Daily Fro Bot Report — 2026-10-04 (UTC) #3950

Daily Fro Bot Report — 2026-10-04 (UTC)

Run Summary

Errored PRs

Remediation evidence: current open PR checks still show Lint failing on #3941, #3942, #3946, and #3948; the latter two also fail renovate/artifacts. Reuse the dedicated security PRs; resolve their landing dependency before refreshing routine Renovate artifacts. Categories 1–4 were not re-run here.

Security

Remediation evidence: five high, nine moderate, three low, zero critical npm advisories; all development-only transitive dependencies. Undici fix and brace-expansion fix cover every high finding but each inherits its sibling's failing floor. That pass used npm registry/GitHub Advisory Database truth, same-major patched targets 8.10.2 and 5.0.12; major drift was not surveyed. No new fix or merge was claimed.

Control-Plane Integrity

Remediation evidence and actionable gaps: 128 SHA-pinned third-party references across 29 workflows/two composites; all 62 production scripts imported under native Node. Eight unscoped App-token mint steps and the bot-author wiki-authority exception require reviewed follow-up. Preserve the cache-free privacy scanner and existing protection/privacy gates.

Code Quality

Remediation verification: bootstrap/types/tests passed, 4,079 tests passed with three todo; independent ESLint passed. Full Lint failed only at the five high advisory-floor findings. This oversight pass validated its additive wiki frontmatter, source SHAs, wikilinks, catalog, new-content formatting, and diff whitespace; it did not repeat the remediation suite.

Oversight

Snapshot began 2026-10-04 05:24 UTC. Paginated /user/repos plus authenticated organization membership and all three returned organization repository listings completed. “Can see” means a returned repository with permissions.pull=true; public reporting covers 40 repositories, with no non-public identities or findings published. Open issues/PRs, Dependabot and Code Scanning alerts, default-branch HEAD check runs, and legacy statuses were requested for every enumerated readable repository.

Public snapshot: 7 new open issues (24h), 79 stale issues (>30d since update), 5 unassigned labeled bugs, 118 open PRs, 81 aging PRs (>7d since creation), 52 stale PRs (>14d since actual activity), 283 Dependabot alerts (90 high/critical), 196 Code Scanning records, 8 latest failing default-HEAD check contexts. Counts are observed lower bounds when a source is unavailable.

PR inactivity uses paginated timelines, commit records, reviews, and review comments; report backlinks/references do not reset it. Check-run failures use the latest run per App/check-name at default HEAD, with legacy statuses inspected separately; superseded failures are excluded. Code Scanning records include posture findings and are not all exploitable vulnerabilities.

Top three hotspots, ranked by current qualifying record count (each issue qualifying as new/stale/unassigned counted once, each open PR once, each alert record once, and each latest failing default-HEAD context once):

• marcusrbrown/gpt: 100 — linked finding. Prioritize high alerts, then review the aged UI/security queue.
• marcusrbrown/extend-vscode: 93 — linked finding. Triage high alerts and unblock the linked vulnerability release check.
• fro-bot/dashboard: 76 — linked finding. Separate exploitable CodeQL findings from posture records; remediate high dependencies first.

Could not check: Dependabot alert endpoints returned HTTP 403 for marcusrbrown/gala-chain-code, marcusrbrown/encode-2024-q3-grp14-jobseeker-ai, fro-bot/tokentoilet, marcusrbrown/copiloting, marcusrbrown/cortexkit_anthropic-auth, pro-actions/peter-murray_workflow-application-token-action. Code Scanning returned HTTP 403/404 where marked in the table; unavailable is not zero findings. Repository enumeration itself had no failed source. No project changes, individual issue/PR edits, or labels were applied.

Gateway rollout awareness — category 8

Project 1 has #3512 In Progress / readiness waiting, consistent with the tracker remaining open; the other 20 items are Done and their linked issues/PRs are closed/merged. Read-only preflight source currently returns no gating transition, but its fingerprint contains issue identity/state, not deployment/release/contract evidence.

Upstream release truth came from GitHub releases and pinned source; agent 0.x minor drift was included. A health probe does not verify browser-session flows or deployed image identity. No tracker comments, Project edits, approvals, secrets, or deployments were changed.

Cross-Project Intelligence

Every entry in the restored authoritative metadata corpus was resolved and scanned, rather than using an example-name list. Unscanned/inaccessible tracked entries: None. All 32 public tracked source snapshots had untruncated tree and source reads. The legacy marcusrbrown/copiloting record lacks node_id; an authenticated owner/name lookup independently verified its public identity and recovered the scan without changing metadata. Scope was all top-level workflows, automation prompt files, and root/central agent guidance; this is a source scan, not runtime verification or a full code audit.

