Skip to content

Org Status — 2026-10-29 #1429

Open
Open
Org Status — 2026-10-29#1429
Labels
daily-reportDaily automated org status report

Description

@don-petry
don-petry
opened on Oct 29, 2026

@org-leads

Org Summary — 2026-10-29

Metric Value
Total open PRs 64
PRs needing rebase 26
Total open issues 405
PR merges (last 8 days) 145
Open discussions 0 
pie title Open PRs by Status
    "CI Failing" : 24
    "Awaiting Review" : 21
    "Changes Requested" : 9
    "Draft" : 6
    "No CI / No Policy" : 4
Loading

Open PRs — Why They're Unmerged (64 total)

xychart-beta
    title "Open PRs by Blocker Category"
    x-axis ["CI Failing", "Awaiting Review", "Changes Requested", "Draft", "No CI / No Policy"]
    y-axis "Count"
    bar [24, 21, 9, 6, 4]
Loading 
xychart-beta
    title "Open PRs per Repo by Category"
    x-axis [".github", ".github-private", "software-factory", "empower-personal-dashboard", "broodly", "broodminder-data", "TalkTerm", "google-app-scripts", "repo-template", "software-factory-canary"]
    y-axis "PRs"
    bar [0, 0, 4, 0, 0, 0, 0, 0, 0, 0]
    bar [10, 4, 0, 3, 0, 0, 3, 0, 0, 1]
    bar [1, 9, 3, 1, 1, 5, 1, 2, 1, 0]
    bar [0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
Loading

PR Merge Activity — Last 8 Days

xychart-beta
    title "combsmith Merges — Last 8 Days"
    x-axis ["Oct-22","Oct-23","Oct-24","Oct-25","Oct-26","Oct-27","Oct-28","Oct-29"]
    y-axis "Merges"
    bar [36,4,2,29,14,18,21,21]
Loading
Repo Oct-22 Oct-23 Oct-24 Oct-25 Oct-26 Oct-27 Oct-28 Oct-29 Total
combsmith/software-factory 24 4 0 0 7 11 7 10 63
combsmith/empower-personal-dashboard 1 0 0 5 1 2 3 5 17
combsmith/.github 1 0 0 3 1 0 7 2 14
combsmith/incubator 3 0 0 6 1 0 1 0 11
combsmith/bmad-bgreat-suite 0 0 1 5 1 0 0 0 7
combsmith/broodminder-data 0 0 0 2 0 3 1 0 6
combsmith/software-factory-canary 0 0 0 0 0 2 1 3 6
combsmith/.github-private 3 0 0 1 0 0 0 1 5
combsmith/google-app-scripts 3 0 0 1 0 0 1 0 5
combsmith/broodly 0 0 0 1 3 0 0 0 4
combsmith/ContentTwin 0 0 1 1 0 0 0 0 2
combsmith/worldchest 1 0 0 1 0 0 0 0 2
combsmith/TalkTerm 0 0 0 1 0 0 0 0 1
combsmith/markets 0 0 0 1 0 0 0 0 1
combsmith/repo-template 0 0 0 1 0 0 0 0 1
TOTAL 36 4 2 29 14 18 21 21 145

Grand total: 145 merges over 8 days. Trend: Increasing.

