Daily Fro Bot Report — 2026-10-29 (UTC) #4071

Daily Fro Bot Report — 2026-10-29 (UTC)

Run Summary

Category	Status	Notes
Errored PRs	✅	Remediation handoff: only open PR #4069 has successful checks and legacy status; no repair produced.
Security	⚠️	Remediation handoff: zero high/critical audit findings; existing high CodeQL parser findings remain.
Control-Plane Integrity	⚠️	Remediation handoff: pins, strip-only imports and live protections verified; Scorecard permission-convention debt remains.
Code Quality	✅	Remediation handoff: bootstrap/types/lint/tests passed; 6,433 tests passed, 43 skipped, 3 todo.
Oversight	❔	Findings present; all account/organization repository listings paginated. Public security-source gaps and empty CI evidence are itemized below. Rollout deployment/release claims have drifted.
Cross-Project Intelligence	❔	Registry coverage partial: 32 public tracked trees read, 30 with automation/guidance sources; full-registry completeness not certified.
Progressive Improvement	⚠️	npm latest includes major drift: TypeScript 6→7 and Vitest 4→5. Zero open learning proposals. Registry accessibility status is stale for copiloting.

Errored PRs

• #4069: current open Renovate PR; handoff verified 22 check runs, successful separate private-leak legacy status, and mergeability. No remediation PR was produced. Next: normal Renovate review.

Security

• Prior-pass evidence: zero open Dependabot alerts/repository advisories returned; override-floor gate passed. Audit: 0 critical, 0 high, 8 moderate, 3 low. Routine upgrades remain with Renovate.
• Existing CodeQL #46 and #47: parser ReDoS deferred by scope cap. Scorecard #9 is an aggregate high classification over lower-severity package advisories, not a new high package advisory. Next: bounded parser work described under Needs Human Attention.

Control-Plane Integrity

• Prior-pass evidence: 154 external action references across 35 YAML files are full-SHA/version-comment pinned; 84/84 production modules imported under Node 24 strip-only; live main/data protections and wiki/privacy guards checked. No protections changed.
• Scorecard workflow: default read-all convention debt remains; preserve required job-scoped SARIF/OIDC writes during any review. Existing branch-protection alert needs reconciliation with the live protections verified by the prior pass.

Code Quality

• Prior-pass validation on main at c30d0c1: bun run bootstrap, bun run check-types, bun run lint, bun run test passed; 118 test files, 6,433 passed, 43 skipped, 3 todo. This oversight pass inherits that evidence; it did not repeat categories 1–4.

Oversight

Coverage/method. Authenticated account repository listing and all three organization listings were paginated and deduplicated; read access means repositories returned with read/pull access. No repository-listing request failed. This public report covers 41 public repositories. Issues, PRs, PR activity timelines, security-alert lists, default-head check runs and legacy statuses were paginated. Latest check per application/name and latest legacy context were used; canceled matrix siblings are not counted as failed checks. New means created in the preceding 24 hours; issue stale means no update for >30 days; PR aging means creation >7 days and PR stale means last commit/review/comment/state activity >14 days. Current-snapshot counts are evidence counts, not deduplicated root causes.
Snapshot: 14 new issues, 165 open PRs (128 aging, 0 stale), 99 stale issues, 3 unassigned labeled bugs, 4 failed default-head checks, 608 open security-tool alerts. Automated daily-report issues are included in new-issue counts; CodeQL/Scorecard classifications are not assumed to be exploitable dependency advisories.
Top three hotspots — ranked by unique qualifying finding URL in this snapshot:

1. marcusrbrown/extend-vscode — 109: 4 stale issues, 1 main failures, 104 security. Linked finding. Next: prioritize critical/high dependency reachability and reuse existing security-update PRs; diagnose the failed vulnerability gate.
2. marcusrbrown/sparkle — 93: 5 stale issues, 14 open prs, 12 aging prs, 74 security. Linked finding. Next: prioritize critical/high dependency reachability and reuse existing security-update PRs; review the oldest dependency queue.
3. marcusrbrown/tokentoilet — 77: 1 new, 5 stale issues, 43 open prs, 33 aging prs, 28 security. Linked finding. Next: prioritize critical/high dependency reachability and reuse existing security-update PRs; review the oldest dependency queue.

Repository snapshot and next steps (links are source inventories; unavailable sources are listed separately).

