — .github/workflows/ci.yml	2026-10-26	dev-lead, fleet-tracker, health-check	—
#120 — [Fleet Monitor] combsmith/empower-personal-dashboard — .github/workflows/sonarcloud.yml	2026-10-26	dev-lead, fleet-tracker, health-check	—
#58 — Scorecard: Pinned-Dependencies (2/10)	2026-10-05	scorecard	—

combsmith/google-app-scripts (10 issues)

Issue	Opened	Labels	Linked PR
#650 — [Fleet Monitor] combsmith/google-app-scripts — .github/workflows/coverage.yml	2026-10-26	health-check, dev-lead, fleet-tracker	—
#647 — [Fleet Monitor] combsmith/google-app-scripts — .github/workflows/dependency-audit.yml	2026-10-25	health-check, dev-lead, fleet-tracker	—
#615 — Scorecard: Code-Review (6/10)	2026-10-05	scorecard	—
#600 — Compliance: ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	2026-09-25	compliance-audit, dev-lead:hands-off, compliance-finding	—
#583 — Compliance: ruleset-drift-pr-quality-require_last_push_approval	2026-09-11	compliance-audit, dev-lead:hands-off, compliance-finding	—
#549 — Adopt canonical apply-repo-settings stub; delete diverged fork (org std .github#984)	2026-08-19		—
#480 — autofix workflow fails on any PR touching .github/workflows/ (App lacks workflows permission) — blocks standards-sync convergence	2026-07-22		—
#439 — Scorecard: Pinned-Dependencies (5/10)	2026-07-14	scorecard	—
#375 — main branch protection deadlocks workflow-only PRs (app-pinned build-and-test required by ruleset + classic protection, no bypass)	2026-06-08		—
#278 — Scorecard: Branch-Protection (5/10)	2026-05-17	scorecard	—

combsmith/incubator (2 issues)

Issue	Opened	Labels	Linked PR
#199 — Scorecard: Code-Review (5/10)	2026-10-26	scorecard	—
#198 — Scorecard: Branch-Protection (8/10)	2026-10-26	scorecard	—

combsmith/markets (6 issues)

Issue	Opened	Labels	Linked PR
#518 — Scorecard: Code-Review (5/10)	2026-10-05	scorecard	—
#482 — Compliance: ruleset-bypass-dependabot-code-quality	2026-09-11	compliance-audit, dev-lead:hands-off, compliance-finding	—
#481 — Compliance: ruleset-bypass-orgadmin-code-quality	2026-09-11	compliance-audit, dev-lead:hands-off, compliance-finding	—
#428 — Adopt canonical apply-repo-settings stub; delete diverged fork (org std .github#984)	2026-08-19		—
#320 — Scorecard: Pinned-Dependencies (2/10)	2026-07-14	scorecard	—
#175 — Scorecard: Branch-Protection (8/10)	2026-05-17	scorecard	—

combsmith/repo-template (4 issues)

Issue	Opened	Labels	Linked PR
#257 — dev-lead: deferred review findings	2026-10-20		—
#232 — Advisory review-bot notices (Qodo trial ended) — org-admin follow-up	2026-10-08		—
#230 — Scorecard: Code-Review (5/10)	2026-10-05	scorecard	—
#1 — Scorecard: Branch-Protection (8/10)	2026-06-29	scorecard	—

combsmith/software-factory (showing 25 of 46 issues)