Open PRs — Needs Human Review

Repo PR Opened CI Approvals
combsmith/TalkTerm #8 — feat: Epic 13 (Structured Questions) + Epic 14 (Native STT) 2026-03-24 FAIL 0
combsmith/broodly #36 — Epic 10: Planning & Weekly Queue (Stories 10.1–10.5) 2026-03-30 FAIL 0
combsmith/TalkTerm #468 — feat: implement issue #466 — [Fleet Monitor] petry-projects/TalkTerm — .github/workflows/pr-auto-review.yml 2026-08-31 PASS 0
combsmith/.github-private #1730 — feat: implement issue #1713 — [#1269 split 1/2] shadow_mode input + total PR-output suppression (inert, nothing dispatched) 2026-09-08 PASS 0
combsmith/.github #1116 — feat: implement issue #1115 — [bug] dismiss-stale-bot-reviews is missing from this repo — a stale bot CHANGES_REQUESTED blocks PRs forever (blocking #1094) 2026-09-12 PASS 1
combsmith/.github-private #1770 — feat: implement issue #1766 — [bug] pr-review approves PRs with unresolved threads (violates its own decision gate 4) and double-reviews the same SHA 2026-09-12 FAIL 0
combsmith/.github #1117 — feat: implement issue #1103 — cmd_rollback moves the bare / tag, not /v- — the emergency lever is a silent no-op for every v-scoped agent 2026-09-13 PASS 0
combsmith/.github-private #1796 — feat: implement issue #1733 — feature-ideation.yml: every run fails at 'Install Python jsonschema' — requirements file missing from the pinned tooling checkout 2026-09-13 FAIL 0
combsmith/.github #1218 — feat: implement issue #1202 — [Phase 1] safety-checks lib with sc_description_missing 2026-10-01 PASS 0
combsmith/.github-private #2135 — feat: implement issue #1973 — [Engine config · Phase 1] Versioned config/ai-engines.json as the single source of truth for providers, model catalog and per-task chains 2026-10-09 FAIL 0
combsmith/.github-private #2217 — feat: implement issue #2211 — dev-lead fix-bot-comment built a commit that undoes the PR's whole diff — the no-op guard caught it, but PR #2198 was held with its fix intact 2026-10-10 PASS 0
combsmith/.github-private #2218 — feat: implement issue #2216 — dev-lead: an agent session can leave base-branch content in the PR worktree, and the harness commits it (follow-up to #2211) 2026-10-10 PASS 0
combsmith/.github #1299 — feat: implement issue #1296 — Standards sweep reuses a same-date sync branch as-is — a narrower second run opens a PR carrying the first run's commits 2026-10-11 PASS 0
combsmith/.github-private #2260 — feat: implement issue #2232 — Sync-stub guard for rebase passes: after the rebase, restore a synced stub left in a third state (check and restore, no push blocker) — the rebase half of #2212 2026-10-11 PASS 0
combsmith/.github-private #2318 — Potential fix for code scanning alert no. 41: Checkout of untrusted code in a non-privileged context 2026-10-12 FAIL 0
combsmith/broodminder-data #194 — feat: implement issue #193 — SonarCloud: shell script hygiene 2026-10-13 FAIL 0
combsmith/google-app-scripts #627 — fix(ci): add pr-review.yml to .prettierignore and use GH_PAT_WORKFLOWS for autofix pushes 2026-10-13 FAIL 0
combsmith/TalkTerm #549 — feat: implement issue #548 — Compliance: verbatim-stub-drift-initiative-driver.yml 2026-10-18 PASS 0
combsmith/.github-private #2366 — chore: sync 3 org-standard workflow stub(s) from combsmith/.github 2026-10-19 FAIL 1
combsmith/empower-personal-dashboard #110 — feat: implement issue #108 — [Fleet Monitor] combsmith/empower-personal-dashboard — .github/workflows/pr-auto-review.yml 2026-10-22 FAIL 1
combsmith/.github #1378 — feat(standards): include GEMINI.md in agent configuration standard and audit 2026-10-26 PASS 0
combsmith/.github #1383 — feat: implement issue #1361 — SonarCloud: code security review (pythonsecurity) 2026-10-27 PASS 0
combsmith/.github #1411 — feat(audit): weekly CodeQL audit that files code-scanning alerts as issues 2026-10-28 FAIL 0
combsmith/.github #1417 — fix(security): scope SONAR_TOKEN to scan steps and fail unanalysed fork PRs (#1390, #1392) 2026-10-28 PASS 0
combsmith/.github #1418 — fix(security): keep Discussion writes out of the feature-ideation model job (#1389) 2026-10-28 PASS 0
combsmith/.github #1419 — fix(security): workflow/CI hardening batch (#1384, #1391, #1396, #1405) 2026-10-28 PASS 0
combsmith/.github #1421 — fix(security): gate Dependabot approve/merge on check success and commit provenance (#1399, #1400) 2026-10-28 PASS 0
combsmith/.github #1423 — fix(security): restrict canary rollback to registered mutable channels (#1402) 2026-10-28 PASS 0
combsmith/.github #1426 — feat: implement issue #1343 — Compliance audit — 2026-10-16 2026-10-29 PASS 0