Repository	Findings / recommended next step
marcusrbrown/extend-vscode	4 stale issues: confirm relevance; 104 alerts: prioritize/validate; 1 failed checks: diagnose
marcusrbrown/sparkle	14 PRs (12 aging): review oldest; 5 stale issues: confirm relevance; 74 alerts: prioritize/validate
marcusrbrown/tokentoilet	1 new: triage; 43 PRs (33 aging): review oldest; 5 stale issues: confirm relevance; 28 alerts: prioritize/validate
fro-bot/dashboard	1 new: triage; 1 stale issues: confirm relevance; 49 alerts: prioritize/validate
marcusrbrown/panthea	1 new: triage; 8 PRs (4 aging): review oldest; 41 alerts: prioritize/validate
marcusrbrown/mothership	1 new: triage; 6 PRs (5 aging): review oldest; 2 stale issues: confirm relevance; 39 alerts: prioritize/validate
marcusrbrown/gpt	16 PRs (13 aging): review oldest; 19 stale issues: confirm relevance; 9 alerts: prioritize/validate
marcusrbrown/Presentations	1 PRs (1 aging): review oldest; 41 alerts: prioritize/validate
marcusrbrown/marcusrbrown.github.io	1 new: triage; 15 PRs (10 aging): review oldest; 3 stale issues: confirm relevance; 17 alerts: prioritize/validate; 3 failed checks: diagnose
bfra-me/github-app	4 PRs (4 aging): review oldest; 2 stale issues: confirm relevance; 32 alerts: prioritize/validate
marcusrbrown/vbs	9 PRs (9 aging): review oldest; 17 stale issues: confirm relevance; 7 alerts: prioritize/validate
bfra-me/renovate-action	1 new: triage; 2 stale issues: confirm relevance; 29 alerts: prioritize/validate
bfra-me/github-action	3 PRs (3 aging): review oldest; 3 stale issues: confirm relevance; 25 alerts: prioritize/validate
fro-bot/agent	2 new: triage; 2 PRs (0 aging): review oldest; 20 alerts: prioritize/validate
marcusrbrown/containers	4 PRs (3 aging): review oldest; 18 alerts: prioritize/validate
marcusrbrown/marcusrbrown	5 PRs (4 aging): review oldest; 4 stale issues: confirm relevance; 10 alerts: prioritize/validate
bfra-me/.github	3 stale issues: confirm relevance; 14 alerts: prioritize/validate
fro-bot/space-bus	1 new: triage; 6 PRs (6 aging): review oldest; 2 stale issues: confirm relevance; 8 alerts: prioritize/validate
bfra-me/ha-addon-repository	5 PRs (5 aging): review oldest; 1 stale issues: confirm relevance; 1 unassigned bugs: assign; 6 alerts: prioritize/validate
marcusrbrown/renovate-config	5 stale issues: confirm relevance; 7 alerts: prioritize/validate
marcusrbrown/marcusrbrown.com	4 PRs (1 aging): review oldest; 3 stale issues: confirm relevance; 2 unassigned bugs: assign; 3 alerts: prioritize/validate
marcusrbrown/systematic	10 alerts: prioritize/validate
bfra-me/works	1 new: triage; 4 PRs (2 aging): review oldest; 4 alerts: prioritize/validate
bfra-me/renovate-config	1 PRs (1 aging): review oldest; 2 stale issues: confirm relevance; 5 alerts: prioritize/validate
fro-bot/.github	1 new: triage; 1 PRs (0 aging): review oldest; 6 alerts: prioritize/validate
marcusrbrown/opencode-copilot-delegate	6 PRs (5 aging): review oldest; 1 stale issues: confirm relevance
marcusrbrown/dev-like	5 stale issues: confirm relevance
marcusrbrown/gala-chain-code	3 PRs (3 aging): review oldest; 1 stale issues: confirm relevance
marcusrbrown/infra	1 new: triage; 1 PRs (0 aging): review oldest; 2 alerts: prioritize/validate
marcusrbrown/.dotfiles	1 new: triage; 2 stale issues: confirm relevance
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai	2 PRs (2 aging): review oldest; 1 stale issues: confirm relevance
fro-bot/systematic	2 stale issues: confirm relevance
marcusrbrown/esphome.life	2 stale issues: confirm relevance
marcusrbrown/ha-config	2 PRs (2 aging): review oldest
fro-bot/fro-bot.github.io	1 stale issues: confirm relevance
marcusrbrown/.github	1 stale issues: confirm relevance
marcusrbrown/metacogs	1 new: triage
fro-bot/tokentoilet	No qualifying finding in checked sources; see source gaps before inferring clean.
marcusrbrown/copiloting	No qualifying finding in checked sources; see source gaps before inferring clean.
marcusrbrown/cortexkit_anthropic-auth	No qualifying finding in checked sources; see source gaps before inferring clean.
pro-actions/peter-murray_workflow-application-token-action	No qualifying finding in checked sources; see source gaps before inferring clean.