Issue	Opened	Labels	Linked PR
#381 — A narrow queue App, combsmith-sf-queue, enqueues and dequeues with contents and pull-request write alone (P-2)	2026-10-28		—
#376 — The shell hook parser misses substitutions in quoted redirection operands and in expanded heredoc bodies	2026-10-28	security	—
#375 — context_eval.py follows symlinks in the agent-edited checkout when extracting test names, reading outside the scratch tree	2026-10-28	security	—
#374 — commits_are_the_maintainers.py takes self-declared Git author and committer identity as proof of maintainer authorship	2026-10-28	security	—
#373 — The executor takes the model's severity for a rubric-linked finding instead of the rubric's, so a downgrade skips the blocking thread	2026-10-28	security	—
#372 — redact_trial.py splits on the first header block only; a second response header block leaves credential JSON unredacted	2026-10-28	security	—
#371 — check_workflows.py discards list-item-shaped lines without YAML scalar context, so a run: command can pass with a different command than the one checked	2026-10-28	security	—
#370 — check_trials.py's credential regex goes quadratic on overlapping auth-word and JWT-prefix suffixes	2026-10-28	security	—
#369 — check_context.py's unanchored title regex goes quadratic on an unclosed curly quote	2026-10-28	security	—
#368 — The label reader drops App provenance, so an App acting on a writer's token can clear controls reserved to people	2026-10-28	security	—
#367 — trial_p39_reach.sh checks its output directory is absent, then mkdir -p accepts one created in between	2026-10-28	security	—
#366 — CodeRabbit's approval follows from its threads being resolved, so it is never counted as a review, and no Role resolves another reviewer's thread	2026-10-28		—
#365 — Evals: the held-out manifest holds its Finding and right-change counts, so the cutover's split is held (#363's Muse read)	2026-10-28		—
#362 — Pause: read the org's FACTORY_PAUSED through the repo's list of org variables, as P-52 found	2026-10-27		—
#361 — SonarCloud: shell script hygiene	2026-10-27	sonarcloud-audit, dev-lead, priority:major	—
#360 — SonarCloud: code security review (pythonsecurity)	2026-10-27	sonarcloud-audit, dev-lead, security, priority:critical	—
#359 — SonarCloud: miscellaneous findings	2026-10-27	sonarcloud-audit, dev-lead, priority:critical	—
#351 — Scorecard: Dependency-Update-Tool (0/10)	2026-10-26	scorecard	—
#350 — Scorecard: Code-Review (0/10)	2026-10-26	scorecard	—
#349 — Scorecard: Branch-Protection (3/10)	2026-10-26	scorecard	—
#346 — Kernel: a Lens review whose applied/1 is past retention on an open pull request is asked for again	2026-10-26		—
#342 — Acceptance: a pull request the Factory opens is bound to its issue by the Run that opened it	2026-10-26		—
#314 — Design: a Run with tools cannot both hide the model credential and hold writes (P-26, P-50, P-51); choose the run job's shape before the first Intent with tools	2026-10-22		—
#309 — Workflows: eval.yml runs the review Intent's held-out cases and writes eval-report/1	2026-10-22		—
#305 — Credentials: each stored credential's age read, and one alert near its limit (L-37)	2026-10-22		—

combsmith/software-factory-canary (showing 25 of 30 issues)

Issue	Opened	Labels	Linked PR
#67 — [Fleet Monitor] combsmith/software-factory-canary — .github/workflows/machine-user-approves.yml	2026-10-28	dev-lead, fleet-tracker, health-check	—
#52 — Trial P-48: issue B, named only after the approval	2026-10-21		—
#51 — Trial P-48: issue A, which the pull request closes from the start	2026-10-21		#53
#33 — Scorecard: License (0/10)	2026-10-19	scorecard	—
#31 — Scorecard: Code-Review (5/10)	2026-10-19	scorecard	—
#30 — Scorecard: Branch-Protection (6/10)	2026-10-19	scorecard	—
#24 — Compliance: gitignore_baseline	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#23 — Compliance: secret_scan_ci_job_present	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#22 — Compliance: missing-copilot-instructions	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#21 — Compliance: missing-copilot-setup-steps	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#20 — Compliance: missing-agents-md	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#19 — Compliance: missing-claude-md	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#18 — Compliance: missing-codeowners	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#17 — Compliance: missing-code-quality	2026-10-16	dev-lead:hands-off, compliance-audit, compliance-finding	—
#16 — Compliance: missing-pr-quality	2026-10-16	dev-lead:hands-off, compliance-audit, compliance-finding	—
#15 — Compliance: has_discussions	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#14 — Compliance: has_wiki	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#13 — Compliance: delete_branch_on_merge	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#12 — Compliance: allow_auto_merge	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#11 — Compliance: missing-config	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#10 — Compliance: missing-initiative-driver.yml	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#9 — Compliance: missing-pr-auto-review.yml	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#8 — Compliance: missing-feature-ideation.yml	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#7 — Compliance: missing-pr-review-mention.yml	2026-10-16	compliance-audit, compliance-finding, dev-lead	—
#6 — Compliance: missing-agent-shield.yml	2026-10-16	compliance-audit, compliance-finding, dev-lead	—

combsmith/worldchest (11 issues)