Open PRs — Automation (Dependency Bumps)

Repo # Dep PRs
combsmith/broodminder-data 2
combsmith/.github 1

Open Issues (405 total)

combsmith/.github (showing 25 of 84 issues)

Issue Opened Labels Linked PR
#1425 — Org Status — 2026-10-28 2026-10-28 daily-report —
#1410 — Allow durable repo-specific required checks (code-quality is overwritten weekly; extra rulesets are flagged as legacy) 2026-10-28 #1428
#1406 — dependency-audit-reusable: the required check is ecosystem discovery, not the scanners' outcome 2026-10-28 security, in-progress —
#1405 — agent-shield-reusable runs the scanner via npm inside the PR checkout, so a PR's .npmrc can neuter the scan 2026-10-28 security, in-progress #1419
#1402 — canary-rollout.sh rollback force-moves any destination tag, including immutable release tags, without checking it is a channel 2026-10-28 security, in-progress #1423
#1400 — dependabot-automerge-reusable approves the whole PR from first-commit Dependabot metadata, including later non-Dependabot commits 2026-10-28 security, in-progress #1421
#1399 — dependabot-rebase-reusable merges with the bypass App after checks complete without requiring successful conclusions 2026-10-28 security, in-progress #1421
#1396 — auto-rebase-reusable: PR base branch name is pasted unescaped into the published recovery shell command 2026-10-28 security, in-progress #1419
#1392 — sonarcloud.yml runs the PR's Python test code with the SonarCloud token in the job environment 2026-10-28 security, in-progress #1417
#1391 — dev-lead-retrigger.sh trusts the dev-lead/ branch prefix as proof of agent activity; fork PRs can suppress compliance retriggers 2026-10-28 security, in-progress #1419
#1390 — standards sonarcloud.yml passes the required check when SONAR_TOKEN is unavailable, so fork PRs skip analysis permanently 2026-10-28 security, in-progress #1417
#1389 — feature-ideation: model with Discussion-write token can bypass dry_run and the target-Discussion guard via its Bash tool 2026-10-28 security, in-progress #1418
#1384 — classify-initiative.sh echoes untrusted issue/PR titles raw to runner stdout, so a title can inject workflow commands 2026-10-28 security, in-progress #1419
#1380 — Scorecard: Vulnerabilities (7/10) 2026-10-26 scorecard —
#1361 — SonarCloud: code security review (pythonsecurity) 2026-10-20 security, dev-lead, sonarcloud-audit, priority:major #1383
#1352 — Exclude combsmith/software-factory from the compliance audit, the scorecard and the fleet monitor 2026-10-19 —
#1343 — Compliance audit — 2026-10-16 2026-10-16 compliance-audit, dev-lead #1426
#1335 — dev-lead: deferred review findings 2026-10-14 —
#1328 — Standards channel standards/v1-stable is behind main — promote it 2026-10-12 —
#1327 — Fix initiative-driver cooldown and daily budget to count actual dispatches 2026-10-12 —
#1326 — initiative-driver template omits issue labels from the rate-limit gate 2026-10-12 —
#1325 — Restore initial PR review triggering in the standard pr-review caller 2026-10-12 —
#1324 — canary-rollout: with two candidates in flight, no command can advance an upper ring pair past a BLOCKED gate, and an API-outage failure is a permanent REGRESSION 2026-10-12 bug —
#1322 — feature-ideation template: the Discussion bridge stays green when the dispatched ideate run fails (move the fix out of the .github-private stub) 2026-10-11 bug —
#1321 — software-factory: record where it departs from the org standards, and exempt it from the matching audit findings 2026-10-11 —

combsmith/.github-private (showing 25 of 148 issues)

