Daily Fro Bot Report — 2026-10-09 (UTC) #3966

Daily Fro Bot Report — 2026-10-09 (UTC)

Fleet snapshot 05:36–05:37 UTC, with tracked-workflow, latest-context and rollout readbacks afterward. This is a rolling snapshot. Categories 1–4 cite the separate remediation pass, not a new remediation analysis. That pass found no eligible mutation.

Run Summary

✅ = verified-clean; ⚠️ = finding; ❌ = failure; ❔ = incomplete/unavailable source. An accessible empty alert list is zero observed alerts, not proof of scanner coverage. Historical or absent runs cannot establish current workflow health.

Errored PRs

None. The remediation evidence checked check runs and legacy statuses for #3965 and #3953. Their head SHAs are unchanged and current PR rollups have no failures. The only open bot-authored PR is routine Renovate #3953; no new repair branch or PR was produced. Next: normal review/merge process.

Security

Remediation found zero critical/high npm advisories, three open lower-severity Dependabot alerts, and four npm-audit advisories across three transitive development packages. Routine remediation remains Renovate-owned. Scorecard vulnerabilities #9 is an aggregate high rule over lower-severity package advisories; protection #1 requests a second reviewer. Neither authorizes an emergency package bump or settings mutation.

Sources recorded by that pass: GitHub Advisory Database/Dependabot, npm audit's registry advisory service, and upstream Git tag objects for Actions. Vulnerable-range comparisons included major versions; it did not perform a latest-version drift survey. Next: review the existing alert evidence through Renovate and operator-owned protection decisions.

Control-Plane Integrity

Remediation verified 128 SHA/version-comment references, YAML parsing across 29 workflows/two composite actions, native Node 24 production imports, and live main protections. App-token mint-time scope omissions and the bot/non-data authority exemption remain deferred. The private-leak workflow's cache-free bootstrap is intentional; preserve it. Exact paths, constraints and verification are in the linked notes.

Code Quality

Separate pass: pnpm bootstrap, pnpm check-types, pnpm lint, pnpm test passed; 88 test files, 4,080 passed, three todo. This oversight pass also passed pnpm lint, direct no-emit TypeScript, diff whitespace, and scoped wiki validation on the edited pages/index across 47 pages. Two pre-existing wiki link findings elsewhere remain; reuse #3903.

Install/build-writing wrappers and the test suite were not repeated for additive wiki evidence under the non-mutating-shell contract. Only four permitted wiki/index/log files are dirty for caller ingestion; metadata remains unchanged.

Oversight

Enumeration: authenticated-account repositories plus every returned organization repository listing were paginated without enumeration errors. “Can see” means returned repositories with at least read/pull access; returned public organization repositories are readable. Every returned record was examined. Public rendering includes only confirmed public identities and findings.

Public snapshot: 242 open issues, 125 open PRs, 15 new issues within 24h, 86 issues inactive >30d, 84 PRs aged >7d, 54 PRs inactive >14d, six unassigned bug-labeled issues. PR aging uses creation; inactivity uses paginated commit/review/comment/state-change timelines, excluding incidental cross-reference backlinks. Issue inactivity uses updated_at. Archived queues remain in coverage. Counts precede publication and include yesterday's report, which this report replaces.

Top three hotspots, ranked by distinct qualifying public finding URLs: overlapping queue categories count once; job URLs normalize to runs; head check runs are reduced to the latest per app/context before ranking. Latest completed workflow observations are included, with historical/cancelled evidence distinguished below. This is a finding-count ranking, not a count of unique exploitable root causes:

1. marcusrbrown/extend-vscode — 96: high advisory, failed publication. Next: prioritize security triage and publication's vulnerability gate.
2. marcusrbrown/sparkle — 63: critical advisory. Next: review dedicated security remediation before routine dependency backlog.
3. marcusrbrown/containers — 60: high advisory, inactive PR. Next: separate package/image/posture findings and review existing fixes.