New issues — triage links:

• marcusrbrown/tokentoilet: #1653. Next: triage the issue/report.
• fro-bot/dashboard: #733. Next: triage the issue/report.
• marcusrbrown/panthea: #265. Next: triage the issue/report.
• marcusrbrown/mothership: #163. Next: triage the issue/report.
• marcusrbrown/marcusrbrown.github.io: #487. Next: triage the issue/report.
• bfra-me/renovate-action: #4006. Next: triage the issue/report.
• fro-bot/agent: #1978, #1970. Next: review the linked report or issue; agent#1970 needs approval-boundary investigation.
• fro-bot/space-bus: #226. Next: triage the issue/report.
• bfra-me/works: #5324. Next: triage the issue/report.
• fro-bot/.github: #4070. Next: triage the issue/report.
• marcusrbrown/infra: #1708. Next: triage the issue/report.
• marcusrbrown/.dotfiles: #3026. Next: triage the issue/report.
• marcusrbrown/metacogs: #52. Next: triage the issue/report.

Failed default-head checks — investigate linked logs:

• marcusrbrown/extend-vscode: Pre-Release Validation (vulnerabilities). Next: diagnose the failing gate without lowering thresholds.
• marcusrbrown/marcusrbrown.github.io: Performance Summary. Next: diagnose the failing gate without lowering thresholds.
• marcusrbrown/marcusrbrown.github.io: Performance Audit (mobile). Next: diagnose the failing gate without lowering thresholds.
• marcusrbrown/marcusrbrown.github.io: Performance Audit (desktop). Next: diagnose the failing gate without lowering thresholds.

Open PR activity inventory. All 165 PRs measured; oldest five per repository linked below. Each link gives creation age / inactivity in days; A marks >7-day aging. No PR met the >14-day inactivity threshold. Next: review/rebase oldest work; routine dependency upgrades stay with Renovate. Full queues are linked in the repository table.