Issue Opened Labels Linked PR
#2416 — combsmith — workflow failures detected 2026-10-29 2026-10-29 health-check, automated-report —
#2415 — Stalled PR candidate(s) detected 2026-10-29 2026-10-29 health-check, automated-report —
#2414 — Runaway PR candidate(s) detected 2026-10-29 2026-10-29 health-check, automated-report —
#2413 — PR Review Agent — failures detected 2026-10-29 2026-10-29 health-check, automated-report —
#2395 — Engine-token preflight — FLEET-WIDE OUTAGE (#1587) 2026-10-23 dev-lead, engine-outage —
#2367 — Scorecard: SAST (9/10) 2026-10-19 enhancement, scorecard —
#2358 — Docs Health Check — stale files detected 2026-10-18 2026-10-18 health-check, automated-report —
#2353 — Compliance: open_secret_alerts 2026-10-16 compliance-audit, dev-lead, compliance-finding —
#2329 — Budget breaker: a 404 from a delete the operator already made turns a successful resume or roll-back into a red run with a wrong message, and the resume notice is never posted 2026-10-14 bug —
#2327 — [ADR-0007] Record the markets pilot's measured baseline and post-collapse cost in the package (§1, §7, §11) 2026-10-14 documentation, dev-lead #2328
#2315 — Give the dev-lead sidecar directory a per-session default in the suite hooks, so a suite that forgets the export does not write to shared /tmp 2026-10-12 enhancement —
#2309 — dev-lead and CodeRabbit reply to each other without end on a thread dev-lead has declined (44 rounds on PR #1796; stopped only by the API rate limit) 2026-10-11 bug —
#2306 — Budget breaker: wake it only when there is something to decide, instead of on every Dev-Lead Agent run 2026-10-11 enhancement —
#2302 — review-one-pr.sh keeps its working files in the fixed directory /tmp/cascade, so concurrent test sessions (and concurrent reviews on one machine) share it 2026-10-11 bug —
#2301 — Freeze the orphaned dev-lead/v1-* channel tags with a tombstone release, so a wrong repin fails loudly at startup instead of running a September build 2026-10-11 enhancement —
#2294 — dev-lead pushes to a pull request opened with dev-lead:hands-off: the pr-opened path classifies review-changes before the label is visible 2026-10-11 bug —
#2282 — fleet-paused notice jobs print the pause variables with their line breaks, so a multi-line value starts a second workflow command 2026-10-11 enhancement, security —
#2280 — Auto-rebase health report: the base-merge necessity counters always read 0, so the report cannot show whether base merges are happening 2026-10-11 bug —
#2276 — Epic: fixes to the current factory that are worth making whatever is rebuilt (lessons from the factory MVP review) 2026-10-11 enhancement —
#2273 — dev-lead issue runs fail in repos with commitlint when the issue title is long — the commit header is the full title and exceeds 100 characters 2026-10-11 bug —
#2258 — Nine of nine persona manifests are still status: draft — decide and record what advances business-analyst (and the rest) now that the router reaches a stable-ring repo 2026-10-11 enhancement —
#2253 — qa-lead never advises a PR that was opened with merge conflicts — pull_request.opened does not run, and synchronize is deliberately not subscribed 2026-10-11 enhancement —
#2251 — Budget breaker: close the gaps found in review before it is armed (race with a human pause, pagination, hold on a bad timestamp, lost notice, live API checks) 2026-10-11 enhancement —
#2247 — Stale-disposition retry cap does not count a fix-reviews pass that dies before posting any marker (follow-up to the edited-comment deadlock fix) 2026-10-11 bug, dev-lead #2290
#2235 — CI Failure Analyst never runs for failed GitHub Actions jobs: the check_run trigger only fires for third-party checks 2026-10-11 bug, dev-lead —

combsmith/ContentTwin (4 issues)

Issue Opened Labels Linked PR
#482 — dev-lead: deferred review findings 2026-10-09 —
#465 — Compliance: stub-surface-drift-agent-shield.yml-on 2026-09-25 compliance-audit, dev-lead, dev-lead:needs-human, compliance-finding —
#158 — Scorecard: Code-Review (6/10) 2026-05-17 scorecard —
#157 — Scorecard: Branch-Protection (8/10) 2026-05-17 scorecard —

combsmith/TalkTerm (13 issues)

