Daily Fro Bot Report — 2026-10-20 (UTC)

Snapshot began 2026-10-20T04:25:20.059587+00:00; workflow/PR checks refreshed during this pass. Run 39368514694.

Run Summary

Category	Status	Notes
Errored PRs	⚠️	Remediation handoff: no repair; both mutation checks now pass; #4014 retains one cancelled Renovate run.
Security	⚠️	Remediation handoff: no high/critical actionable package/Actions advisory; moderate/low advisories remain.
Control-Plane Integrity	⚠️	Remediation handoff: data-branch continuity defect and permission review deferred.
Code Quality	✅	Remediation evidence: bootstrap, types, lint, tests passed; current main CI passed its applicable gates.
Oversight	❔	Findings across 40 public repositories; security endpoints, empty/stale workflow sources and an empty org listing limit coverage. See source table below.
Cross-Project Intelligence	❔	All inventory rows attempted; 32 public source sets inspected. Full inventory coverage cannot be certified; bounded file survey only.
Progressive Improvement	⚠️	TypeScript/Vitest major drift; 0 open learning proposals, no draft PR; tracker body disagrees with Project and rollout evidence.

Errored PRs

Remediation handoff: no repair branch or PR produced. #4014 and #3991 now pass all Main jobs, including mutation guards, and both legacy status contexts. chore(dev): update dependency eslint to v10.13.0 #4014's separate cancelled Renovate run remains cancellation evidence, not a diagnosed code defect; a sibling Renovate check succeeded. Next: normal dependency-review queue.
#3991 blocked/rebase notice: inspect the current head before requesting a destructive Renovate regeneration; no rebase request made here.

Security

Remediation security evidence: three moderate and one low npm advisories; zero high/critical, override-floor check passed. GitHub alert endpoints were available for this repository. npm advisory service and GitHub Advisory Database were the authoritative sources; cross-major applicability was included. Routine version work stays with Renovate.
Fleet alerts are linked under Oversight; they are detection only, not security fixes performed by this job.

Control-Plane Integrity

Remediation evidence: 32 workflows/two composite actions, 152 external references fully SHA/version-comment pinned; strip-only imports and authority/privacy protections checked. #4018 remains the continuity repair; no duplicate opened.
Deferred permissions review: .github/workflows/codeql-analysis.yaml extra read scopes and .github/workflows/scorecard.yaml default read-all; preserve explicit required token wiring and effective job-level overrides.

Code Quality

Remediation results: pnpm bootstrap, pnpm check-types, pnpm lint, pnpm test passed; 110 test files, 5,687 passing tests, 43 skipped, three TODO tests. These are the earlier pass's results, not tests rerun by this report-only pass.
Main at 8c8d64a: Lint, Check Types, Test, Test Scripts Load, Check Workflows and Check Wiki Write Core Dist succeeded. PR-only authority/mutation jobs correctly skipped on push; the two open PRs ran and passed them.

Oversight

Scope/method: paginated authenticated user/repos (owner/collaborator/organization-member) plus paginated user/orgs and each organization's repositories, deduplicated by repository name and retained only with permissions.pull=true. All returned repositories were processed internally; only verified public sources are included here. Organization listings: bfra-me 7, pro-actions 1, psware-ps2 0 (empty; no org-level clean claim). No repository-list request failed.

Public snapshot: 16 new issues (created in the preceding 24 hours, including subsequently closed issues), 140 open PRs, 87 stale issues, 111 aging PRs, 66 stale PRs, 3 unassigned bug-labeled issues. Issue staleness uses last update >30d; PR aging uses creation >7d; PR staleness uses last activity >14d. Old PR candidates were cross-checked against paginated commits, reviews, issue comments and state-change events. Recent PR updated_at excludes a stale classification. Counts/ages are snapshot values, not a claim about reviewer attention.

Top three hotspots, ranked by unique linked findings: each new/stale/unassigned issue once, each open PR once, each latest failing workflow once, each open security alert once. Aging/stale flags do not double-count a PR; unavailable sources do not contribute.

marcusrbrown/extend-vscode: 99 findings; linked finding. Next: prioritize critical/high alerts, then unblock existing PRs.
marcusrbrown/sparkle: 66 findings; linked finding. Next: prioritize critical/high alerts, then unblock existing PRs.
marcusrbrown/containers: 64 findings; linked finding. Next: prioritize critical/high alerts, then unblock existing PRs.

New issues — triage the linked source, assign an owner when actionable:

bfra-me/renovate-action: #3962.
bfra-me/works: #5215.
fro-bot/.github: #4018.
fro-bot/agent: #1882, #1876, #1875.
fro-bot/dashboard: #676, #674.
fro-bot/space-bus: #218.
marcusrbrown/.dotfiles: #2926.
marcusrbrown/dev-like: #178.
marcusrbrown/infra: #1617.
marcusrbrown/marcusrbrown.github.io: #472.
marcusrbrown/mothership: #153.
marcusrbrown/panthea: #251.
marcusrbrown/tokentoilet: #1626.

Open PRs — next: review current checks/conflicts and unblock active heads; reconfirm stale-head intent before rebasing. Aging is not inactivity:

bfra-me/.github: #2907.
bfra-me/github-action: #1467 (aging 125.7d, stale 116.4d), #1466 (aging 125.8d, stale 125.7d), #1463 (aging 126.7d, stale 125.7d).
bfra-me/github-app: #950 (aging 41.4d, stale 41.4d), #843 (aging 125.7d, stale 125.7d), #842 (aging 125.8d, stale 125.7d), #840 (aging 126.7d, stale 125.7d).
bfra-me/ha-addon-repository: #602 (aging 11.5d), #601 (aging 11.9d), #600 (aging 12.2d), #599 (aging 12.2d), #592 (aging 40.8d).
bfra-me/renovate-config: #1383 (aging 222.2d, stale 208.2d).
bfra-me/works: #5227, #5149.
fro-bot/.github: #4014, #3991.
fro-bot/agent: #1881, #1879, #1878, #1874.
fro-bot/space-bus: #217, #202 (aging 13.4d), #193 (aging 21.6d), #177 (aging 35.9d), #135 (aging 78.1d), #72 (aging 100.8d).
marcusrbrown/containers: #809 (aging 22.3d), #758 (aging 56.6d), #744 (aging 66.6d, stale 66.5d), #740 (aging 73.6d, stale 73.5d), #727 (aging 80.5d, stale 75.5d), #723 (aging 81.5d, stale 75.5d).
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai: #27 (aging 730.8d, stale 729.0d), #22 (aging 735.1d, stale 729.7d).
marcusrbrown/gala-chain-code: #72 (aging 959.3d, stale 959.3d), #68 (aging 964.4d, stale 960.0d), #65 (aging 964.4d, stale 964.4d).
marcusrbrown/gpt: #2790 (aging 22.0d, stale 22.0d), #2693 (aging 82.9d, stale 82.9d), #2692 (aging 83.9d, stale 83.9d), #2688 (aging 84.9d, stale 84.9d), #2674 (aging 94.0d, stale 94.0d), #2673 (aging 99.0d, stale 98.0d), #2672 (aging 100.0d, stale 100.0d), #2665 (aging 103.0d, stale 103.0d), #2664 (aging 104.0d, stale 104.0d), #2662 (aging 105.1d, stale 93.0d), #2599 (aging 121.0d, stale 120.0d), #2587 (aging 123.0d, stale 22.0d), #2586 (aging 123.0d, stale 22.0d), #2440 (aging 158.9d, stale 93.0d), #2320 (aging 183.2d, stale 93.0d), #2165 (aging 205.7d, stale 163.0d).
marcusrbrown/ha-config: #896 (aging 45.2d), #777 (aging 159.0d).
marcusrbrown/infra: #1616.
marcusrbrown/marcusrbrown: #1277 (aging 7.7d), #1107 (aging 86.9d, stale 43.0d), #1100 (aging 90.0d, stale 43.0d), #1095 (aging 90.9d, stale 83.9d), #1055 (aging 104.0d, stale 71.9d).
marcusrbrown/marcusrbrown.github.io: #460 (aging 12.0d), #456 (aging 14.0d, stale 14.0d), #454 (aging 14.0d, stale 14.0d), #448 (aging 18.5d), #440 (aging 23.8d), #439 (aging 23.9d), #435 (aging 26.9d), #430 (aging 28.3d), #426 (aging 29.0d).
marcusrbrown/mothership: #139 (aging 13.5d), #132 (aging 19.1d), #122 (aging 27.1d), #111 (aging 35.8d), #108 (aging 37.3d).
marcusrbrown/opencode-copilot-delegate: #335 (aging 79.5d, stale 69.5d), #332 (aging 80.5d, stale 65.5d), #278 (aging 105.1d), #241 (aging 119.5d, stale 69.5d), #135 (aging 157.1d, stale 69.5d).
marcusrbrown/panthea: #249, #247, #246, #237.
marcusrbrown/Presentations: #54 (aging 77.3d).
marcusrbrown/sparkle: #2153, #2128 (aging 13.0d), #2122 (aging 14.0d), #2107 (aging 19.0d, stale 19.0d), #2101 (aging 20.0d, stale 19.0d), #2090 (aging 25.0d, stale 25.0d), #2082 (aging 28.0d, stale 28.0d), #2077 (aging 29.0d, stale 29.0d), #2074 (aging 30.0d, stale 30.0d), #2069 (aging 33.0d, stale 31.0d), #2048 (aging 40.3d, stale 40.3d), #2036 (aging 42.8d).
marcusrbrown/systematic: #1174, #1173, #1171, #1168, #1166, #1165.
marcusrbrown/tokentoilet: #1625, #1623, #1621, #1619, #1617, #1615, #1613, #1611 (aging 7.0d), #1610 (aging 7.8d), #1607 (aging 8.0d), #1606 (aging 8.6d), #1604 (aging 9.0d), #1602 (aging 10.0d), #1601 (aging 11.0d), #1598 (aging 11.0d), #1596 (aging 12.0d), #1593 (aging 13.0d), #1592 (aging 13.1d), #1590 (aging 14.0d, stale 14.0d), #1589 (aging 14.3d), #1583 (aging 15.0d, stale 15.0d), #1579 (aging 16.0d, stale 16.0d), #1573 (aging 17.0d, stale 17.0d), #1567 (aging 18.0d, stale 18.0d), #1559 (aging 19.0d, stale 19.0d), #1552 (aging 20.0d, stale 20.0d).
marcusrbrown/vbs: #740 (aging 56.8d), #717 (aging 73.0d, stale 73.0d), #701 (aging 86.9d, stale 75.9d), #697 (aging 89.0d, stale 75.9d), #693 (aging 90.0d, stale 90.0d), #688 (aging 91.0d, stale 91.0d), #674 (aging 100.0d, stale 100.0d), #672 (aging 102.0d, stale 102.0d), #671 (aging 102.0d, stale 102.0d).

Stale issues — reconfirm intent and next acceptance step:

bfra-me/.github: #2546, #2545.
bfra-me/github-action: #1611, #1380, #1379.
bfra-me/github-app: #767, #752.
bfra-me/ha-addon-repository: #569.
bfra-me/renovate-config: #1395, #1381.
fro-bot/dashboard: #112.
fro-bot/fro-bot.github.io: #1.
fro-bot/space-bus: #81, #63.
fro-bot/systematic: #3, #1.
marcusrbrown/.dotfiles: #2633, #1924.
marcusrbrown/.github: #37.
marcusrbrown/dev-like: #122, #114, #100.
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai: #1.
marcusrbrown/esphome.life: #298, #8.
marcusrbrown/extend-vscode: #319, #318, #317, #142.
marcusrbrown/gala-chain-code: #6.
marcusrbrown/gpt: #2604, #2524, #2519, #2505, #2175, #2174, #2173, #2172, #2171, #2170, #2169, #2168, #2162, #2146, #2144, #2143, #2142, #2141, #2140.
marcusrbrown/marcusrbrown: #1087, #925.
marcusrbrown/marcusrbrown.com: #517, #465, #411.
marcusrbrown/marcusrbrown.github.io: #414, #334.
marcusrbrown/mothership: #19.
marcusrbrown/opencode-copilot-delegate: #38.
marcusrbrown/renovate-config: #1417, #1111, #1096, #1079, #1068.
marcusrbrown/sparkle: #2035, #2032, #2025, #2023, #876.
marcusrbrown/systematic: #1014.
marcusrbrown/tokentoilet: #1507, #1171.
marcusrbrown/vbs: #694, #676, #675, #670, #657, #656, #161, #160, #159, #158, #157, #155, #154, #153, #152, #150.

Unassigned bugs — assign ownership and a reproduction:

bfra-me/ha-addon-repository: #569.
marcusrbrown/marcusrbrown.com: #517, #465.

Latest default-branch workflow failures — inspect the linked failed jobs, reuse existing reports:

bfra-me/github-action / Update Repo Settings: failure, 2026-10-19T22:04:45Z. Next: inspect failure logs; diagnose without weakening the gate.
fro-bot/agent / Auto Release: failure, 2026-03-22T08:33:35Z. Next: inspect failure logs; historical source (>30d), not evidence of a new regression.
marcusrbrown/dev-like / Link Check: failure, 2026-10-19T06:54:39Z. Next: inspect failure logs; diagnose without weakening the gate.
marcusrbrown/extend-vscode / Publish: failure, 2026-10-20T00:59:52Z. Next: inspect failure logs; diagnose without weakening the gate.
marcusrbrown/marcusrbrown.github.io / Performance Testing: failure, 2026-10-19T06:16:51Z. Next: inspect failure logs; diagnose without weakening the gate.

Security alerts — prioritize confirmed critical/high; link to existing security update work before creating anything:

bfra-me/.github: dependabot: 2 (0 critical, 0 high); code-scanning: 6 (0 critical, 2 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
bfra-me/github-action: dependabot: 5 (2 critical, 0 high); code-scanning: 7 (0 critical, 5 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
bfra-me/github-app: dependabot: 20 (2 critical, 4 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
bfra-me/ha-addon-repository: code-scanning: 6 (0 critical, 3 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
bfra-me/renovate-action: dependabot: 2 (0 critical, 0 high); code-scanning: 5 (0 critical, 3 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
bfra-me/renovate-config: code-scanning: 5 (0 critical, 2 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
bfra-me/works: code-scanning: 4 (0 critical, 2 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
fro-bot/.github: dependabot: 3 (0 critical, 0 high); code-scanning: 5 (0 critical, 2 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
fro-bot/agent: code-scanning: 7 (0 critical, 4 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
fro-bot/dashboard: code-scanning: 48 (0 critical, 45 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
fro-bot/space-bus: code-scanning: 4 (0 critical, 1 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/containers: dependabot: 12 (4 critical, 2 high); code-scanning: 46 (7 critical, 10 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/extend-vscode: dependabot: 94 (3 critical, 37 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/gpt: dependabot: 11 (0 critical, 0 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/infra: code-scanning: 3 (0 critical, 3 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/marcusrbrown: dependabot: 3 (0 critical, 0 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/marcusrbrown.com: dependabot: 1 (0 critical, 0 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/marcusrbrown.github.io: dependabot: 4 (0 critical, 3 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/mothership: dependabot: 1 (0 critical, 1 high); code-scanning: 28 (0 critical, 15 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/Presentations: dependabot: 39 (2 critical, 16 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/renovate-config: dependabot: 1 (0 critical, 0 high); code-scanning: 6 (0 critical, 3 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/sparkle: dependabot: 49 (1 critical, 17 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/systematic: code-scanning: 10 (0 critical, 2 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/tokentoilet: dependabot: 4 (0 critical, 2 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.
marcusrbrown/vbs: dependabot: 1 (0 critical, 0 high). Next: triage applicability/reachability; routine bumps remain Renovate-owned.

Unavailable/empty/stale sources (❔, not clean): Dependabot/code-scanning/secret-scanning endpoints were attempted separately in every repository. A 403/404 is not zero alerts. Default-branch workflow runs were fetched per active workflow; PR-only/manual workflows with no such run are listed as empty evidence, not missing CI defects. Historical runs >30d cannot certify current health.

Repository	Unavailable security sources	Empty/historical workflow sources
bfra-me/.github	secret-scanning: 404/disabled	No default-branch run: Dependency Review, PR Triage, Create Renovate Changeset, Trigger Renovate, Copilot code review, Copilot cloud agent
bfra-me/github-action	secret-scanning: 404/disabled	None
bfra-me/github-app	code-scanning: 404/no analysis; secret-scanning: 404/disabled	No default-branch run: Auto Approve
bfra-me/ha-addon-repository	secret-scanning: 404/disabled	Main — >30d old; Hadolint — >30d old; Workflow Lint — >30d old
bfra-me/renovate-action	secret-scanning: 404/disabled	No default-branch run: Dependency Review, Copilot cloud agent
bfra-me/renovate-config	secret-scanning: 404/disabled	No default-branch run: Copilot coding agent
bfra-me/works	secret-scanning: 404/disabled	No default-branch run: Dependency Review, Create Renovate Changeset, Copilot code review, Copilot cloud agent
fro-bot/.github	None	No default-branch run: Dependency Review, Copilot cloud agent, Copilot code review, Copilot, Private Leak Sentinel, Unpublish Wiki (emergency takedown); Copilot Setup Steps — >30d old; Apply Branding — >30d old; Capture Patterns — >30d old
fro-bot/agent	None	No default-branch run: harness-integrate, Copilot, Copilot code review, Copilot cloud agent; Auto Release — >30d old; Copilot Setup Steps — >30d old
fro-bot/dashboard	None	No default-branch run: Dependency Review
fro-bot/fro-bot.github.io	code-scanning: 404/no analysis	pages-build-deployment — >30d old
fro-bot/systematic	code-scanning: 404/no analysis	Dependency Graph — >30d old
fro-bot/tokentoilet	dependabot: 403/archived; code-scanning: 403/disabled	No default-branch run: Copilot Setup Steps; Renovate — >30d old; current HEAD checks/statuses empty
marcusrbrown/.dotfiles	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: Copilot cloud agent
marcusrbrown/.github	code-scanning: 404/no analysis; secret-scanning: 404/not found	None
marcusrbrown/containers	secret-scanning: 404/not found	No default-branch run: Dockerfile Generation Workflow, Copilot code review, Copilot cloud agent; Dependency Graph — >30d old
marcusrbrown/copiloting	dependabot: 403/archived; code-scanning: 403/disabled; secret-scanning: 404/not found	No default-branch run: Copilot coding agent; CI — >30d old; Copilot Setup Steps — >30d old; Fro Bot Autoheal — >30d old; Fro Bot — >30d old; Renovate — >30d old; Update Repo Settings — >30d old
marcusrbrown/cortexkit_anthropic-auth	dependabot: 403/archived; code-scanning: 403/disabled; secret-scanning: 404/not found	No default-branch run: CI, Copilot cloud agent; Copilot Setup Steps — >30d old; Release — >30d old
marcusrbrown/dev-like	code-scanning: 404/no analysis; secret-scanning: 404/not found	None
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai	dependabot: 403/archived; code-scanning: 403/disabled; secret-scanning: 404/not found	No default-branch run: main; current HEAD checks/statuses empty; workflow run inventory empty
marcusrbrown/esphome.life	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: pages-build-deployment
marcusrbrown/extend-vscode	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: Emergency Rollback
marcusrbrown/gala-chain-code	dependabot: 403/archived; code-scanning: 403/disabled; secret-scanning: 404/not found	No default-branch run: main, Renovate, Update Repo Settings; current HEAD checks/statuses empty; workflow run inventory empty
marcusrbrown/gpt	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: Copilot code review, Copilot coding agent; Copilot Setup Steps — >30d old
marcusrbrown/ha-config	code-scanning: 404/no analysis; secret-scanning: 404/not found	None
marcusrbrown/infra	secret-scanning: 404/not found	No default-branch run: Renovate Changesets, Copilot, Copilot cloud agent; Deploy CLIProxy — >30d old; Deploy KeeWeb — >30d old; Deploy Umami — >30d old
marcusrbrown/marcusrbrown	code-scanning: 404/no analysis; secret-scanning: 404/not found	None
marcusrbrown/marcusrbrown.com	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: CI, Copilot code review, Copilot cloud agent; Copilot Setup Steps — >30d old
marcusrbrown/marcusrbrown.github.io	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: CI, Copilot code review, Copilot cloud agent; Copilot Setup Steps — >30d old; E2E Tests — >30d old
marcusrbrown/mothership	secret-scanning: 404/not found	No default-branch run: Dependency Review, Release
marcusrbrown/opencode-copilot-delegate	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: Copilot cloud agent; Copilot Setup Steps — >30d old
marcusrbrown/panthea	code-scanning: 404/no analysis; secret-scanning: 404/not found	None
marcusrbrown/Presentations	code-scanning: 404/no analysis; secret-scanning: 404/not found	None
marcusrbrown/renovate-config	secret-scanning: 404/not found	No default-branch run: Copilot code review, Copilot cloud agent
marcusrbrown/sparkle	code-scanning: 404/no analysis; secret-scanning: 404/not found	Regenerate Documentation — >30d old
marcusrbrown/systematic	secret-scanning: 404/not found	No default-branch run: Publish Claude Code Plugin, Copilot, Copilot code review, Copilot cloud agent; Copilot Setup Steps — >30d old; Dependency Graph — >30d old
marcusrbrown/tokentoilet	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: Copilot, Copilot code review, Copilot cloud agent; Copilot Setup Steps — >30d old
marcusrbrown/vbs	code-scanning: 404/no analysis; secret-scanning: 404/not found	No default-branch run: Copilot code review, Copilot cloud agent; Copilot Setup Steps — >30d old
pro-actions/peter-murray_workflow-application-token-action	dependabot: 403/disabled; code-scanning: 404/no analysis; secret-scanning: 404/disabled	current HEAD checks/statuses empty; workflow run inventory empty

Cross-Project Intelligence

Coverage partial: attempted every row of metadata/repos.yaml, resolving stable repository IDs where present rather than trusting stale names/status. Inspected 32 verifiable public source sets at pinned default-branch commits (automation workflows plus manifest/README where present). Full inventory access coverage cannot be certified from the available source responses. This is a bounded source survey, not a claim of runtime effectiveness. fro-bot/fro-bot.github.io and fro-bot/systematic expose static-site content rather than adoptable automation in the inspected tree. No changes made.

Adoptable findings only:

infra clean-room package smoke: test the packed artifact outside the workspace and check bundled assets/runtime imports. Consider the same for packages/wiki-write-core in addition to its current committed-dist equality gate; verify exported entry points from the tarball, not merely source imports.
systematic host-contract gate/shards/aggregator: explicit required/not-required verdict, missing-report failure, per-file/skip guard and successful-shard requirement. Adopt this evidence-completeness pattern if this repository shards expensive integration/mutation checks; preserve existing authority/privacy checks and pnpm/shared setup. A green aggregate alone is not proof all intended tests executed.

Public survey evidence (one pinned source per scanned repository):

Progressive Improvement

Authoritative current versions: npm registry via pnpm view <package> version (configured registry verified), compared with package.json. Major drift included; latest stable dist-tags, not prerelease guesses.

Tool	Declared	Registry latest	Assessment
ESLint	10.12.0	10.13.0	One minor behind; below “more than a minor” threshold; existing Renovate PR.
Prettier	3.9.1	3.9.10	Patch drift only.
TypeScript	6.0.3	7.0.2	Major drift; evaluate compatibility in Renovate-owned upgrade work.
Vitest	4.1.11	5.0.5	Major drift; evaluate with coverage/Stryker compatibility, not a blind bump.

CI/conventions: Main workflow and latest run retain all expected local gates and shared setup. No missing/degraded local quality job established. Carry forward the permission/lifecycle notes; do not disable checks to make upgrades pass.
TODO/FIXME: code/config scan found no stale actionable annotation; the TODO text in private-leak test fixture is fixture data. Three TODO tests reported by remediation are not proof of a dated, stalled work item.
Compounding: open learning proposals: 0, ages: None. Open docs/drafted-solutions PR: 0, ages: None; no Closes #N exceptions needed. No stall under the >14-day / two-open rule. #3674 currently says ambiguous (October 19); its metrics population is not used as proposal-authoring evidence.

Gateway rollout awareness (category 8):

#3512 body says contract 1.8.0, gateway v0.118.2, dashboard 2026.10.15. Live health independently returns 1.12.0. infra gateway pin is v0.124.0; dashboard pin is 2026.10.51, with a successful .51 deploy. The .52 deploy is waiting, not deployed evidence. Health verifies contract only, not image identity or behavioral acceptance.
Project 1 has 29 items, all retrieved. Track cross-repo Gateway operator control-surface rollout #3512 is In Progress, consistent with its open/acceptance-incomplete state. Its body lists agent #1736, #1737, #1739, #1740, and dashboard #583, #584, #585, #586 as Open; the corresponding Project items are all Done and the issues are no longer in the open inventory.
The body still leaves the question-producing/live-checkout acceptance boxes unchecked; Done implementation is not proof of live acceptance. October 19 signed-in results separately credit SSE ready 1.12.0, prompt enforcement and an already-open-app approval deep link; acknowledgment retains cold-start iOS/provider-failure/other acceptance gaps. Merged acceptance runbook is newer than the body. Next: the dedicated tracker workflow should reconcile the rollup and matrix, preserving remaining acceptance work. No tracker comments or Project edits made here.

Needs Human Attention

Serving-branch continuity — reuse #4018. Root cause: promotion deletes the serving data ref and policy consumers cannot refresh. Smallest safe scoped follow-up spans .github/settings.yml, .github/workflows/merge-data.yaml, scripts/merge-data-pr.ts and lifecycle tests: preserve data, non-destructively reconcile main, retain concurrent writes, stop/alert on conflict. Do not retry delete-and-reseed as normal operation. Verify squash promotion, concurrent writes and conflicts; keep branch protections/privacy/authority gates intact. This report-only pass makes no fix or settings change.
Unavailable is not empty — reuse agent#1875 and dashboard#674. Preserve fail-closed authorization while distinguishing policy unavailability from a legitimate empty listing. Entry points: agent packages/gateway/src/redaction/denylist.ts and packages/gateway/src/web/operator/{repos,runs}-route.ts; dashboard src/gateway/operator-client.ts, public/operator-launch.js, web/src/operator/ and paired tests. Verify cold-start/no-cache outage and successful refresh recovery, without relaxing denylist enforcement. Signed-in incident/acceptance evidence and runbook provide the entry point.
Rollup drift — #3512, Project 1. Dedicated tracker owns writes. Reconcile stale 1.8.0/image/Open claims against the 1.12.0 health response, pinned/deploy evidence, eight Done items and signed-in acceptance comments above. Do not mark unchecked runtime/privacy/security acceptance complete from merge/Project status alone; do not claim waiting .52 deployment succeeded.
Routine tool majors — package.json. Renovate owns TypeScript 7/Vitest 5 evaluation. Keep upgrades separate from unrelated security fixes, check config/plugin/Stryker compatibility and run bootstrap/types/lint/tests plus applicable mutation guards; do not lower thresholds or suppress failures. No version changes made.
Coverage gaps — use the linked source table above. Obtain missing alert access/analysis evidence in the appropriate operator context; investigate empty/stale CI sources before claiming health. Empty PR-only/manual history is not a defect by itself. No secrets, settings, protections, labels or individual issue/PR state were modified by oversight.

Report-only source audit; no repository files changed. No new durable lesson beyond existing cited incident/runbook evidence was authored into the wiki. Superseded daily reports are closed without closing comments to honor the invocation's higher-priority exactly one comment limit; the one marked summary comment belongs on this report.

Daily oversight published in this report. The previous report is closed with a body backlink; no closing comment was added because this invocation permits exactly one comment.

Run Summary

Category	Status	Notes
Errored PRs	⚠️	Remediation handoff inspected; both mutation checks now pass, one Renovate cancellation remains.
Security	⚠️	Remediation found moderate/low package advisories; fleet alerts linked in the report.
Control-Plane Integrity	⚠️	Reuse #4018 for serving-data-branch continuity.
Code Quality	✅	Earlier remediation gates passed; applicable main CI gates pass.
Oversight	❔	40 public repositories: 140 open PRs, 87 stale issues; unavailable/empty/stale evidence listed explicitly.
Cross-Project Intelligence	❔	Every inventory row attempted; 32 public source sets scanned, full coverage uncertified.
Progressive Improvement	⚠️	TypeScript/Vitest major drift; zero learning proposals; #3512 body trails Project/live contract 1.12.0.

Source run. No repository-file changes; no tracker or Project writes. Dedicated tracker owns rollout reconciliation.

Remediation handoff — 2026-10-21 UTC

No eligible autohealing changes. Categories 1–4 inspected against main at f193b3ce. Working tree clean; no branch, commit, or PR needed.

Run Summary

Category	Result	Evidence
Errored PRs	Pass	Only open PR: #4029, a mergeable Renovate update. No failed check runs; the separately queried legacy Private Leak Scan status is successful.
Security	No high/critical package finding	Dependabot alerts accessible: 0 open. Override-floor gate exits 0. Four package advisories remain moderate/low; no affected high/critical Actions advisory identified.
Control-Plane Integrity	Existing issue needs attention	153 third-party references in 34 workflow/action YAML files have full SHA pins and version comments. Node strip-only imports and erasable-syntax lint pass. Effective job permissions are scoped; setup exceptions preserve documented privacy/build/release boundaries. Data-branch continuity remains tracked in #4018.
Code Quality	Pass	Bootstrap, check-types, lint, and test all exit 0. 110 test files passed; 5,648 tests passed, 43 skipped, 3 todo.

Security detail

Sources: the npm advisory feed queried by bun audit --json, GitHub repository alerts, and the GitHub Advisory Database, including its Actions high/critical advisories. Comparisons used vulnerable ranges and fixed releases. Routine latest-version and major-version drift were not surveyed.

@humanfs/node: GHSA-p498-v437-472g, moderate; fixed in 0.16.8.
fast-uri: GHSA-hrr3-gc8f-f4qj and GHSA-jvvf-x445-j334, moderate; installed 4.x line fixed in 4.1.5.
katex: GHSA-238p-pmpm-9mq7, low; fixed in 0.18.2.

These remain Renovate-owned. Scorecard alert #9 labels the aggregate finding high, but its four underlying advisories above are moderate/low; that aggregate label does not authorize a security-bump PR under this run policy.

Needs Human Attention

Reuse Keep the data branch present through promotion #4018 — serving data branch disappears during promotion. .github/settings.yml:115–130 deliberately omits deletion protection and documents delete/reseed behavior; scripts/merge-data-pr.ts owns promotion. Repair requires operator-owned deletion protection plus non-destructive, App-authored reconciliation of main into data, preserving concurrent writes and stopping on conflicts. Update lifecycle comments and tests together. Verify continuity through squash promotion, concurrent writes, conflicts, and bootstrap recovery. This exceeds a minimal reversible autoheal and touches branch-protection policy. Do not retry by deleting/reseeding data, force-pushing, or weakening privacy gates.
Existing Scorecard findings require contextual review. #45 points to the npm scratch-tool install in .github/workflows/release-wiki-write-core.yaml:171, not a floating action. It uses exact tool versions, disabled lifecycle scripts, and a three-day release-age floor; transitive tool locking needs separate design and release-path verification. #1 requests more than the configured one approving review. Live main protection enforces admins and all 14 required checks. Review policy with the operator; do not change settings or suppress these findings in this pass.

Guard review followed docs/solutions/security-issues/wiki-authority-guard-branch-name-spoofable-2026-10-10.md: authority requires the same-repository data head and an authorized author. Wiki and metadata files were not modified.

Source run. Categories 5–8 and the daily report remain with the subsequent observe pass.

Superseded by today’s Daily Fro Bot Report.

Run Summary

Category	Status	Notes
Errored PRs	✅	Remediation handoff and current #4029 checks/statuses agree; no failing eligible PR.
Security	⚠️	Remediation found no high/critical package advisory; moderate/low advisory and Scorecard follow-up remain.
Control-Plane Integrity	⚠️	Remediation verified pins/strip-only/guards; existing data-branch continuity issue #4018 remains.
Code Quality	✅	Remediation gates passed; observe wiki validation and required local checks also passed.
Oversight	❔	Findings detected; unavailable alerts and empty/historical run sources prevent verified-clean fleet coverage.
Cross-Project Intelligence	❔	31 public tracked source snapshots inspected; two have no automation files; full-inventory coverage uncertified.
Progressive Improvement	⚠️	TypeScript/Vitest major drift; zero learning proposals; eight tracker/Project discrepancies and contract drift.

40 public repositories inspected: 143 open PRs, 111 aging PRs, 91 stale issues. Hotspots: extend-vscode (100), sparkle (75), containers (64). Source gaps and all eight tracker/Project discrepancies are linked in the report. Exactly one summary comment is used as the previous report’s closing backlink.

Additive cancellation-proof knowledge left dirty for trusted wiki ingestion; incoming changes preserved. Bootstrap, check-types, lint, test (5,648 passed), wiki lint (zero deterministic findings), and diff whitespace check passed. No tracker/Project writes. Source run.

Navigation Menu

Repository navigation

Daily Fro Bot Report — 2026-10-20 (UTC) #4022