Daily Fro Bot Report — 2026-10-17 (UTC)

Run Summary

Category	Status	Notes
Errored PRs	✅	Six open automation heads have no failing current checks; today's remediation handoff also verified legacy statuses.
Security	⚠️	Remediation: three moderate/one low npm advisories; no applicable high/critical dependency or Actions advisory.
Control-Plane Integrity	⚠️	Remediation: SHA/strip-only/privacy guards verified; permission hygiene deferred.
Code Quality	✅	Remediation: bootstrap/types/lint/tests passed; 5,358 passing tests, three existing todos.
Oversight	❔	Public findings below; security endpoints denied/unavailable and some default-branch execution evidence absent/historical. No unavailable source counted clean.
Cross-Project Intelligence	❔	Full manifest traversed; 32 public entries source-scanned, two have an empty selected automation source set.
Progressive Improvement	❔	Major TypeScript/Vitest drift and old CLI todos; latest Main run is historical, not fresh execution. Learning proposal is authored, not stalled.

Snapshot collected 2026-10-17 04:04 UTC; run 39000036705. ✅ verified-clean; ⚠️ warning; ❌ error; ❔ incomplete/unavailable evidence. Categories 1–4 are credited exclusively to the preceding remediation pass, not rerun here.

Errored PRs

Remediation evidence: no eligible repair, no repair PR created. Current open Fro-Bot-authored PRs #3993, #3991, #3989, #3988, #3987, #3984 have no failing check conclusions. The handoff inspected 146 check runs and all six successful combined legacy statuses. Next: review/unblock these existing PRs; do not confuse review blocking with failed CI.

Security

Remediation evidence: no applicable high/critical package or Actions advisory; override-floor checker passed. Existing alert 59, alert 77, alert 79 and Scorecard aggregate 9 remain. The high-rated Scorecard aggregate is not an additional high-severity package advisory. Next: Renovate owns these moderate/low updates; retain separate advisory-range and action-release verification.

Control-Plane Integrity

Remediation evidence: 146 third-party references across 33 workflow/action files pinned with version comments; 169 script files parse in Node strip-only mode. Wiki authority, privacy/promotion gates and enforced branch protection verified by that pass. Next: reviewed permission narrowing for CodeQL and the unused Scorecard workflow default, using the exact paths/constraints in the handoff; no guard relaxation.

Code Quality

Remediation evidence: pnpm bootstrap, pnpm check-types, pnpm lint, pnpm test passed (102 test files; 5,358 tests, three todos). None required a repair PR. No application code changed in this observation pass.

Oversight

Enumeration: authenticated fro-bot; paginated /user/repos with owner/collaborator/organization-member affiliation, paginated /user/orgs, then paginated repository lists for bfra-me, psware-ps2, and pro-actions. “Can see” means the returned repository grants permissions.pull (at least read); union deduplicated by repository identity. Enumeration requests that failed: None. Public-safe inventory below covers 40 public repositories, including archived repositories; security/CI evidence gaps remain explicit. No individual issue/PR was modified in categories 5–8.

Hotspots — current-snapshot qualifying finding count. Count each unique new/stale/unassigned-bug issue once, each open PR once (aging/stale flags do not double-count it), each open security alert once, and each failed workflow/current-check record once. Unavailable endpoints add no invented findings. Scores are finding volume, not severity-weighted risk.

marcusrbrown/extend-vscode: 99 = 94 alert records + 0 PRs + 4 qualifying issues + 1 failures. Example alert #212. Next: triage critical/high alerts and unblock existing security fixes before routine maintenance.
marcusrbrown/sparkle: 66 = 49 alert records + 12 PRs + 5 qualifying issues + 0 failures. Example alert #320. Next: triage critical/high alerts and unblock existing security fixes before routine maintenance.
marcusrbrown/containers: 64 = 58 alert records + 6 PRs + 0 qualifying issues + 0 failures. Example alert #54. Next: triage critical/high alerts and unblock existing security fixes before routine maintenance.

Latest default-branch workflow failures / current-head failed contexts. Next for every linked run: inspect its failed job logs, establish the root cause and whether it is still relevant, then choose a minimal reviewed fix. Latest is per active workflow, not the latest overall run; old latest failures are historical evidence, not proof the workflow executed today. Repeated check attempts are deduplicated by context/app; failures already represented by a workflow run are not repeated.

bfra-me/github-action: Update Repo Settings (2026-10-16).
fro-bot/.github: Poll Invitations (2026-10-17), Survey Repo (2026-10-15), Reconcile Repos (2026-10-16).
fro-bot/agent: Auto Release (2026-03-22).
marcusrbrown/dev-like: Link Check (2026-10-12).
marcusrbrown/extend-vscode: Publish (2026-10-15).
marcusrbrown/marcusrbrown.github.io: Performance Testing (2026-10-12).

New open issues (last 24h). Next for every linked issue: triage scope, reproduction/evidence, and ownership.

Unassigned bugs. Next for every linked issue: assign an owner and establish reproducible acceptance evidence.

bfra-me/ha-addon-repository: #569.
fro-bot/agent: #1836.
marcusrbrown/marcusrbrown.com: #517, #465.
marcusrbrown/systematic: #1131, #740.

Open PR inventory — age / inactivity in days

Next for every linked PR: review current checks and unblock review/conflicts; prioritize security fixes, with routine bumps remaining Renovate-owned. A = creation age >7d, S = latest-activity inactivity >14d. Latest activity is max(PR update, paginated timeline, commit author/committer dates, reviews, review-comment updates); it is not creation age.

bfra-me/.github: #2882 (2.2/0.5d).
bfra-me/github-action: #1467 (122.7/1.0d; A), #1466 (122.7/1.0d; A), #1463 (123.7/1.0d; A).
bfra-me/github-app: #950 (38.4/1.0d; A), #843 (122.7/1.0d; A), #842 (122.7/1.0d; A), #840 (123.7/1.0d; A).
bfra-me/ha-addon-repository: #602 (8.5/1.0d; A), #601 (8.9/1.0d; A), #600 (9.1/1.0d; A), #599 (9.1/1.0d; A), #592 (37.8/1.0d; A).
bfra-me/renovate-config: #1558 (36.4/1.0d; A), #1383 (219.2/1.0d; A).
bfra-me/works: #5175 (0.1/0.1d), #5149 (1.8/0.8d).
fro-bot/.github: #3993 (2.3/1.0d), #3991 (3.4/1.0d), #3989 (4.6/1.0d), #3988 (4.9/1.0d), #3987 (4.9/1.0d), #3984 (5.1/1.0d).
fro-bot/agent: #1844 (1.3/0.3d), #1843 (1.3/0.4d), #1842 (1.3/0.4d), #1839 (1.6/0.4d), #1838 (1.6/0.4d).
fro-bot/space-bus: #203 (10.4/0.1d; A), #202 (10.4/0.1d; A), #193 (18.6/0.1d; A), #177 (32.9/0.1d; A), #135 (75.0/0.1d; A), #72 (97.8/0.1d; A).
marcusrbrown/Presentations: #54 (74.3/1.0d; A).
marcusrbrown/containers: #809 (19.3/0.0d; A), #758 (53.6/0.0d; A), #744 (63.5/1.0d; A), #740 (70.5/1.0d; A), #727 (77.5/1.0d; A), #723 (78.5/1.0d; A).
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai: #27 (727.7/1.0d; A), #22 (732.0/1.0d; A).
marcusrbrown/gala-chain-code: #72 (956.3/1.0d; A), #68 (961.4/1.0d; A), #65 (961.4/1.0d; A).
marcusrbrown/gpt: #2790 (19.0/1.0d; A), #2693 (79.9/1.0d; A), #2692 (80.9/1.0d; A), #2688 (81.9/1.0d; A), #2674 (91.0/1.0d; A), #2673 (96.0/1.0d; A), #2672 (97.0/1.0d; A), #2665 (99.9/1.0d; A), #2664 (101.0/1.0d; A), #2662 (102.1/1.0d; A), #2599 (117.9/1.0d; A), #2587 (119.9/1.0d; A), #2586 (119.9/1.0d; A), #2440 (155.9/1.0d; A), #2320 (180.2/1.0d; A), #2165 (202.7/1.0d; A).
marcusrbrown/ha-config: #896 (42.2/1.0d; A), #777 (156.0/1.0d; A).
marcusrbrown/infra: #1586 (0.0/0.0d), #1585 (0.0/0.0d), #1582 (0.4/0.0d).
marcusrbrown/marcusrbrown: #1277 (4.7/0.1d), #1107 (83.9/1.0d; A), #1100 (86.9/1.0d; A), #1095 (87.9/1.0d; A), #1055 (100.9/1.0d; A).
marcusrbrown/marcusrbrown.github.io: #460 (9.0/1.0d; A), #456 (11.0/1.0d; A), #454 (11.0/1.0d; A), #448 (15.5/1.0d; A), #440 (20.8/1.0d; A), #439 (20.9/1.0d; A), #435 (23.9/0.0d; A), #430 (25.3/1.0d; A), #426 (26.0/1.0d; A).
marcusrbrown/mothership: #139 (10.5/0.9d; A), #132 (16.1/0.1d; A), #122 (24.1/0.9d; A), #111 (32.8/0.9d; A), #108 (34.3/0.9d; A).
marcusrbrown/opencode-copilot-delegate: #335 (76.5/1.0d; A), #332 (77.4/1.0d; A), #278 (102.1/0.3d; A), #241 (116.4/1.0d; A), #135 (154.1/1.0d; A).
marcusrbrown/panthea: #242 (0.9/0.0d), #237 (1.8/0.0d).
marcusrbrown/sparkle: #2153 (1.3/0.1d), #2128 (9.9/1.0d; A), #2122 (10.9/1.0d; A), #2107 (15.9/1.0d; A), #2101 (16.9/1.0d; A), #2090 (21.9/1.0d; A), #2082 (24.9/1.0d; A), #2077 (25.9/1.0d; A), #2074 (26.9/1.0d; A), #2069 (29.9/1.0d; A), #2048 (37.3/1.0d; A), #2036 (39.8/1.0d; A).
marcusrbrown/systematic: #1139 (0.0/0.0d), #1135 (1.4/0.9d).
marcusrbrown/tokentoilet: #1619 (0.0/0.0d), #1617 (1.0/0.5d), #1615 (2.0/1.0d), #1613 (3.0/1.0d), #1611 (4.0/1.0d), #1610 (4.8/0.0d), #1607 (5.0/1.0d), #1606 (5.6/0.0d), #1604 (6.0/1.0d), #1602 (7.0/1.0d; A), #1601 (8.0/1.0d; A), #1598 (8.0/1.0d; A), #1596 (9.0/1.0d; A), #1593 (10.0/0.0d; A), #1592 (10.1/0.5d; A), #1590 (11.0/0.0d; A), #1589 (11.3/1.0d; A), #1583 (12.0/1.0d; A), #1579 (12.9/1.0d; A), #1573 (14.0/1.0d; A), #1567 (15.0/1.0d; A), #1559 (16.0/1.0d; A), #1552 (17.0/1.0d; A).
marcusrbrown/vbs: #740 (53.8/0.5d; A), #717 (70.0/1.0d; A), #701 (83.9/1.0d; A), #697 (86.0/1.0d; A), #693 (87.0/1.0d; A), #688 (88.0/1.0d; A), #674 (97.0/1.0d; A), #672 (99.0/1.0d; A), #671 (99.0/1.0d; A).

Total: 139 public open PRs; 107 aging; 0 stale. Activity fetch gaps: None.

Stale open issues — >30d since update

Stale issues. Next for every linked issue: confirm relevance and an acceptance target, then prioritize or let a maintainer retire it.

bfra-me/.github: #2546 (62.8d inactive), #2545 (62.8d inactive).
bfra-me/github-action: #1380 (217.2d inactive), #1379 (38.4d inactive).
bfra-me/github-app: #767 (204.9d inactive), #752 (38.4d inactive).
bfra-me/ha-addon-repository: #569 (45.0d inactive).
bfra-me/renovate-config: #1395 (215.4d inactive), #1381 (219.2d inactive).
fro-bot/dashboard: #193 (98.2d inactive), #112 (113.1d inactive).
fro-bot/fro-bot.github.io: #1 (222.1d inactive).
fro-bot/space-bus: #81 (97.2d inactive), #63 (98.2d inactive).
fro-bot/systematic: #3 (112.5d inactive), #1 (222.1d inactive).
marcusrbrown/.dotfiles: #1924 (113.0d inactive).
marcusrbrown/.github: #37 (1168.0d inactive).
marcusrbrown/dev-like: #122 (32.9d inactive), #114 (39.9d inactive), #100 (46.9d inactive).
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai: #1 (725.4d inactive).
marcusrbrown/esphome.life: #298 (310.3d inactive), #8 (1216.9d inactive).
marcusrbrown/extend-vscode: #319 (425.5d inactive), #318 (349.8d inactive), #317 (425.5d inactive), #142 (856.8d inactive).
marcusrbrown/gala-chain-code: #6 (956.3d inactive).
marcusrbrown/gpt: #2604 (61.0d inactive), #2524 (131.9d inactive), #2519 (133.0d inactive), #2505 (63.0d inactive), #2175 (202.5d inactive), #2174 (202.5d inactive), #2173 (202.5d inactive), #2172 (202.5d inactive), #2171 (202.5d inactive), #2170 (202.5d inactive), #2169 (202.5d inactive), #2168 (202.5d inactive), #2162 (202.5d inactive), #2146 (205.2d inactive), #2144 (205.2d inactive), #2143 (205.2d inactive), #2142 (205.2d inactive), #2141 (205.2d inactive), #2140 (205.2d inactive).
marcusrbrown/marcusrbrown: #1087 (89.9d inactive), #925 (146.2d inactive).
marcusrbrown/marcusrbrown.com: #517 (69.0d inactive), #465 (101.0d inactive), #411 (155.0d inactive).
marcusrbrown/marcusrbrown.github.io: #414 (30.0d inactive), #334 (44.9d inactive).
marcusrbrown/mothership: #19 (89.9d inactive).
marcusrbrown/opencode-copilot-delegate: #38 (173.2d inactive).
marcusrbrown/renovate-config: #1417 (112.5d inactive), #1111 (156.5d inactive), #1096 (221.8d inactive), #1079 (228.8d inactive), #1068 (235.8d inactive).
marcusrbrown/sparkle: #2035 (39.9d inactive), #2032 (40.0d inactive), #2025 (40.2d inactive), #2023 (40.2d inactive), #876 (374.9d inactive).
marcusrbrown/systematic: #854 (53.3d inactive).
marcusrbrown/tokentoilet: #1171 (118.3d inactive).
marcusrbrown/vbs: #694 (87.0d inactive), #675 (97.0d inactive), #670 (99.0d inactive), #657 (107.0d inactive), #656 (102.0d inactive), #161 (425.2d inactive), #160 (425.2d inactive), #159 (425.2d inactive), #158 (425.2d inactive), #157 (425.2d inactive), #155 (430.8d inactive), #154 (430.8d inactive), #153 (430.8d inactive), #152 (430.8d inactive), #150 (370.9d inactive).

Security alert endpoint inventory and evidence gaps

D = Dependabot, C = code scanning, S = secret scanning. Numbers are open alert records, not unique CVEs; code-scanning policy findings can overlap dependency concerns. Next for every linked endpoint: triage accessible high/critical alerts first; diagnose permission/feature/archival/no-analysis gaps without blanket token expansion. HTTP 403/404 means ❔, never zero.

Repository	D	C	S

| marcusrbrown/esphome.life | 0 | ❔404 | ❔404 |

| pro-actions/peter-murray_workflow-application-token-action | ❔403 | ❔404 | ❔404 |

| marcusrbrown/.dotfiles | 0 | ❔404 | ❔404 |

| bfra-me/github-action | 5 | 7 | ❔404 |

| marcusrbrown/marcusrbrown.github.io | 2 | ❔404 | ❔404 |

| marcusrbrown/systematic | 0 | 10 | ❔404 |

| marcusrbrown/gala-chain-code | ❔403 | ❔403 | ❔404 |

| bfra-me/ha-addon-repository | 0 | 6 | ❔404 |

| bfra-me/works | 0 | 4 | ❔404 |

| marcusrbrown/.github | 0 | ❔404 | ❔404 |

| fro-bot/space-bus | 0 | 4 | 0 |

| marcusrbrown/tokentoilet | 4 | ❔404 | ❔404 |

| bfra-me/renovate-action | 2 | 5 | ❔404 |

| fro-bot/agent | 0 | 7 | 0 |

| marcusrbrown/renovate-config | 4 | 6 | ❔404 |

| marcusrbrown/Presentations | 39 | ❔404 | ❔404 |

| fro-bot/fro-bot.github.io | 0 | ❔404 | 0 |

| marcusrbrown/panthea | 1 | ❔404 | ❔404 |

| marcusrbrown/marcusrbrown | 3 | ❔404 | ❔404 |

| marcusrbrown/vbs | 1 | ❔404 | ❔404 |

| bfra-me/renovate-config | 0 | 5 | ❔404 |

| marcusrbrown/copiloting | ❔403 | ❔403 | ❔404 |

| fro-bot/dashboard | 0 | 48 | 0 |

| marcusrbrown/gpt | 11 | ❔404 | ❔404 |

| marcusrbrown/cortexkit_anthropic-auth | ❔403 | ❔403 | ❔404 |

| marcusrbrown/encode-2024-q3-grp14-jobseeker-ai | ❔403 | ❔403 | ❔404 |

| marcusrbrown/ha-config | 0 | ❔404 | ❔404 |

| bfra-me/.github | 2 | 6 | ❔404 |

| marcusrbrown/opencode-copilot-delegate | 0 | ❔404 | ❔404 |

| marcusrbrown/extend-vscode | 94 | ❔404 | ❔404 |

| marcusrbrown/containers | 12 | 46 | ❔404 |

| marcusrbrown/marcusrbrown.com | 1 | ❔404 | ❔404 |

| marcusrbrown/dev-like | 0 | ❔404 | ❔404 |

| fro-bot/tokentoilet | ❔403 | ❔403 | 0 |

| fro-bot/systematic | 0 | ❔404 | 0 |

| marcusrbrown/mothership | 1 | 28 | ❔404 |

| marcusrbrown/infra | 0 | 3 | ❔404 |

| fro-bot/.github | 3 | 4 | 0 |

| marcusrbrown/sparkle | 49 | ❔404 | ❔404 |

| bfra-me/github-app | 20 | ❔404 | ❔404 |

All three endpoint families attempted for every enumerated repository. Unavailable sources keep Oversight ❔.

Default-branch execution coverage gaps

Latest run fetched separately for every active workflow, alongside current-head check runs and legacy status. The following have no default-branch run in the source. PR-only, emergency/manual and provider-managed workflows may legitimately have none: absence is not itself a broken job. Next: check the trigger and inspect an eligible PR/manual run before claiming execution coverage.

marcusrbrown/cortexkit_anthropic-auth: CI: no default-branch run.
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai: main: no default-branch run.
marcusrbrown/gala-chain-code: main: no default-branch run.
marcusrbrown/marcusrbrown.com: CI: no default-branch run.
marcusrbrown/marcusrbrown.github.io: CI: no default-branch run.

Historical results are not a fresh clean bill of health. Current-head check runs, legacy statuses and workflow listings were paginated; latest per-workflow requests avoid relying on the noisy overall recent-run window. PR-only/provider-managed and emergency/manual workflows with no eligible default-branch execution are not treated as degraded jobs.

Cross-Project Intelligence

Coverage ❔ partial for pattern assurance. Every entry in the tracked manifest was resolved, including stable database-ID resolution, and every accessible entry's full workflow source set plus available root instructions/package/action manifests was fetched at a pinned default-branch tree. All 32 public entries were scanned without source-fetch errors/truncated trees. Public inaccessible/unscanned entries: None. fro-bot/fro-bot.github.io and fro-bot/systematic have no files in that selected automation source set, so no pattern assurance is claimed for them. Findings are source-shape evidence, not claims that each job recently executed.

Systematic Host Contract: fail closed on malformed filter output, build before module-scope availability gates, and validate expected files/skips/pass evidence even when the test suite fails. Adopt explicit execution-evidence assertions for critical integration gates here; a green skipped check is not test coverage.
Systematic Release rehearsal: credential-free release rendering runs as a stable status on PRs/pushes, while publishing stays separate. Consider a read-only rehearsal of generated dispatch/delivery plans so payload validity is checked before a privileged writer receives it.
Renovate Action self-test boundary: credential-bearing local-action self-tests require an owner default-branch push and relevant path changes. Use that trusted-event boundary for future live automation smoke checks, retaining credential-free untrusted PR tests.

Public tracked-source coverage — pinned head and files fetched

marcusrbrown/ha-config: 3 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/.dotfiles: 4 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/.github: 3 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/containers: 12 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/copiloting: 9 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/esphome.life: 3 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/extend-vscode: 8 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/gpt: 13 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/infra: 24 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/marcusrbrown: 8 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/marcusrbrown.github.io: 11 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/renovate-config: 8 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/sparkle: 9 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/systematic: 15 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/tokentoilet: 8 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/vbs: 10 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/opencode-copilot-delegate: 9 workflow/guidance/manifest files; source-fetch errors 0.
fro-bot/agent: 16 workflow/guidance/manifest files; source-fetch errors 0.
fro-bot/fro-bot.github.io: 0 workflow/guidance/manifest files; source-fetch errors 0.
fro-bot/systematic: 0 workflow/guidance/manifest files; source-fetch errors 0.
bfra-me/.github: 19 workflow/guidance/manifest files; source-fetch errors 0.
bfra-me/ha-addon-repository: 9 workflow/guidance/manifest files; source-fetch errors 0.
bfra-me/renovate-action: 13 workflow/guidance/manifest files; source-fetch errors 0.
bfra-me/works: 16 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/cortexkit_anthropic-auth: 7 workflow/guidance/manifest files; source-fetch errors 0.
fro-bot/dashboard: 10 workflow/guidance/manifest files; source-fetch errors 0.
fro-bot/space-bus: 9 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/mothership: 10 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/dev-like: 9 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/marcusrbrown.com: 8 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/Presentations: 3 workflow/guidance/manifest files; source-fetch errors 0.
marcusrbrown/panthea: 6 workflow/guidance/manifest files; source-fetch errors 0.

Progressive Improvement

Tool drift — authoritative npm registry latest; major drift included. Compared with package.json. Renovate owns routine changes; no bump PR opened.

Tool	Pinned	Registry latest	Next step
ESLint	10.12.0	10.13.0	One minor behind; below >one-minor threshold.
Prettier	3.9.1	3.9.10	Patch-only drift, below threshold.
TypeScript	6.0.3	7.0.2	Major drift: review compiler-API compatibility in `scripts/check-solutions-examples.ts`, not just `tsc`.
Vitest	4.1.11	5.0.5	Major drift: review runner/coverage/Stryker compatibility together.

CI/conventions: Main retains lint, types, tests, committed-build, strip-only, actionlint, wiki-authority and mutation guards with the shared setup. Latest Main run 38112400504 succeeded October 11 at unchanged main; that is historical, not fresh CI execution today. Fresh local verification is credited to the remediation handoff. Failed Poll Invitations, Survey Repo and Reconcile Repos are linked above. Existing #3793 owns the Renovate-config validation gap; #3792 owns reusable-workflow grouping; reuse those roots. No newly established convention drift beyond the permission follow-up in the remediation handoff.

Stale TODO/FIXME: no actionable production annotation found in script/workflow/config sources (prompt text and a test fixture are not backlog). Three executable todos at scripts/wiki-lint-issues.test.ts:499–501 date to May 17, 153 days ago: schema/fingerprint rejection and CLI output counters. Next: a testable CLI seam and behavior-level assertions, preserving import safety and no API writes on invalid input.

Compounding pipeline: one open learning proposal #3985, age 5.1d; approved App author fro-bot[bot] has open docs/drafted-solutions PR #3989, age 4.6d, explicitly Closes #3985, with non-failing current checks. Zero uncovered proposals; neither the >14d nor two-or-more-uncovered stall trigger applies. Expected action is authoring into docs/solutions/, already covered by that PR; next is human review/manual merge. Metrics #3674 was not used as evidence of authorship.

Gateway rollout tracker — awareness only. Compared #3512 with all 29 Project 1 items, current managed sources, executed deploy evidence and fresh health:

Claim	Issue body	Project / newer rollout evidence
Producer defects	agent #1736/#1737/#1739/#1740 Open	All four Project items Done. Source completion is separate from runtime acceptance.
Dashboard defects	#583/#584/#585 Open	All three Project items Done.
Markdown #586	Open	Project Todo: consistent.
Overall rollout	Open, acceptance unchecked	Project In Progress: consistent overall; residual acceptance remains.
Contract / gateway version	`1.8.0` / `v0.118.2`	Fresh health advertises 1.11.0; current upstream pin is v0.122.3, matching the operator's deployed-pair evidence. Latest routed gateway deploy job succeeded October 16.
Dashboard deployed	`2026.10.15`	2026.10.43: successful deploy job converged at 19:11 UTC October 16, with requested runtime digest and health verified in its logs. Main compose still says 2026.10.42; open audit PR #1582 records the already-executed `.43` deploy, not a pending deployment.
Browser acceptance	Old 1.8.0 verification; later checks still globally unverified in body	October 16 operator report explicitly passes 1.11.0 signed-in ready, approval waiting display, expired-output handling, question answer/skip, installed-app question notification navigation and desktop push disablement. Credit those reported passes; do not claim independent browser execution by this pass.
Rollback	Snapshot restore plus paired images broadly required after migration	Current gateway guidance: snapshot restore when crossing the one-way ownership migration; paired pin reversal between releases at/after v0.118.2.

Next: the dedicated Gateway Rollout Tracker workflow should reconcile issue-body versions, defect states and acceptance detail. Still owed per the latest operator evidence: approval Once/Always/Reject rechecks, new-run ordering, Refresh and signed-out redirect/button rechecks, closed-app/iOS cold-start notification navigation, reconnect/settlement, checkout details, cancellation, logout/CSRF and privacy/security acceptance. Question-notification success is not approval-notification success; agent #1840 remains the producer run-ID dependency. No tracker comment or Project edit was made.

Needs Human Attention

Operational workflow failures: .github/workflows/poll-invitations.yaml, .github/workflows/survey-repo.yaml, .github/workflows/reconcile-repos.yaml have linked failed executions above. The observation establishes failure, not cause. Inspect failed-step logs before proposing a minimal reversible fix; reuse #3979 only where its tooling/handoff root matches. Verify action references/YAML and affected workflow plus required repository checks. Do not suppress errors, broaden credentials, or retry ingestion until prior-write completion is known.
Permission/advisory follow-ups: today's remediation handoff gives exact .github/workflows/codeql-analysis.yaml, .github/workflows/scorecard.yaml, pnpm-lock.yaml, pnpm-workspace.yaml paths, patched ranges, constraints and verification. Preserve required credential wiring and narrow scope independently, per the token-wiring learning. Moderate/low bumps remain Renovate-owned.
CLI coverage debt: scripts/wiki-lint-issues.ts has an environment-bound CLI entrypoint; scripts/wiki-lint-issues.test.ts:499–501 defers invalid-version/no-write and GITHUB_OUTPUT assertions. Extract the smallest injectable CLI seam preserving the import guard; add behavior-level tests for rejected input and output counters. Verify focused Vitest, types/lint/tests, and mutation guards when configured triggers are touched. Do not delete todos to hide missing coverage.
Rollout reconciliation: use the two-value matrix above through the dedicated tracker. Preserve the distinction between source fixed, released, deploy executed, audit recorded and authenticated acceptance. In marcusrbrown/infra, .github/workflows/deploy-dashboard.yaml deploys before the apps/dashboard/docker-compose.yaml audit PR; do not retry/redeploy merely because Action Required: Fix Renovate Configuration #1582 remains open. Verify the linked run's runtime digest and successful deploy job before interpreting a compose pin as production truth.
Existing improvement roots: #3793 and #3792 own missing Renovate validation/grouping. Scope validation to shipped inputs and cover reusable-workflow dependency types; preserve SHA pinning and required checks. For TypeScript 7, account for scripts/check-solutions-examples.ts compiler imports; for Vitest 5, align runner/coverage/mutation compatibility. Renovate owns version changes.

Delivery: report-only; no metadata, source, workflow, prompt, dependency or knowledge changes authored by this invocation. Existing dirty wiki/metadata state was preserved. New observations are snapshot/rollout evidence or reinforce already-captured CI/deploy lessons, so no duplicate durable wiki entry was added. The Systematic guard is unavailable; repository guard checks are a separate verified contract in the remediation handoff. Temporary collection scripts are removed before completion. No branches, commits, pushes, approvals or PR mutations.

Remediation handoff — 2026-10-18 (UTC)

No eligible minimal repair found. Verified main at 898209884dee4b338cc73a78cb774a9d3949466a; working tree remains clean. No repair branch or PR was needed. This is categories 1–4 evidence for the subsequent observation pass.

Run Summary

Category	Status	Evidence
Errored PRs	✅	All six open heads checked through check runs and legacy statuses; no failures, all mergeable.
Security	⚠️	Zero high/critical npm advisories or applicable high/critical Actions advisories. Three moderate and one low npm advisory remain; override-floor check passes.
Control-Plane Integrity	⚠️	All 146 external references across 31 workflows and two composite actions have full SHA pins and version comments. All 74 production scripts import under Node 24 strip-only; permission hygiene remains deferred.
Code Quality	✅	`pnpm bootstrap`, `pnpm check-types`, `pnpm lint`, and `pnpm test` pass: 102 test files, 5,358 tests passed, three TODOs.

Errored PRs

Inspected #3993, #3991, #3989, #3988, #3987, and #3984 using both commit check-runs and combined legacy status endpoints through gh. All legacy statuses are successful. Merge-state blocking is distinct from CI failure. No PR branch was checked out or executed; no failing/conflicted security-update PR needed repair.

Security

Sources: repository Dependabot and code-scanning alerts, live npm registry advisory data via pnpm audit, and paginated GitHub Advisory Database high/critical Actions records. Advisory ranges were considered across major lines; routine latest-version and major-version drift were not assessed.

Open Dependabot alerts 59, 77, and 79 affect transitive development dependencies. The npm audit additionally identifies GHSA-hrr3-gc8f-f4qj for fast-uri.
Scorecard alert 9 is a high-rated aggregate of these four lower-severity advisories, not a separate high-severity package advisory.
Upstream GitHub tags resolve the pinned CodeQL commit to v4.38.0 and download-artifact commit to v8.0.1, outside their published affected ranges. No applicable high/critical Actions advisory found.

Control-Plane Integrity

Wiki authority still requires an authorized bot on the same-repository data branch. PR privacy scanning executes main code, treats the PR diff as data, and posts a fail-closed legacy status. Promotion retains both privacy gates. Live main protection enforces admins, required checks, code-owner review, stale-review dismissal, and last-push approval; force pushes/deletions are disabled. The active data ruleset restricts creation/update through the App bypass.

Preserved the intentional cache-free setup in .github/workflows/check-private-leak.yaml; replacing it with the cache-restoring shared action would undermine its documented boundary. Credential presence and scope were evaluated separately, following docs/solutions/workflow-issues/required-github-token-for-agent-steps-2026-06-22.md and docs/solutions/best-practices/privacy-gate-promotion-leak-prevention-2026-06-04.md.

Needs Human Attention

Existing permission hygiene: .github/workflows/codeql-analysis.yaml:27–31 grants packages: read and actions: read, although .github/codeql/codeql-config.yml declares no private packs. Verify upstream requirements before removing unnecessary grants; retain analysis/upload permissions. .github/workflows/scorecard.yaml:19 has an unused read-all default overridden by its sole job; narrow that default in a reviewed change. Verify actionlint and actual CodeQL/Scorecard runs. No failing run justifies editing these workflows here. Scorecard alert 1 separately requests two approvals versus the configured one; branch-protection changes require operator ownership.
Lower-severity dependency updates remain Renovate-owned: affected resolutions are in pnpm-lock.yaml; patched thresholds are @humanfs/node >=0.16.8, fast-uri >=4.1.5, and katex >=0.18.2. Review the fast-uri floor in pnpm-workspace.yaml with its future update. Verify pnpm audit, node scripts/check-override-floors.ts, and all four required commands. Do not create autonomous moderate/low version-bump PRs under this high/critical-only contract.
Execution tooling: Systematic workflow guard unavailable in observe mode; repository checks completed independently. This is separate from wiki/privacy guard health.

Existing findings reuse the report thread; no duplicate issue was created. No source, workflow, prompt, dependency, knowledge, or metadata edits. Categories 5–8 and daily-report publication belong to the subsequent observation pass.

Run 39095131863.

Superseded by Daily Fro Bot Report — 2026-10-18 (UTC).

Run Summary

Run 39095131863: categories 5–8 assessed; categories 1–4 inherited from the remediation handoff on this issue.
Public snapshot: 40 repositories; 141 open PRs, 108 aging, 62 stale; 86 stale issues; four unassigned bugs. Hotspots: extend-vscode 99, sparkle 66, containers 64 distinct findings.
Findings: polling/reconcile 401s, TypeScript/Vitest major drift, missing Renovate validation, and Track cross-repo Gateway operator control-surface rollout #3512 body drift versus Project/deployed evidence. One learning proposal is covered by docs(solutions): drafted learnings from open proposals #3989; no uncovered-proposal stall.
Coverage: security endpoint gaps, stale/empty workflow evidence, and unresolved manifest identities remain ❔. Execution workflow guard unavailable in observe mode.
Delivery: new daily issue published; this older report is being closed. Exactly one comment; no tracker/Project edits or new repairs. Existing wiki changes and metadata overlay preserved; no new repository edits retained.
Verification: report structure, size, publication-name checks, current PR checks/legacy statuses, all eight rollout defect states, deployment logs, and live Project fields checked. Repository tests were completed by remediation and were not rerun for this report-only pass.

Navigation Menu

Repository navigation

Daily Fro Bot Report — 2026-10-17 (UTC) #3997