Issue Opened Labels Linked PR
#556 — [Fleet Monitor] combsmith/TalkTerm — .github/workflows/ci.yml 2026-10-26 dev-lead, fleet-tracker, health-check —
#548 — Compliance: verbatim-stub-drift-initiative-driver.yml 2026-10-16 compliance-audit, dev-lead, compliance-finding #549
#540 — Scorecard: Code-Review (6/10) 2026-10-12 scorecard —
#527 — Remove classic branch protection requiring 'Analyze (python)' — blocks PRs CodeQL skips; standard requires rulesets only 2026-10-02 —
#443 — Adopt canonical apply-repo-settings stub; delete diverged fork (org std .github#984) 2026-08-19 —
#358 — 🧭 Idea Promotion Queue 2026-07-13 idea-triage —
#338 — [Phase 4] Onboarding activation instrumentation and funnel report 2026-07-01 initiative —
#337 — [Phase 4] Role-adaptive tutorial content with a safe default 2026-07-01 initiative —
#336 — [Phase 3] The five tutorial steps producing a real persisted 3-item artifact 2026-07-01 initiative —
#335 — [Phase 2] Scripted tutorial step engine driving avatar prompts and awaiting user interaction 2026-07-01 initiative —
#334 — [Phase 1] Gated tutorial session type: first-launch detection, skip, and replay 2026-07-01 initiative —
#333 — Guided Interactive Onboarding: avatar-led learn-by-doing first session 2026-07-01 initiative —
#177 — Scorecard: Branch-Protection (8/10) 2026-05-17 scorecard —

combsmith/bmad-bgreat-suite (3 issues)

Issue Opened Labels Linked PR
#521 — Scorecard: Branch-Protection (0/10) 2026-10-26 scorecard —
#369 — 🧭 Idea Promotion Queue 2026-07-13 idea-triage —
#336 — Scorecard: Code-Review (8/10) 2026-06-22 scorecard —

combsmith/broodly (13 issues)

Issue Opened Labels Linked PR
#623 — [Fleet Monitor] combsmith/broodly — .github/workflows/pr-auto-review.yml 2026-10-27 health-check, dev-lead, fleet-tracker —
#622 — [Fleet Monitor] combsmith/broodly — dynamic/dependabot/dependabot-updates 2026-10-27 health-check, dev-lead, fleet-tracker —
#618 — [Fleet Monitor] combsmith/broodly — .github/workflows/ci.yml 2026-10-25 health-check, dev-lead, fleet-tracker —
#617 — [Fleet Monitor] combsmith/broodly — .github/workflows/dependency-audit.yml 2026-10-25 health-check, dev-lead, fleet-tracker —
#614 — SonarCloud: miscellaneous findings 2026-10-20 security, dev-lead, sonarcloud-audit, priority:blocker #624
#591 — PR #34 follow-ups: SonarCloud new-code coverage & duplication quality gate 2026-10-09 —
#589 — Scorecard: Code-Review (7/10) 2026-10-05 scorecard —
#568 — Compliance: ruleset-drift-pr-quality-dismiss_stale_reviews_on_push 2026-09-18 compliance-audit, compliance-finding, dev-lead:hands-off —
#567 — Compliance: ruleset-drift-pr-quality-require_code_owner_review 2026-09-18 compliance-audit, compliance-finding, dev-lead:hands-off —
#556 — Compliance: ruleset-drift-pr-quality-require_last_push_approval 2026-09-11 compliance-audit, compliance-finding, dev-lead:hands-off —
#447 — Scorecard: Vulnerabilities (5/10) 2026-07-27 scorecard —
#395 — Scorecard: Pinned-Dependencies (5/10) 2026-07-14 scorecard —
#196 — Scorecard: Branch-Protection (0/10) 2026-05-17 scorecard —

combsmith/broodminder-data (10 issues)

Issue Opened Labels Linked PR
#232 — [Fleet Monitor] combsmith/broodminder-data — .github/workflows/ci.yml 2026-10-28 dev-lead, fleet-tracker, health-check —
#231 — [Fleet Monitor] combsmith/broodminder-data — .github/workflows/sonarcloud.yml 2026-10-28 dev-lead, fleet-tracker, health-check —
#229 — LocalStore materializes every uncovered 180-day window for an unbounded caller-supplied interval 2026-10-28 security #230
#228 — Gzip readers in bm/battery.py and LocalStore have no bound on decompressed size or line length (decompression bomb) 2026-10-28 security #230
#216 — Scorecard: Vulnerabilities (7/10) 2026-10-26 scorecard —
#215 — [Fleet Monitor] combsmith/broodminder-data — .github/workflows/dependency-audit.yml 2026-10-25 dev-lead, fleet-tracker, health-check —
#208 — Scorecard: Branch-Protection (8/10) 2026-10-19 scorecard —
#204 — Compliance: stub-surface-drift-persona-mention.yml-on 2026-10-16 dev-lead, compliance-audit, compliance-finding #207
#181 — dev-lead: deferred review findings 2026-10-10 —
#173 — Scorecard: Code-Review (6/10) 2026-10-05 scorecard —

combsmith/empower-personal-dashboard (15 issues)

Issue Opened Labels Linked PR
#160 — dev-lead: deferred review findings 2026-10-29 —
#156 — [Fleet Monitor] combsmith/empower-personal-dashboard — .github/workflows/dependency-audit.yml 2026-10-28 dev-lead, fleet-tracker, health-check —
#138 — Session load follows symlinks and lets the session file override the auth origin, redirecting password submission 2026-10-28 security #153
#136 — MCP server has no client authentication when served over HTTP/SSE, exposing the owner's financial session 2026-10-28 security #149
#135 — CSV exports don't neutralize formula-leading cells (CSV/formula injection) 2026-10-28 security #154
#134 — Detailed financial log file is created without owner-only (0600) permissions 2026-10-28 security #153
#133 — MCP export_data checks export-root containment before fetching but re-resolves the path at write time (TOCTOU) 2026-10-28 security #153
#132 — Session save re-resolves validated directory paths at write time (TOCTOU on ancestor rename) 2026-10-28 security #153
#131 — Balance report prints imported account/institution names without stripping terminal control sequences 2026-10-28 security #154
#127 — CLI JSONL transaction summary emits schema-invalid mode="historical" 2026-10-27 #128
#125 — Mutation threshold checker: key modules by path, not file basename 2026-10-27 #129
#122 — Scorecard: Vulnerabilities (7/10) 2026-10-26 scorecard —
#58 — Scorecard: Pinned-Dependencies (2/10) 2026-10-05 scorecard —
#57 — Scorecard: Code-Review (5/10) 2026-10-05 scorecard —
#56 — Scorecard: Branch-Protection (0/10) 2026-10-05 scorecard —

combsmith/google-app-scripts (10 issues)

Issue Opened Labels Linked PR
#651 — [Fleet Monitor] combsmith/google-app-scripts — .github/workflows/playwright-tests.yml 2026-10-29 health-check, dev-lead, fleet-tracker —
#647 — [Fleet Monitor] combsmith/google-app-scripts — .github/workflows/dependency-audit.yml 2026-10-25 health-check, dev-lead, fleet-tracker —
#615 — Scorecard: Code-Review (6/10) 2026-10-05 scorecard —
#600 — Compliance: ruleset-drift-pr-quality-dismiss_stale_reviews_on_push 2026-09-25 compliance-audit, dev-lead:hands-off, compliance-finding —
#583 — Compliance: ruleset-drift-pr-quality-require_last_push_approval 2026-09-11 compliance-audit, dev-lead:hands-off, compliance-finding —
#549 — Adopt canonical apply-repo-settings stub; delete diverged fork (org std .github#984) 2026-08-19 —
#480 — autofix workflow fails on any PR touching .github/workflows/ (App lacks workflows permission) — blocks standards-sync convergence 2026-07-22 —
#439 — Scorecard: Pinned-Dependencies (5/10) 2026-07-14 scorecard —
#375 — main branch protection deadlocks workflow-only PRs (app-pinned build-and-test required by ruleset + classic protection, no bypass) 2026-06-08 —
#278 — Scorecard: Branch-Protection (5/10) 2026-05-17 scorecard —

combsmith/incubator (2 issues)

Issue Opened Labels Linked PR
#199 — Scorecard: Code-Review (5/10) 2026-10-26 scorecard —
#198 — Scorecard: Branch-Protection (8/10) 2026-10-26 scorecard —

combsmith/markets (6 issues)

Issue Opened Labels Linked PR
#518 — Scorecard: Code-Review (5/10) 2026-10-05 scorecard —
#482 — Compliance: ruleset-bypass-dependabot-code-quality 2026-09-11 compliance-audit, dev-lead:hands-off, compliance-finding —
#481 — Compliance: ruleset-bypass-orgadmin-code-quality 2026-09-11 compliance-audit, dev-lead:hands-off, compliance-finding —
#428 — Adopt canonical apply-repo-settings stub; delete diverged fork (org std .github#984) 2026-08-19 —
#320 — Scorecard: Pinned-Dependencies (2/10) 2026-07-14 scorecard —
#175 — Scorecard: Branch-Protection (8/10) 2026-05-17 scorecard —

combsmith/repo-template (4 issues)

Issue Opened Labels Linked PR
#257 — dev-lead: deferred review findings 2026-10-20 —
#232 — Advisory review-bot notices (Qodo trial ended) — org-admin follow-up 2026-10-08 —
#230 — Scorecard: Code-Review (5/10) 2026-10-05 scorecard —
#1 — Scorecard: Branch-Protection (8/10) 2026-06-29 scorecard —

combsmith/software-factory (showing 25 of 52 issues)

Issue Opened Labels Linked PR
#407 — A Finding that cites a rubric criterion: is its category the criterion's, as its severity is? A ruling on §3.14 2026-10-29 —
#406 — Trial scripts: a 201 with an unparseable token is never written or left unrevoked, and the reach script has a test 2026-10-29 —
#401 — Readiness check: each Consumer repo against its entry 2026-10-29 —
#398 — Mutant shards scale with their count: a disjoint share of the named tests for each baseline, and a survivor's whole-suite run kept under the limit 2026-10-29 —
#390 — Design: CodeRabbit runs as an external Lens through its CLI, read as structured Findings, never as comment threads 2026-10-29 —
#388 — A job stopped at its timeout concludes cancelled, so neither a required check nor a Run reads it as timed_out 2026-10-29 —
#381 — A narrow queue App, combsmith-sf-queue, enqueues and dequeues with contents and pull-request write alone (P-2) 2026-10-28 —
#376 — The shell hook parser misses substitutions in quoted redirection operands and in expanded heredoc bodies 2026-10-28 security #395
#375 — context_eval.py follows symlinks in the agent-edited checkout when extracting test names, reading outside the scratch tree 2026-10-28 security #404
#374 — commits_are_the_maintainers.py takes self-declared Git author and committer identity as proof of maintainer authorship 2026-10-28 security —
#373 — The executor takes the model's severity for a rubric-linked finding instead of the rubric's, so a downgrade skips the blocking thread 2026-10-28 security #405
#372 — redact_trial.py splits on the first header block only; a second response header block leaves credential JSON unredacted 2026-10-28 security #404
#371 — check_workflows.py discards list-item-shaped lines without YAML scalar context, so a run: command can pass with a different command than the one checked 2026-10-28 security #392
#370 — check_trials.py's credential regex goes quadratic on overlapping auth-word and JWT-prefix suffixes 2026-10-28 security #404
#369 — check_context.py's unanchored title regex goes quadratic on an unclosed curly quote 2026-10-28 security #404
#368 — The label reader drops App provenance, so an App acting on a writer's token can clear controls reserved to people 2026-10-28 security #402
#367 — trial_p39_reach.sh checks its output directory is absent, then mkdir -p accepts one created in between 2026-10-28 security #404
#366 — CodeRabbit's approval follows from its threads being resolved, so it is never counted as a review, and no Role resolves another reviewer's thread 2026-10-28 #408
#365 — Evals: the held-out manifest holds its Finding and right-change counts, so the cutover's split is held (#363's Muse read) 2026-10-28 —
#362 — Pause: read the org's FACTORY_PAUSED through the repo's list of org variables, as P-52 found 2026-10-27 —
#361 — SonarCloud: shell script hygiene 2026-10-27 sonarcloud-audit, dev-lead, priority:major —
#360 — SonarCloud: code security review (pythonsecurity) 2026-10-27 sonarcloud-audit, dev-lead, security, priority:critical —
#359 — SonarCloud: miscellaneous findings 2026-10-27 sonarcloud-audit, dev-lead, priority:critical —
#351 — Scorecard: Dependency-Update-Tool (0/10) 2026-10-26 scorecard —
#350 — Scorecard: Code-Review (0/10) 2026-10-26 scorecard —

combsmith/software-factory-canary (showing 25 of 30 issues)