New issues — next: triage/assign; proposals need reviewed authorship: dashboard #587, mothership #141, portfolio #461, control-plane #3962, #3963, #3964, agent #1753, tokentoilet #1599, #1600, renovate-action #3904, infra #1501, works #5037, .dotfiles #2813, panthea #186. The fifteenth is yesterday's report.

Unassigned bugs — next: reproduce/assign: systematic #1005, #740, ha-addon-repository #569, agent #1753, brand site #517, #465.

Failures — next: inspect the failed step and newest relevant execution before retrying: extend-vscode Publish, github-action settings, space-bus Fro Bot, portfolio Performance Testing, dev-like Link Check. The control-plane Renovate callback fails Dispatch Repository Updates, with a rate-limit signature in failed logs; Main itself succeeds. The callback is separate from PR-head health/local validation.

Agent Auto Release is a March failure, not current release proof. Latest completed portfolio E2E and infra broker deploy were cancelled, not observed test failures. Archived cortexkit automation remains disabled_inactivity; next: confirm intended archive disposition rather than enable it automatically. Some PR/manual-only workflows have no default-branch run; distinguish those from missing workflow definitions.

Accessible public endpoints returned 244 Dependabot, 187 Code Scanning, zero secret alerts. 6/40 Dependabot, 25/40 Code Scanning and 33/40 secret endpoints were unavailable; HTTP results are above. Code Scanning includes posture/image findings, not necessarily independent exploitable vulnerabilities. Enumeration, issues, PR timelines, default-head checks/statuses and workflow queries had no scan errors. No individual queue item was edited or labeled.

Cross-Project Intelligence

Every metadata/repos.yaml tracking entry was processed, using live node identity or REST fallback for the legacy record. Public source coverage: 32 entries, 30 accessible workflow trees, all 220 YAML workflow files read/parsed. No unresolved identities or unread files in those trees. Two default-branch directories are absent: fro-bot.github.io and systematic gh-pages. Coverage is partial; absence on the default branch does not establish absence on every branch. Target sources were never executed.

Adoptable findings only; no implementation changes:

1. Explicit local delivery followed by late scoped credentials and trusted finalization: model output stays working-directory-local; trusted code freezes/builds/validates the candidate. Useful for privileged artifact publication. Preserve the workflow's explicit one-job OIDC authority invariant; copying a multi-job split would silently widen broker reach.
2. Job-specific failure signal: inspect the actual Release job after Main fails, avoiding unrelated failures. Useful for learning-publisher monitoring. Its marker lookup is label-filtered/capped and jobs are unpaginated: adapt signal selection, add complete discovery, and do not claim marker-only deduplication.
3. Fail-closed test execution evidence: malformed path-filter results fail, assets build before module-scope suite selection, and diagnostics run after an executed suite on success or failure. Apply this to producer-output/consumer boundaries without turning missing output into empty success.

Progressive Improvement

Version authority: npm registry latest stable dist-tags, queried with pnpm view; major drift included. Manifest:

All 29 committed workflows are active; core Main validation passes. No missing core CI job identified. The separate Renovate callback failure is described above. Existing Renovate config-validation gap #3793 remains the reusable follow-up, not a new issue. Convention/scope exceptions remain in the remediation notes. The scripts TODO/FIXME scan found only a test-fixture string, no production annotation to age or remediate.

Publication recovered; compounding remains stalled. The manual Capture Learnings run succeeded end-to-end: digest/bodies artifacts are present, both publisher downloads and issue opening succeeded. It created #3962, #3963, #3964. This supersedes the October 5 missing-handoff observation as latest execution evidence; it does not establish the earlier producer cause or future scheduled reliability.

13 open learning proposals: five September 14 (25d), five September 21 (18d), three new. Ten exceed 14d; the multi-open threshold is also exceeded. Expected action: review and author learnings into docs/solutions/, not generate another proposal. Full queue, oldest group #3887, September 21 group #3909. Metrics #3674 is still ambiguous / pending backlog 0, generated October 5: recurrence edges do not count the unauthored queue. Publication success can increase that backlog.

Gateway rollout awareness (category 8)

#3512 and its Project 1 item remain Open / In Progress / waiting, consistent with unchecked production-verification criteria. The body now correctly names gateway v0.118.2, dashboard 2026.10.15, and contract 1.8.0. Fresh health matches; dashboard pin #1499 merged and deploy succeeded. The old July anchors were reconciled.

Source-fixed, released, deployed and runtime-verified are different gates. GitHub Releases is version authority; latest dashboard is 2026.10.15. This rollout comparison covers relevant 0.x/CalVer releases, not a separate major survey. Health establishes contract parity, not serving digests or an authenticated replay. Approval/cancel/logout/CSRF/privacy checks and snapshot #583/Cancel #584 regressions remain. Next: dedicated tracker reconciles source states and coordinates release/deploy/runtime verification. No tracker comments or Project writes occurred.

Needs Human Attention

1. Author the learning backlog: inspect the linked 13 proposals and existing docs/solutions/ first; consolidate duplicates and author reviewed learnings with schema-valid frontmatter. The root gap is codification, not currently missing artifact delivery. Verify solution examples/links and full lint. Monitor the next scheduled .github/workflows/capture-learnings.yaml run for real bodies download/publication; do not manufacture empty success or remove required token wiring. Follow docs/solutions/workflow-issues/required-github-token-for-agent-steps-2026-06-22.md.
2. Gateway source-state drift: Track cross-repo Gateway operator control-surface rollout #3512's two Open rows contradict closed issues/Project Done. Dedicated tracker owns reconciliation. Use marcusrbrown/infra/apps/gateway/upstream.json, apps/dashboard/docker-compose.yaml, and docs/runbooks/gateway-operator-auth-lifecycle.md to track release inclusion, actual deployment, then live checkout/question behavior. Approval/cancel/logout/CSRF and dashboard Action Required: Fix Renovate Configuration #583/Action Required: Fix Renovate Configuration #584 require authenticated regression checks. After the one-way ownership migration, rollback needs volume snapshots plus paired images; pin reversal alone is insufficient. Do not close rollout based on source issue closure or health parity.
3. Renovate callback rate-limit signal: .github/workflows/renovate.yaml:31–51 routes successful Main completion to the pinned bfra-me/.github reusable workflow. Run 37880650371 fails Dispatch Repository Updates; failed logs contain a rate-limit signature. The exact budget/credential cause remains unconfirmed. Smallest next step: inspect upstream dispatch consumer and request/rate-limit evidence, then apply bounded retry/pacing only if diagnosed. Preserve required-check semantics and upstream dependency ownership; do not label Main validation broken or rerun blindly. Space-bus's Run Fro Bot failure likewise needs its own logs; no root cause was established here.
4. Existing integrity findings: reuse the remediation notes for eight unscoped App-token steps in .github/workflows/{dispatch-renovate,manage-cache,manage-issues,merge-data,reconcile-repos,reset-survey-status,update-metadata}.yaml, and scripts/check-wiki-authority.ts:66–79. Trace consumers before tightening scopes; test promotion identity/path behavior and mutation guards. Preserve the cache-free private-leak gate and all privacy/protection checks. No metadata writes from this pass.
5. Coverage: public per-repository security 403/404 results above are unavailable, not zero. Confirm scanner/read capability before a fleet all-clear. The two absent default workflow directories limit tracked-source coverage; historical/cancelled/no-default-run observations limit current execution conclusions. No enumeration or queue scan errors occurred. Routine tool bumps remain Renovate-owned.
6. Persistence: additive evidence was written only to knowledge/wiki/topics/github-actions-ci.md, knowledge/wiki/repos/fro-bot--dashboard.md, knowledge/index.md, and append-only knowledge/log.md. Scoped wiki/frontmatter/link checks, lint, no-emit TypeScript and diff whitespace pass. Caller ingestion must capture the dirty tree; no cleanup, branch, commit or push occurred. The injected workflow guard was unavailable; working-directory delivery governs.

Run 37888679834 · oversight working-dir; caller owns wiki persistence.