Daily Fro Bot Report — 2026-10-12 (UTC) #3986

Daily Fro Bot Report — 2026-10-12 (UTC)

Snapshot begins 05:25 UTC; later rollout and verification readbacks follow. Categories 1–4 are attributed to the separate remediation pass, not repeated by this oversight pass. No repair PR was produced. Existing open automation work was reused as evidence.

Run Summary

✅ = verified-clean; ⚠️/❌ = warning/error; ❔ = could-not-check. Missing, empty, stale or denied evidence is never an all-clear.

Errored PRs

None. Remediation readback inspected the sole open PR #3984, App-authored same-repository data promotion. Completed non-skipped checks and the separate legacy private-leak status pass. Current PR/check readback agrees; no comments or repair PR exist for this category.

Security

Remediation readback: three open transitive development Dependabot alerts (two medium, one low), npm audit three moderate/one low, zero high/critical. Override-floor check passes. All 17 Action/reusable-workflow packages were checked against the GitHub Advisory Database; no affected pin. Scorecard #9's high rule label does not elevate the underlying lower-severity advisories. Next: Renovate-owned routine remediation through #2828.

That pass used npm registry audit advisories, GitHub Dependabot/Advisory Database and upstream GitHub tags. Affected major ranges were included; latest-version drift was not surveyed there. No security repair PR was produced.

Control-Plane Integrity

Remediation readback: 31 workflows/two composite actions parse; 146 external references have full SHA pins/version comments, all upstream tags match; 74 production scripts import under Node 24 strip-only. Explicit App scopes, same-repository data wiki authority, privacy gates and live branch protections pass. Surplus CodeQL read permissions remain. Effective Systematic guard evidence is unavailable/unverified; reuse #3979. No repair PR was produced.

Code Quality

Remediation readback passed pnpm bootstrap, pnpm check-types, pnpm lint, pnpm test: 102 files, 5,358 passed / three todo. This pass passed pnpm lint, direct no-emit TypeScript, direct Vitest with the same counts, and git diff --check. Install/build-writing wrappers were not repeated under the non-mutating-shell delivery constraint.

Read-only wiki schema/link validation: 47 pages; no deterministic finding on the edited dashboard page. Two existing broken links elsewhere remain under #3903; four nonblocking advisories concern older unrelated pages/catalog connectivity. Generic ESLint excludes wiki content; scoped wiki validation supplies that evidence.

Oversight

Paginated authenticated-account /user/repos and /user/orgs, then repository listings for every returned organization (bfra-me, psware-ps2, pro-actions), succeeded. “Can see” means returned records with read/pull permission. Every returned record was inspected; only confirmed-public identities/findings appear here. The empty psware-ps2 listing provides no repository evidence for that organization, rather than an org-health all-clear.

Public snapshot: 224 open issues, 132 open PRs, 18 new issues within 24h, 85 issues inactive >30d, 88 PRs aged >7d, 56 PRs inactive >14d, five unassigned bugs. Counts precede this report's creation/retirement. PR age uses creation time; inactivity uses latest commits, reviews, comments, state changes and update timestamps, with incidental report backlinks excluded. Paginated activity requests all succeeded.

Top three hotspots, ranked by distinct qualifying URLs (new/stale issues, aged/stale PRs, unassigned bugs, accessible alerts, latest failing default-head check contexts; overlaps count once):

1. extend-vscode — 99: advisory, vulnerability gate. Next: prioritize existing dedicated security work before retrying release.
2. sparkle — 63: advisory. Next: review dedicated security fixes before routine dependency bumps.
3. containers — 61: package advisory, aged PR. Next: separate package/image triage and review existing PRs.

Alert counts represent findings, not unique exploitable root causes.

New issues — next: triage each linked issue: bfra-me/renovate-action/issues/3919, bfra-me/works/issues/5085, fro-bot/.github/issues/3985, fro-bot/agent/issues/1791, fro-bot/space-bus/issues/208, marcusrbrown/.dotfiles/issues/2847, marcusrbrown/infra/issues/1522, marcusrbrown/infra/issues/1521, marcusrbrown/marcusrbrown.github.io/issues/464, marcusrbrown/mothership/issues/144, marcusrbrown/panthea/issues/211, marcusrbrown/systematic/issues/1090, marcusrbrown/systematic/issues/1089, marcusrbrown/systematic/issues/1084, marcusrbrown/systematic/issues/1083, marcusrbrown/systematic/issues/1081, marcusrbrown/tokentoilet/issues/1609, marcusrbrown/tokentoilet/issues/1608.

Unassigned bugs — next: reproduce and assign each: bfra-me/ha-addon-repository/issues/569, marcusrbrown/infra/issues/1521, marcusrbrown/marcusrbrown.com/issues/517, marcusrbrown/marcusrbrown.com/issues/465, marcusrbrown/systematic/issues/740.

Failing default-head checks — next: inspect current inputs and failed steps before retry: marcusrbrown/extend-vscode/actions/runs/38191288729/job/114624417018, marcusrbrown/marcusrbrown.github.io/actions/runs/37272080949/job/111642046625, marcusrbrown/marcusrbrown.github.io/actions/runs/37272080949/job/111641034034, marcusrbrown/marcusrbrown.github.io/actions/runs/37272080949/job/111641033800. Portfolio performance failures are October 5 evidence on the current head, not a fresh execution. Latest check-run per app/name and latest legacy status per context were inspected separately; historical superseded failures do not count.

Empty default-head check and legacy-status histories: fro-bot/tokentoilet, marcusrbrown/encode-2024-q3-grp14-jobseeker-ai, marcusrbrown/gala-chain-code, pro-actions/peter-murray_workflow-application-token-action. Next: establish intended CI/archive coverage; empty sources are not verified health.

Accessible public Dependabot endpoints return 252 alerts; 6/40 endpoints are unavailable (HTTP status named above). Accessible public Code Scanning endpoints return 188 alerts; 25/40 endpoints are unavailable (HTTP status named above). Accessible public secret endpoints return 0 alerts; 33/40 endpoints are unavailable (HTTP status named above). Empty accessible lists do not establish scanner coverage.

Gateway rollout awareness — category 8

#3512 remains Open, and its Project 1 item remains In Progress; incomplete production acceptance is consistent. All 29 Project items were read. Body-versus-Project mismatches:

Dashboard #585 and #586 remain body Open / Project Todo / issue Open — consistent.

• Body/live-contract claim 1.8.0 versus fresh health 1.9.0.
• Body gateway v0.118.2 versus current infra pin v0.119.2; actual gateway deployment job succeeds October 12 04:55:51 UTC.
• Body dashboard 2026.10.15 versus infra source ledger 2026.10.21 versus successful actual deployment job targeting 2026.10.22 (logs reference sha256:6731b2d8af94e3b7d6e39affa4d3fca8bd38a561dd57ec7a79082eb3bfab32a7), completed 04:52:54 UTC. The source ledger is not proof of the running image.
• Latest-version authority: GitHub Releases identifies agent v0.120.0 and dashboard 2026.10.22. Tagged contract files declare 1.10.0 versus 1.9.0. This is released-contract skew, not observed live skew. Comparison includes minor contract/release drift; no broader major-version survey here.
• Newer green router run 38205474985 and 38192650243 skipped gateway/dashboard deployment jobs. Overall router success is not a new deployment.

Next: the dedicated tracker reconciles stale body/source-ledger values and verifies a compatible paired upgrade before adopting latest agent. Authenticated SSE ready, question answer/skip/settlement/cleanup, checkout projection, expired-output recovery, cancellation, logout/CSRF and privacy acceptance remain unverified here. Health and successful jobs do not identify the serving digest or prove those flows. No tracker comment or Project write occurred.

Cross-Project Intelligence

Every metadata/repos.yaml entry was processed, using stable repository identity where available. Public inspection covers 32 tracked source trees / 220 fetched workflow files, without truncation or public fetch failure. Coverage is partial: fro-bot.github.io and systematic gh-pages have empty default workflow trees. This is configured-source inspection, not execution verification.

Adoptable findings only:

1. Explicit local delivery and no-response mode: model writes a candidate, trusted finalization owns publication. The no-post App mint runs before model execution, scoped step env keeps the private key away from subsequent agent-influenced execution, and only the trusted finalizer receives its token. Preserve the single-job OIDC authority invariant and token-expiry fail-closed behavior. This corrects yesterday's report wording that described minting after model execution.
2. Failure-surviving suite diagnosis: combine !cancelled() with actual suite outcome so diagnostics run after failures without turning a failed suite green. Useful for artifact/producer validation.
3. Release-job-specific failure alerts: distinguish publisher failures from unrelated Main failures and reuse marker-matched issues. Adapt with paginated job/issue reads rather than copying its bounded dedup unchanged.

No changes in this category.

Progressive Improvement

Current-version authority: npm registry latest stable versions, individually queried with pnpm view --registry=https://registry.npmjs.org; major drift included. Manifest:

All 31 committed workflows are active. Current-main Main run 38112400504 passes lint/types/tests, strip-only loading, workflow and committed-dist checks; PR-only authority/mutation jobs correctly skip on push. The newer successful Main run is on #3984's PR head, not a newer main commit. Existing preset-validation gap #3793 remains. No stale production TODO/FIXME annotations found: the script occurrence is a negative-test fixture; the workflow occurrence is this scan's prompt text. Shared setup and pnpm conventions remain consistent with documented exception workflows; unresolved guard/preflight behavior stays under #3979.

Learning proposals: one open, zero >14d: #3985, approximately 0.16 days / four hours old. Zero open docs/drafted-solutions PRs, so no proposal is covered by an eligible App-authored Closes #N line. One fresh uncovered proposal meets neither stall rule (>14 days or two-or-more uncovered open proposals). Expected action: author the token-scope/consumer-routing learning into docs/solutions/ via the compounding pipeline.

Metrics #3674 is fresh (October 12), reads ambiguous, and reports zero recurrence backlog. That metric is not proposal authorship evidence. Only Draft Solutions run 37981130113 is available: an earlier empty-queue run, not evidence that today's nonempty queue can draft/publish successfully.

Needs Human Attention

1. Rollout reconciliation and paired compatibility: dedicated tracker owns #3512's six Open-versus-Done mismatches and stale deployment claims. Paths: fro-bot/agent/packages/gateway/src/operator-contract/version.ts, fro-bot/dashboard/src/gateway/operator-contract/version.ts, marcusrbrown/infra/apps/gateway/upstream.json, apps/dashboard/docker-compose.yaml, docs/runbooks/gateway-operator-auth-lifecycle.md. Smallest safe next step: reconcile ledger/tracker from actual deployment evidence, then verify dashboard compatibility before an agent 1.10.0-contract cutover. Do not deploy latest agent against the 1.9.0 dashboard or weaken exact-match enforcement. Verify authenticated acceptance above and retain paired, volume-aware rollback.
2. Guard/preflight — reuse #3979: inspect redacted effective OpenCode initialization, opencode.json, .github/workflows/fro-bot.yaml. Root cause is not established; configured repository gates passing does not prove the unavailable execution guard is active. Obtain consistent evidence on a future run; do not repeatedly retry unavailable guard or widen credentials. Distinguish endpoint HTTP status from missing/disabled resources before diagnosing scope.
3. CodeQL least privilege — remediation handoff: .github/workflows/codeql-analysis.yaml:27–31, .github/codeql/codeql-config.yml. Verify pinned Action requirements and remove only surplus packages: read / actions: read through reviewed work. Preserve contents: read, security-events: write, tests and scanning coverage; verify required commands, YAML/action references and a CodeQL run. No failing-run bug qualified this report-only pass to edit it.
4. Preset gate and learning authorship: reuse #3793 for Renovate preset validation through shared setup. For #3985, .github/workflows/draft-solutions.yaml and scripts/drafted-solutions-*.ts, verify the next nonempty queue through bodies artifact, privacy handoff, focused docs PR and human merge. Scope assertions must cover actual consumer credential bindings. Prior learning: docs/solutions/workflow-issues/required-github-token-for-agent-steps-2026-06-22.md — required token wiring and token scope are separate controls. Do not fabricate proposals or relax publication boundaries.
5. Fleet failures and source coverage: linked failed jobs/security endpoint statuses are detection evidence, not a reproduced root cause. Inspect exact failed steps and current advisory inputs; reuse existing security PRs/dashboards and preserve guardrails. Routine dependency/tool bumps remain Renovate-owned. Empty histories require intended CI/archive coverage confirmation rather than a green health claim.
6. Wiki handoff and report retirement: this pass updates only knowledge/wiki/repos/fro-bot--dashboard.md, knowledge/index.md, append-only knowledge/log.md; all pre-existing wiki/rename changes and staged metadata overlay remain preserved. Dirty wiki diff is left for caller-owned trusted ingestion, whose persistence is not yet verified. Two unrelated deterministic wiki links remain under #3903. Exactly-one-comment harness rule overrides per-older-report closing comments: older reports are closed without extra comments; today's sole summary comment links this report and the retired predecessor. No branch/commit/push or metadata mutation was performed by this pass.

Run 38207199307 · oversight working-dir · caller owns trusted wiki ingestion.