Issue Opened Labels Linked PR
#67 — [Fleet Monitor] combsmith/software-factory-canary — .github/workflows/machine-user-approves.yml 2026-10-28 dev-lead, fleet-tracker, health-check —
#52 — Trial P-48: issue B, named only after the approval 2026-10-21 —
#51 — Trial P-48: issue A, which the pull request closes from the start 2026-10-21 #53
#33 — Scorecard: License (0/10) 2026-10-19 scorecard —
#31 — Scorecard: Code-Review (5/10) 2026-10-19 scorecard —
#30 — Scorecard: Branch-Protection (6/10) 2026-10-19 scorecard —
#24 — Compliance: gitignore_baseline 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#23 — Compliance: secret_scan_ci_job_present 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#22 — Compliance: missing-copilot-instructions 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#21 — Compliance: missing-copilot-setup-steps 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#20 — Compliance: missing-agents-md 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#19 — Compliance: missing-claude-md 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#18 — Compliance: missing-codeowners 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#17 — Compliance: missing-code-quality 2026-10-16 dev-lead:hands-off, compliance-audit, compliance-finding —
#16 — Compliance: missing-pr-quality 2026-10-16 dev-lead:hands-off, compliance-audit, compliance-finding —
#15 — Compliance: has_discussions 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#14 — Compliance: has_wiki 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#13 — Compliance: delete_branch_on_merge 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#12 — Compliance: allow_auto_merge 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#11 — Compliance: missing-config 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#10 — Compliance: missing-initiative-driver.yml 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#9 — Compliance: missing-pr-auto-review.yml 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#8 — Compliance: missing-feature-ideation.yml 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#7 — Compliance: missing-pr-review-mention.yml 2026-10-16 compliance-audit, compliance-finding, dev-lead —
#6 — Compliance: missing-agent-shield.yml 2026-10-16 compliance-audit, compliance-finding, dev-lead —

combsmith/worldchest (11 issues)

Issue Opened Labels Linked PR
#20 — Scorecard: Code-Review (2/10) 2026-10-26 scorecard —
#19 — Scorecard: Branch-Protection (0/10) 2026-10-26 scorecard —
#15 — [Phase 3] FR-8: Results into brief §6 and the decision comment 2026-10-21 dev-lead:hands-off, initiative, initiative:hold —
#14 — [Phase 2] FR-7: Mojang native-backup watch (time-boxed, dated checks) 2026-10-21 dev-lead:hands-off, initiative, initiative:hold —
#13 — [Phase 2] FR-4: Share-sheet .mcworld round trip on Android 15 and iOS (one-day time-box) 2026-10-21 dev-lead:hands-off, initiative, initiative:hold —
#12 — [Phase 2] FR-3: Shizuku hallway test — three non-technical parents, unaided 2026-10-21 dev-lead:hands-off, initiative, initiative:hold —
#11 — [Phase 2] FR-2: Five parent interviews, recruited regardless of incident history 2026-10-21 dev-lead:hands-off, initiative, initiative:hold —
#10 — [Phase 2] FR-1: Fake door on worldchest.app — pre-register thresholds, launch, record conversion 2026-10-21 dev-lead:hands-off, initiative, initiative:hold —
#9 — [Phase 2] FR-5: EULA and Usage Guidelines note + written question to Mojang 2026-10-21 dev-lead:hands-off, initiative, initiative:hold —
#8 — [Phase 1] FR-6: Brand-compliance checklist for everything the programme publishes 2026-10-21 dev-lead:hands-off, initiative, initiative:hold —
#7 — WorldChest — one-week evidence programme (brief §6 tests 1–5, decision return) 2026-10-21 initiative —

Open Discussions

none

Activity

  1. don-petry
    added
    daily-reportDaily automated org status report
    on Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    daily-reportDaily automated org status report

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions