Daily Fro Bot Report — 2026-10-15 (UTC) #3994

Daily Fro Bot Report — 2026-10-15 (UTC)

Run Summary

Run 38679087052. Snapshot began 2026-10-15T04:08:00 UTC. Categories 1–4 below inherit the linked remediation evidence; this observe pass did not repeat their analysis or repair branches. Findings are linked summaries, with no issue/PR content copied.

Errored PRs

None. Handoff; current successful/non-failing rollups: #3993, #3991, #3989, #3988, #3987, #3984. No remediation PR or branch mutation was produced. BLOCKED merge state is not failed CI.

Security

Handoff: Dependabot 59 and 77 are medium; 79 is low. Live npm audit had zero high/critical advisories; the override-floor gate passed. Action advisory checks covered 17 packages. Follow existing Renovate dashboard #2828; routine bumps remain Renovate-owned. Account-wide alert coverage is separately qualified under Oversight.

Control-Plane Integrity

Handoff: 146 external action/workflow references pinned across 31 workflows and two composite actions; 74 production scripts loaded under Node strip-only. Wiki authority, privacy gates, token scopes and live branch controls were checked. Execution guard remains unavailable; reuse #3979. CodeQL's surplus actions: read / packages: read scopes remain deferred, not silently relaxed.

Code Quality

Handoff: pnpm bootstrap, pnpm check-types, pnpm lint, pnpm test passed (102 test files; 5,358 passing, three todo). No mechanical fix was needed. Observe's additive wiki capture separately passed pnpm lint, direct no-emit TypeScript, direct Vitest and whitespace checks. The touched topic has no deterministic/advisory wiki finding; the full wiki retains two pre-existing broken links and four advisory findings. Install/build-writing wrappers were not repeated under this pass's non-mutating-shell contract.

Oversight

Coverage ❔. Paginated authenticated user/repos, user/orgs, and each returned organization's repository listing were unioned and filtered to returned read access. Public report scope is 40 repos. bfra-me returned seven and pro-actions one; psware-ps2 returned zero, so that empty source is not verified-clean. All listed public repos were checked for open issues/PRs, head check runs, legacy statuses, Actions history and three alert endpoints. Archived repositories remain in scope.

Counts: 10 new issues (last 24h, including rolling reports), 83 stale issues (>30d since update), 127 open PRs, 101 aging PRs (>7d since creation), 0 stale PRs (>14d since latest activity), 6 unassigned bugs, 6 failed latest head check contexts, 443 accessible open security alerts. PR activity includes commits, reviews, comments, and timeline/state changes; a daily comment legitimately resets activity without resetting creation age. Older failed attempts superseded by newer check results are excluded.

Top three public-reportable hotspots. Ranking is the sum of the eight category counts above; overlaps count as separate category hits, unavailable sources add zero (not a clean bill).

Failing/default-branch evidence and next actions

• bfra-me/github-action: Update Repo Settings / Update Repository Settings. Inspect the linked failure and reuse existing repair work; performance evidence may predate today even when attached to the current head.
• marcusrbrown/extend-vscode: Pre-Release Validation (vulnerabilities). Inspect the linked failure and reuse existing repair work; performance evidence may predate today even when attached to the current head.
• marcusrbrown/marcusrbrown.github.io: Performance Summary, Performance Audit (mobile), Performance Audit (desktop). Inspect the linked failure and reuse existing repair work; performance evidence may predate today even when attached to the current head.
• marcusrbrown/panthea: check. Inspect the linked failure and reuse existing repair work; performance evidence may predate today even when attached to the current head.
• dev-like Link Check is the latest completed run of that workflow in the sampled history, but on an older commit: rerun/inspect before claiming a current-head failure. Actions history was bounded to the latest 100 runs per repo; current-head check runs and issue/PR lists were fully paginated.
• Empty head check-run sources (❔, not clean): fro-bot/tokentoilet, marcusrbrown/encode-2024-q3-grp14-jobseeker-ai, marcusrbrown/gala-chain-code, pro-actions/peter-murray_workflow-application-token-action. Confirm whether CI is expected before adding jobs; archived status is not proof of passing checks.

New issues — next step: triage the linked new work; read rolling reports as status rather than separate defects.

• fro-bot/.github: #3992.
• fro-bot/dashboard: #617.
• fro-bot/space-bus: #211.
• marcusrbrown/infra: #1531.
• marcusrbrown/marcusrbrown.github.io: #467.
• marcusrbrown/panthea: #233.
• marcusrbrown/systematic: #1126, #1125, #1124.
• marcusrbrown/tokentoilet: #1616.

Unassigned bugs — next step: assign an owner and establish reproduction/acceptance evidence.

• bfra-me/ha-addon-repository: #569.
• marcusrbrown/infra: #1521.
• marcusrbrown/marcusrbrown.com: #517, #465.
• marcusrbrown/systematic: #1099, #740.

Cross-Project Intelligence

Coverage ❔ partial against the full tracked manifest. Every manifest entry was considered; identity resolution did not complete for all entries. All 31 public tracked entries were accessible and scanned at pinned heads, including archived marcusrbrown/copiloting despite its historical lost-access metadata. Public entries unscanned: None. fro-bot/fro-bot.github.io and fro-bot/systematic have no workflows/agent guidance/manifest in the scanned source set, so they provide no automation-pattern evidence. No metadata was changed.

Adoptable findings only:

1. Prove execution rather than accepting empty green suites. Systematic Host Contract job checks path-gate output explicitly, expected test files/skips, and pass evidence; its diagnostic guard also runs after suite failure. Apply this pattern to critical automation integration checks here, with an explicit allowed-skip set rather than weakening failure handling.
2. Health probes must follow the actual trusted ingress. infra#1537 validates HTTP + a structured contract field through the dashboard origin, rather than trusting the intentionally rejected gateway proxy. Separate liveness, compatibility, and authenticated acceptance when reporting Gateway health. The new probe remains warning-only; deployment success is not probe success.
3. Make rollout and rollback a version-pair contract. infra#1539 records deployment-gate supersession, the non-atomic paired sequence, and migration-crossing rollback semantics. Use the same evidence distinctions in this control plane's rollout reports; capture actual live pins and pending-deploy identity rather than treating a release or Project Done field as production acceptance.

Progressive Improvement

Tool drift — authoritative npm registry latest, major drift included. Current package.json:

CI/conventions: Main workflow retains lint, typecheck, tests, committed-build, strip-only loading, actionlint, wiki-authority and mutation guards. Latest Main run succeeded on the unchanged current main SHA; it is historical (October 11), not a fresh run today. No missing core job was found. #3979 still carries the unavailable execution-guard/convention follow-up; keep its remaining claims source-checked rather than assuming the entire issue body is current. CodeQL scope follow-up remains in the remediation handoff.

Stale TODOs: no actionable TODO/FIXME annotation was found in production TS/JS/YAML/JSON (only the task text and a test fixture match). Three executable test todos in scripts/wiki-lint-issues.test.ts:499–501 date to May 17, about 151 days: schema/fingerprint-version CLI rejection and GITHUB_OUTPUT counters still need a testable CLI seam.

Compounding pipeline: one open learning proposal, #3985, age 3.1d. The approved automation author's open head docs/drafted-solutions, PR #3989, age 2.6d, explicitly contains Closes #3985; its checks are successful/non-failing. Zero uncovered proposals, so neither stall rule is triggered. Next step: human review/manual merge of the drafted doc. Metrics #3674 was not used as proof of proposal authorship.

Gateway rollout tracker — awareness only

Issue #3512 versus Project 1:

The linked rollout comment reports a 29-minute mismatch interval between deploys. This is operator-reported timing, not independently measured here. Fresh anonymous health confirms contract 1.11.0 only; authenticated SSE, question/approval settlement, notification jumps, cancellation, logout/CSRF and privacy/security acceptance remain unverified. No tracker comments or Project fields were changed.

Needs Human Attention

1. Repair remaining guard/coverage plumbing through #3979. Inspect effective CI OpenCode/Systematic initialization and .github/workflows/fro-bot.yaml; guard availability is unresolved. Do not retry unavailable start/complete calls or widen credentials. Add capability-aware endpoint preflight that distinguishes 403/404/disabled/no-analysis from zero findings. Verify with a fresh invocation plus existing repository checks. Preserve required agent token wiring while narrowing scopes: prior learning.
2. Reconcile tracker prose through its dedicated owner workflow. In Track cross-repo Gateway operator control-surface rollout #3512's version table, remaining-defect rows, rollback warning and acceptance claims, use the two-value comparison above and infra#1539. Preserve unfinished authenticated verification; do not equate Project Done, released, deployed, and accepted. Verify all 29 Project items and source-linked live evidence; this daily path must not write tracker/Project state.
3. Close the old CLI test coverage gap. scripts/wiki-lint-issues.ts has a private environment-bound main(); scripts/wiki-lint-issues.test.ts:499–501 leaves version rejection and output-counter behavior untested. Smallest candidate fix: expose an injectable CLI seam while preserving the import guard, then implement the three behavior-level tests. Assert invalid versions cause no GitHub writes and correct counts reach a temporary output file. Verify focused Vitest, full types/lint/tests, and mutation guards if the configured trigger set applies. Do not delete the todos merely to make the count green.
4. Prioritize existing critical/high hotspot alerts and review backlog. Use the linked hotspot/security inventory and existing PRs; do not create duplicate override fixes or routine bump PRs. For this repo's lower-severity lockfile backlog and CodeQL surplus scopes, follow the remediation handoff, which includes exact paths, candidate fixes and verification constraints.
5. Existing wiki hygiene remains: marcusrbrown.com page has two broken LICENSE links; use source-qualified upstream links after checking the target. copiloting is stale/unconnected and polyglot-monorepo is stale. Refresh only from current evidence and verify wiki lint/link/index checks; use the data-authoritative writer path.

Delivery: additive durable knowledge was written only to knowledge/wiki/topics/github-actions-ci.md, knowledge/index.md, and append-only knowledge/log.md, for trusted caller ingestion. Existing knowledge/metadata changes were preserved; no metadata write, branch/commit/push/PR operation, individual finding comment, label, or Project mutation was performed. No workflow/prompt/dependency file changed. In-memory wiki validation found no new issue on the touched topic. Install/build-writing wrappers were omitted here because this delivery contract permits non-mutating shell checks; their successful remediation results are linked above. The pending working-tree payload must remain dirty for ingestion.