Adoptable patterns:

• Portfolio live-audit finalization: validate the finalization result before exporting artifact outputs, then require the artifact to exist. Apply an explicit parseable handoff to Capture Learnings; missing output must not become an empty success.
• Systematic host-contract guard: inspect expected files/skips/pass floor after both passing and failing suite outcomes, using !cancelled() to override implicit success gating. Use meaningful execution evidence where a green job could otherwise represent skipped work.
• Infra package smoke: verify the packed artifact, install it in a clean room, and execute its real entry point. A consumer-facing smoke test would complement the control plane's existing compiled-dist equality check for @fro-bot/wiki-write-core.

No pattern was implemented in this report-only category.

Progressive Improvement

Compounding is stalled: learning-proposal queue has 10 open proposals: five are 20 days old and five 13 days old. Five exceed 14 days; the queue also exceeds the two-open threshold. Author each accepted learning into docs/solutions/; opening the proposal is not codification.

• 20 days: #3887, #3888, #3889, #3890, #3891.
• 13 days: #3905, #3906, #3907, #3908, #3909.
• Latest Capture Learnings run, September 28: publisher failed because capture-learnings-bodies was missing, then the CLI threw ENOENT. Improvement Metrics #3674 says healthy/backlog 0 as of September 28; it measures recurrence of codified classes, not this unauthored queue. Existing wiki explanation keeps those populations separate.

Tool comparisons used npm registry latest endpoints, including majors:

All 29 repository-authored workflows are active. Existing CI gaps remain Renovate config validation #3793 and mutation guard self-reach #3835. No live TODO/FIXME annotation was found in execution source; the only scripts match is a test-fixture string. Known convention/security gaps are linked in the remediation evidence rather than re-analyzed here.

Needs Human Attention

1. Security landing dependency: reuse #3941/#3942 evidence. Paths: pnpm-workspace.yaml, pnpm-lock.yaml, scripts/check-override-floors.ts. Each isolated fix inherits the other high finding; coordinate authorized integration while preserving dedicated scope, all required checks, and the advisory gate. Do not retry unchanged branches or create duplicates. Verify both patched floors, all four repository commands, and zero high/critical findings.
2. Learning delivery and codification: .github/workflows/capture-learnings.yaml, scripts/capture-learnings-open.ts, and docs/solutions/. Verify producer output exists and parses before declaring the draft successful; distinguish a genuine no-candidate result from missing output, preserve the separate publisher/privacy-token boundary, then author the ten queued learnings. Verify required artifact delivery, privacy rejection, explicit empty-result behavior, and successful publication. Guidance: required token with restricted scope. Do not remove required credentials or silently replace missing bodies with empty success.
3. Tracker evidence coverage: scripts/rollout-tracker-snapshot.ts and its paired test; hashSnapshot projects away Project fields and has no deployment/release/contract observations. Extend only reviewed typed gate evidence, with tests showing meaningful transitions change the fingerprint; preserve idempotency. Reconcile Track cross-repo Gateway operator control-surface rollout #3512 through its owning tracker using the fresh pin/closure/deployment evidence above. Before upgrading gateway apps/gateway/upstream.json, coordinate dashboard src/gateway/operator-contract/version.ts and infra apps/gateway/src/deploy.ts requirements. Verify live contract agreement and browser-session flows; do not infer deployment or completion from a release/health probe.
4. Coverage limitations: security alerts unavailable where the table identifies HTTP 403; Code Scanning HTTP 404 is unverified availability, not a clean security result. Restore appropriate read access or confirm scanning configuration. The legacy marcusrbrown/copiloting entry in metadata/repos.yaml lacks node_id, but verified owner/name fallback recovered its current source scan. Do not equate a missing identifier with lost access; any metadata normalization belongs to the established data-branch writer, not this pass.
5. Existing CI/convention work: reuse #3793 for .github/renovate.json5/shared presets and .github/workflows/main.yaml validation; reuse #3835 for source-reaching mutation-guard tests. The remediation notes name the eight App-token steps and scripts/check-wiki-authority.ts:66–80 authority mismatch. Verify consumer permissions, workflow validation, authority tests, and mutation guards without weakening any gate.

Durable tracker knowledge was added to knowledge/wiki/topics/github-actions-ci.md, knowledge/index.md, and knowledge/log.md, with dated public sources and prior findings preserved. Those edits remain dirty for caller-owned ingestion; existing caller-restored changes and staged metadata were preserved. No branch/commit/push/PR delivery was attempted. One marked comment is reserved for retiring the previous daily report.

Workflow run 37179141402. Workflow guard unavailable; source/coverage limitations are stated above. Categories 5–8 made no individual issue/PR, label, Project, or deployment changes.