Issue	Opened	Labels	Linked PR
#20 — Scorecard: Code-Review (2/10)	2026-10-26	scorecard	—
#19 — Scorecard: Branch-Protection (0/10)	2026-10-26	scorecard	—
#15 — [Phase 3] FR-8: Results into brief §6 and the decision comment	2026-10-21	dev-lead:hands-off, initiative, initiative:hold	—
#14 — [Phase 2] FR-7: Mojang native-backup watch (time-boxed, dated checks)	2026-10-21	dev-lead:hands-off, initiative, initiative:hold	—
#13 — [Phase 2] FR-4: Share-sheet .mcworld round trip on Android 15 and iOS (one-day time-box)	2026-10-21	dev-lead:hands-off, initiative, initiative:hold	—
#12 — [Phase 2] FR-3: Shizuku hallway test — three non-technical parents, unaided	2026-10-21	dev-lead:hands-off, initiative, initiative:hold	—
#11 — [Phase 2] FR-2: Five parent interviews, recruited regardless of incident history	2026-10-21	dev-lead:hands-off, initiative, initiative:hold	—
#10 — [Phase 2] FR-1: Fake door on worldchest.app — pre-register thresholds, launch, record conversion	2026-10-21	dev-lead:hands-off, initiative, initiative:hold	—
#9 — [Phase 2] FR-5: EULA and Usage Guidelines note + written question to Mojang	2026-10-21	dev-lead:hands-off, initiative, initiative:hold	—
#8 — [Phase 1] FR-6: Brand-compliance checklist for everything the programme publishes	2026-10-21	dev-lead:hands-off, initiative, initiative:hold	—
#7 — WorldChest — one-week evidence programme (brief §6 tests 1–5, decision return)	2026-10-21	initiative	—

Open Discussions

none

Superseded by the newer daily Org Status snapshot.

Navigation Menu

Repository navigation

Org Status — 2026-10-28 #1425

Org Summary — 2026-10-28

Open PRs — Why They're Unmerged (64 total)

PR Merge Activity — Last 8 Days

Open PRs — Needs Human Review

Open PRs — Automation (Dependency Bumps)

Open Issues (425 total)

combsmith/.github (showing 25 of 95 issues)

combsmith/.github-private (showing 25 of 150 issues)

combsmith/ContentTwin (4 issues)

combsmith/TalkTerm (13 issues)

combsmith/bmad-bgreat-suite (3 issues)

combsmith/broodly (13 issues)

combsmith/broodminder-data (11 issues)

combsmith/empower-personal-dashboard (showing 25 of 27 issues)

combsmith/google-app-scripts (10 issues)

combsmith/incubator (2 issues)

combsmith/markets (6 issues)

combsmith/repo-template (4 issues)

combsmith/software-factory (showing 25 of 46 issues)

combsmith/software-factory-canary (showing 25 of 30 issues)

combsmith/worldchest (11 issues)

Open Discussions

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Org Status — 2026-10-28 #1425

Description

Org Summary — 2026-10-28

Open PRs — Why They're Unmerged (64 total)

PR Merge Activity — Last 8 Days

Open PRs — Needs Human Review

Open PRs — Automation (Dependency Bumps)

Open Issues (425 total)

combsmith/.github (showing 25 of 95 issues)

combsmith/.github-private (showing 25 of 150 issues)

combsmith/ContentTwin (4 issues)

combsmith/TalkTerm (13 issues)

combsmith/bmad-bgreat-suite (3 issues)

combsmith/broodly (13 issues)

combsmith/broodminder-data (11 issues)

combsmith/empower-personal-dashboard (showing 25 of 27 issues)

combsmith/google-app-scripts (10 issues)

combsmith/incubator (2 issues)

combsmith/markets (6 issues)

combsmith/repo-template (4 issues)

combsmith/software-factory (showing 25 of 46 issues)

combsmith/software-factory-canary (showing 25 of 30 issues)

combsmith/worldchest (11 issues)

Open Discussions

Activity

don-petry commented on Oct 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions