Daily Fro Bot Report — 2026-09-25 (UTC)

Run Summary

Category	Status	Notes
Errored PRs	✅	Remediation pass checked #3920 and #3901 (both check runs and legacy statuses); no failures. Re-verified by the scheduled pass (run 36093828964): evidence
Security	⚠️	Re-verified (evidence). No critical/high Dependabot alerts in this repo. 1 medium transitive alert. Scorecard posture findings are open (`BranchProtectionID` and `VulnerabilitiesID` rated high).
Control-Plane Integrity	✅	Re-verified (evidence). SHA pinning, strip-only TS, and top-level `permissions:` verified across all workflows. Guards untouched.
Code Quality	✅	Re-verified (evidence). `bootstrap` / `check-types` / `lint` / `test` all green (3819 passed).
Oversight	⚠️	5 failing default-branch checks, 2 repos with critical alerts, and a large stale remediation-PR backlog.
Cross-Project Intelligence	⚠️	Coverage partial: 30 of 34 tracked entries scanned from wiki repo pages.
Progressive Improvement	⚠️	10 open learning proposals (pipeline stalled). TypeScript and Vitest are one major behind.

Errored PRs

Refreshed 2026-09-25 ~04:25Z by the scheduled pass (run 36093828964). Both remediation passes opened 0 PRs. #3920 is now BLOCKED even though every check is green, which means it is waiting on required review/merge gating rather than a CI failure.

None. The remediation pass opened no PRs. #3901 is green but BEHIND main. Its only change is to .github/workflows/renovate.yaml, so the branch update was left for merge time.

Security

Dependabot #59: @humanfs/node, medium, transitive, patched in 0.16.8. Renovate owns it.
Code scanning: 4 OpenSSF Scorecard posture findings (VulnerabilitiesID high, BranchProtectionID high, FuzzingID, CIIBestPracticesID). These are not code vulnerabilities.

Control-Plane Integrity

Clean. The only broad grant is permissions: read-all in scorecard.yaml, which is the upstream Scorecard pattern and read-only.

Code Quality

Green on main at 5d8f66b.

Oversight

Scope: every public, non-archived repo returned by user/repos (owner + collaborator + org member, paginated). Security is Dependabot only. Not checkable: pro-actions/peter-murray_workflow-application-token-action has Dependabot disabled.

Failing default-branch checks

Repo	Failing check	Next step
bfra-me/github-action	Update Repo Settings	Already tracked in #1611; fix `.github/settings.yml`.
bfra-me/ha-addon-repository	Renovate / Renovate	Read the latest Renovate run log. #569 (settings 500) may be related.
marcusrbrown/containers	Renovate / Renovate	Read the latest Renovate run log.
marcusrbrown/cortexkit_anthropic-auth	Fro Bot	Its autoheal report #11 has not updated since 2026-06-29. The daemon looks dead. Inspect the workflow run.
marcusrbrown/extend-vscode	Pre-Release Validation (vulnerabilities)	This is caused by the alert load below, not a CI bug.

Security alerts (Dependabot, open)

Critical: marcusrbrown/containers (1 critical, 1 high, 5 medium) and marcusrbrown/extend-vscode (1 critical, 34 high).
High: marcusrbrown/gpt 24, marcusrbrown/Presentations 8, bfra-me/github-app 3, marcusrbrown/marcusrbrown 3, marcusrbrown/sparkle 3, marcusrbrown/marcusrbrown.github.io 2, marcusrbrown/cortexkit_anthropic-auth 1.
Next step: each repo's own autoheal owns remediation. The two critical repos should be triaged first.

Stale PRs (created more than 7 days ago with no update in 14+ days). Most are Fro Bot remediation PRs that have gone past their useful life.

marcusrbrown/vbs: 7 fro-bot PRs from July, including 5 fix(security) (#672, #688, #697, #701, #717). Grouped Renovate #740 has been blocked for 32 days.
marcusrbrown/gpt: 15 open PRs, the newest from 2026-07-29. They include the six-PR Ollama-contrast cluster (#2664 through #2692) and HeroUI v3 #2165 (last update 2026-05-10).
bfra-me/github-action #1463, #1466, #1467; bfra-me/github-app #840, #842, #843, #950. These are June security-override PRs, and Action Required: Fix Renovate Configuration #1463/Action Required: Fix Renovate Configuration #1467 are duplicates of each other.
marcusrbrown/containers #723, #727, #740, #744; marcusrbrown/marcusrbrown #1055, #1095, #1100, #1107; marcusrbrown/opencode-copilot-delegate #135, #241, #332, #335; bfra-me/renovate-config #1383 (Copilot, March), #1558; fro-bot/space-bus #72, #130, #135.
Next step: close or rebase them by cohort. A CONFLICTING remediation PR suppresses a fresh refile through the dedup rule, so it counts as exposure, not coverage.

New since yesterday (substantive only)
fro-bot/agent#1663 (workspace container has no init), bfra-me/renovate-action#3835 (stale v9 deprecation notice), and fro-bot/agent#1666 (deterministic termination test). Triage in their repos.

Unassigned bugs
bfra-me/ha-addon-repository#569, marcusrbrown/marcusrbrown.com#465, #517, marcusrbrown/systematic#740, #1005. Assign an owner or fold them into each repo's autoheal queue.

Report sprawl
marcusrbrown/.dotfiles has 4 open daily reports (#2682, #2685, #2695, #2699), which means its close-older step is not running. marcusrbrown/renovate-config still has 3 open weekly reports from February and March.

Stale issues (more than 30 days)
There are many, concentrated in gpt (HeroUI #2162–#2175 and techdebt #2140–#2146, all March), vbs (2025 roadmap #150–#161 and convention drift #670–#694), and extend-vscode (#317–#319). Close or re-scope them in bulk; they are roadmap residue, not active work.

Top 3 hotspots (ranked by finding count)

marcusrbrown/gpt: 15 stale PRs, 24 high alerts, and more than 15 stale issues.
marcusrbrown/vbs: 10 stale PRs (7 are Fro Bot remediation), the grouped update frozen for 32 days, and more than 15 stale issues.
marcusrbrown/extend-vscode: 1 critical and 34 high alerts, a failing default-branch check, and stale roadmap issues.

Cross-Project Intelligence

Coverage is partial. metadata/repos.yaml lists 34 entries. 30 were scanned through their wiki repo pages and the [[github-actions-ci]] topic. marcusrbrown/copiloting is archived and was skipped. 3 entries are excluded from public reporting.

These findings apply to this repo:

Key dedup on merge state, not just on "an open PR exists" (source: vbs and gpt, wiki section A Security Remediation PR Has a Shelf Life, 2026-09-21). This repo's autoheal dedup rule reuses any open Fro Bot PR for the same root cause, so a CONFLICTING remediation PR can block a live refile indefinitely. The fleet-wide stale-PR list above is that failure at scale. Adopt: treat mergeStateStatus: DIRTY older than 14 days as "no usable PR".
Verify tracker claims against deployed truth (source: category 8 below; recorded in the wiki as A Rollup Tracker Whose Structured Source Omits the Rows It Narrates). The Gateway Rollout Tracker preflight keys on Project/issue state, which cannot see drift in rows the Project never held.
Split the Fro Bot workflow into a read-only content job and a privileged scheduled job (source: marcusrbrown/infra, 2026-09-06). Evaluate whether fro-bot.yaml here already separates attacker-reachable triggers from the credentialed autoheal. This is report-only and was not verified this run.

Progressive Improvement

Learning-proposal pipeline stalled. 10 open: #3887–#3891 (11 days old) and #3905–#3909 (4 days old). None has passed 14 days yet; the first cohort does on 2026-09-28. Having two or more open means authoring into docs/solutions/ is not keeping up. #3674 reading healthy is not evidence against this.
Tool-version drift (source: npm registry npm view <pkg> version; major drift included): TypeScript 6.0.3 → 7.0.2 (major), Vitest 4.1.11 → 5.0.1 (major), Prettier 3.9.1 → 3.9.9 (patch, within minor), ESLint 10.11.0 (current). Renovate owns these; check the Dependency Dashboard #2828 for pending majors.
Stale TODO/FIXME: none. The only match is a fixture string in scripts/check-private-leak.test.ts:219.
Wiki lint #3903 has been open since 2026-09-20. Its fix must land through the data branch.

Needs Human Attention

Gateway rollout tracker #3512 is stale (Project 1 status is In Progress, which is consistent). The body claims the deployed gateway is v0.83.0; marcusrbrown/infra apps/gateway/upstream.json shows ref: v0.113.2. The body claims the latest release is v0.85.0; the actual latest is v0.115.1 (2026-09-24). The matrix lists fro-bot/dashboard#179 as Open, but it is CLOSED. Project 1 has no items for dashboard#179, agent#1109, agent#1111, or push #1152–#1165. Health still returns contractVersion 1.6.0, which matches the body. Fix: refresh the body's pin, release, and chore(deps): update bfra-me/renovate-action action to v2.2.4 #179 rows, and add the missing items to Project 1. Tracker writes belong to the Gateway Rollout Tracker workflow, not to this report.
Gateway deploy awaiting manual approval since 2026-09-21T20:02Z: marcusrbrown/infra#1412. This is a human gate.
Critical alerts in marcusrbrown/containers and marcusrbrown/extend-vscode. Triage those first.
Learning proposals: author the 10 open proposals into docs/solutions/ or close the rejected ones.
#3901: update the branch before merging.

Autoheal Remediation Pass: 2026-09-25 (UTC), categories 1–4

Nothing needed fixing, so this run created no branches, commits or PRs. Checks ran against main at 5d8f66b, which includes #3926 (data-branch writes restricted to trusted jobs).

1. Errored PRs: none

PR	Author	Check runs	Legacy statuses	Merge state
#3920 `fro-bot/agent` → v0.115.1	fro-bot (Renovate)	all pass (Fro Bot jobs skipped by design)	`Security: Private Leak Scan` success	MERGEABLE
#3901 renovate global-config comment	fro-bot	all pass	`Security: Private Leak Scan` success	MERGEABLE

2. Security: no critical/high advisories to fix

Dependabot chore(deps): update bfra-me/renovate-config action to v1.13.0 #59: @humanfs/node, GHSA-p498-v437-472g, medium, transitive, dev scope, fixed in 0.16.8. This is below the critical/high bar, so I left it to Renovate and opened no PR.
Code scanning: the only open alerts are repo-level Scorecard findings with no file attached (VulnerabilitiesID, BranchProtectionID, FuzzingID, CIIBestPracticesID). No code fix applies. VulnerabilitiesID should clear once the @humanfs/node bump lands.

3. Control-plane integrity: clean

a. SHA pinning: every third-party uses: in .github/workflows/*.yaml and .github/actions/**/action.yaml is pinned as @<40-char sha> # vX.Y.Z. No floating tags.
b. Strip-only TS: scripts/*.ts has no enum, namespace, parameter properties or import x = aliases. The only grep hit is a comment in scripts/repos-metadata.ts:476 that documents the rule. The Test Scripts Load job passes on both open PRs.
c. Least privilege: every workflow declares a top-level permissions: block, and none uses write-all.
d. Guard integrity: Check Wiki Authority, Security: Private Leak Scan and Check Mutation Guards all run and pass on the open PRs. Nothing was weakened.

4. Code quality: green

pnpm bootstrap ✅ · pnpm check-types ✅ · pnpm lint ✅ · pnpm test ✅ (84 files, 3819 passed, 3 todo). Nothing needed autofixing, and the working tree stayed clean.

Needs Human Attention

None this run. Dependabot chore(deps): update bfra-me/renovate-config action to v1.13.0 #59 depends on Renovate picking up @humanfs/node@0.16.8. If it's still open after the next Renovate cycle, find which dev dependency pulls it in with pnpm why @humanfs/node.

Run Summary

Field	Value
Event	schedule
Run	36093828964
Thread	`schedule-898cd73a-36093828964`
Mode	branch-pr (no mutations required)
PRs inspected	#3920, #3901
Branches / PRs created	0 / 0
Wiki persistence	none (branch-pr mode)

Oversight Pass Refresh: 2026-09-25 ~04:25Z (UTC), categories 5–8

Today's report already existed (dispatch run 36090469764, 03:36Z), so I updated this issue in place instead of opening a second one. #3927 is the only open daily report.

What changed in the body

The Errored PRs, Security, Control-Plane Integrity and Code Quality rows now link to this run's remediation evidence. All four are unchanged: 0 PRs opened, no critical/high alerts, pinning and permissions clean, 3819 tests green.
chore(deps): update fro-bot/agent to v0.115.1 #3920 moved to BLOCKED with every check green. It is waiting on merge gating, not failing CI.

Checked again and still true

Learning-proposal backlog: 10 open (Learning proposal: (e86b0877) #3887–Learning proposal: (31309d62) #3891 at 11 days, Learning proposal: (bd4b7e68) #3905–Learning proposal: (374ddfe7) #3909 at 4 days). The first cohort passes 14 days on 2026-09-28.
#3512 and marcusrbrown/infra#1412 are both still open. The gateway deploy is still waiting on a human approval.
bfra-me/github-action Update Repo Settings still fails on main. marcusrbrown/extend-vscode Publish failed at 2026-09-24T04:33Z.

One caveat on oversight data. Looking at each workflow's latest run on main: bfra-me/ha-addon-repository Renovate succeeded (01:27Z) and marcusrbrown/containers Renovate was skipped. The 03:36Z report marked both as failing because it read check-runs on the HEAD commit, which is a different source. Tomorrow's pass should reconcile which source counts as "failing main". The rest of categories 5–8 is less than an hour old, so I did not rerun it.

Run Summary

Field	Value
Event	schedule
Run	36093828964
Thread	`schedule-898cd73a-36093828964`
Mode	working-dir (report-only)
Report issue	#3927 (updated, not duplicated)
Older reports closed	0 (none open)
Wiki writes this pass	none. The tree was already dirty from an earlier step and I left it for ingestion.

Autoheal Remediation Pass — 2026-09-26 (UTC), categories 1–4

No minimal repair was needed; no branch, commit, or PR was created. Inspected main at 7339707.

Errored PRs

Open PR #3901: check runs have no failures; the separate legacy Security: Private Leak Scan commit status is success. No failing PR to repair.

Security

Dependabot alert chore(deps): update bfra-me/renovate-config action to v1.13.0 #59 (@humanfs/node, development/transitive, medium, first patched in 0.16.8 per GitHub Dependabot advisory data) remains open. Below the critical/high remediation threshold; routine dependency upgrades belong to Renovate. No high/critical alert or failing security PR was found. Repository security advisories: none published; secret-scanning alerts: none open. Four open code-scanning Scorecard findings (VulnerabilitiesID, FuzzingID, CIIBestPracticesID, BranchProtectionID) are not confirmed high/critical direct-dependency or Action advisories.

Control-Plane Integrity

All third-party uses: entries across 29 workflows and 2 composite actions are pinned to 40-character SHAs with # vX.Y.Z comments. No strip-only TypeScript construct surfaced; pnpm lint passed. Workflows scope permissions; the Scorecard read-all default is overridden by job permissions for SARIF upload/publishing, and the private-leak gate intentionally bypasses shared setup to avoid a PR-poisonable cache (.github/workflows/check-private-leak.yaml:12-13). Main branch protection has enforce_admins: true, required review, and required Check Wiki Authority / Security: Private Leak Scan contexts. No guardrail changes needed.

Code Quality

pnpm bootstrap, pnpm check-types, pnpm lint, and pnpm test all passed on main (86 files, 3,890 passed, 3 todo). Working tree clean.

Needs Human Attention

None for this pass. The medium transitive advisory remains with Renovate; no version comparison or major-version drift assessment was needed for an eligible security fix.

Run Summary

Field	Value
Event	schedule
Run	36217580903
Thread	`schedule-898cd73a-36217580903`
Mode	branch-pr; no mutations required
PRs inspected	#3901
Branches / PRs created	0 / 0
Wiki persistence	none (branch-pr mode)

Superseded by the 2026-09-26 daily report.

Run Summary

Field	Value
Event	schedule
Run	36217580903
Thread	`schedule-898cd73a-36217580903`
Mode	working-dir (report-only)
Daily report	#3930
Older reports closed	1 (#3927)
Wiki writes	none; no validated new public finding

Navigation Menu

Repository navigation

Daily Fro Bot Report — 2026-09-25 (UTC) #3927