Oldest PRs, with creation age and most recent activity

• marcusrbrown/sparkle: #2036 51.9d/0.2d A, #2048 49.4d/1.0d A, #2069 42.0d/1.0d A, #2074 39.0d/1.0d A, #2077 38.0d/1.0d A; 9 additional PRs in linked queue.
• marcusrbrown/tokentoilet: #1552 29.1d/1.0d A, #1559 28.1d/0.1d A, #1567 27.1d/1.0d A, #1573 26.1d/1.0d A, #1579 25.0d/1.0d A; 38 additional PRs in linked queue.
• marcusrbrown/panthea: #237 13.9d/0.1d A, #247 11.4d/1.0d A, #246 11.4d/1.0d A, #252 8.2d/0.1d A, #257 5.1d/0.1d; 3 additional PRs in linked queue.
• marcusrbrown/mothership: #108 46.4d/1.0d A, #111 44.8d/1.0d A, #122 36.2d/0.0d A, #139 22.5d/0.0d A, #155 8.4d/0.0d A; 1 additional PRs in linked queue.
• marcusrbrown/gpt: #2165 214.8d/1.0d A, #2320 192.2d/1.0d A, #2440 168.0d/1.0d A, #2599 130.0d/1.0d A, #2662 114.2d/1.0d A; 11 additional PRs in linked queue.
• marcusrbrown/Presentations: #54 86.3d/1.0d A
• marcusrbrown/marcusrbrown.github.io: #426 38.1d/0.1d A, #430 37.3d/0.1d A, #435 35.9d/0.0d A, #439 32.9d/0.1d A, #440 32.8d/0.1d A; 10 additional PRs in linked queue.
• bfra-me/github-app: #840 135.7d/1.0d A, #843 134.8d/1.0d A, #842 134.8d/1.0d A, #950 50.4d/1.0d A
• marcusrbrown/vbs: #672 111.0d/1.0d A, #671 111.0d/1.0d A, #674 109.0d/1.0d A, #688 100.0d/1.0d A, #693 99.0d/1.0d A; 4 additional PRs in linked queue.
• bfra-me/github-action: #1463 135.7d/1.0d A, #1467 134.8d/1.0d A, #1466 134.8d/1.0d A
• fro-bot/agent: #1982 0.1d/0.0d, #1983 0.0d/0.0d
• marcusrbrown/containers: #723 90.6d/1.0d A, #740 82.6d/1.0d A, #744 75.6d/0.6d A, #830 4.6d/1.0d
• marcusrbrown/marcusrbrown: #1055 113.0d/1.0d A, #1095 100.0d/1.0d A, #1100 99.0d/1.0d A, #1107 95.9d/1.0d A, #1308 2.5d/0.2d
• fro-bot/space-bus: #72 109.8d/0.1d A, #135 87.1d/0.1d A, #177 45.0d/0.1d A, #193 30.6d/0.1d A, #202 22.5d/0.1d A; 1 additional PRs in linked queue.
• bfra-me/ha-addon-repository: #592 49.9d/1.0d A, #600 21.2d/1.0d A, #599 21.2d/1.0d A, #601 20.9d/1.0d A, #602 20.6d/1.0d A
• marcusrbrown/marcusrbrown.com: #605 7.2d/0.2d A, #607 5.2d/0.2d, #606 5.2d/1.0d, #608 1.1d/0.1d
• bfra-me/works: #5149 13.9d/0.8d A, #5245 7.9d/0.8d A, #5277 4.9d/0.8d, #5328 0.1d/0.1d
• bfra-me/renovate-config: #1383 231.2d/1.0d A
• fro-bot/.github: #4069 2.0d/1.0d
• marcusrbrown/opencode-copilot-delegate: #135 166.2d/1.0d A, #241 128.5d/1.0d A, #278 114.2d/0.0d A, #332 89.5d/1.0d A, #335 88.5d/1.0d A; 1 additional PRs in linked queue.
• marcusrbrown/gala-chain-code: #65 973.5d/1.0d A, #68 973.4d/1.0d A, #72 968.4d/1.0d A
• marcusrbrown/infra: #1705 0.7d/0.1d
• marcusrbrown/encode-2024-q3-grp14-jobseeker-ai: #22 744.1d/1.0d A, #27 739.8d/1.0d A
• marcusrbrown/ha-config: #777 168.1d/1.0d A, #896 54.2d/1.0d A

Stale issues and unassigned bugs

Next for every stale issue: confirm relevance and request a concrete next step; assign each linked unassigned bug.

• marcusrbrown/extend-vscode: #319 (stale 437.5d), #318 (stale 361.9d), #317 (stale 437.5d), #142 (stale 868.9d)
• marcusrbrown/sparkle: #2035 (stale 52.0d), #2032 (stale 52.1d), #2025 (stale 52.3d), #2023 (stale 52.3d), #876 (stale 387.0d)
• marcusrbrown/tokentoilet: #1520 (stale 38.1d), #1519 (stale 38.1d), #1518 (stale 38.1d), #1517 (stale 38.1d), #1171 (stale 130.3d)
• fro-bot/dashboard: #112 (stale 125.1d)
• marcusrbrown/mothership: #128 (stale 31.3d), #19 (stale 102.0d)
• marcusrbrown/gpt: #2604 (stale 73.0d), #2524 (stale 144.0d), #2519 (stale 145.0d), #2505 (stale 75.0d), #2175 (stale 214.6d), #2174 (stale 214.6d), #2173 (stale 214.6d), #2172 (stale 214.6d), #2171 (stale 214.6d), #2170 (stale 214.6d), #2169 (stale 214.6d), #2168 (stale 214.6d), #2162 (stale 214.6d), #2146 (stale 217.3d), #2144 (stale 217.3d), #2143 (stale 217.3d), #2142 (stale 217.3d), #2141 (stale 217.3d), #2140 (stale 217.3d)
• marcusrbrown/marcusrbrown.github.io: #431 (stale 37.1d), #414 (stale 42.1d), #334 (stale 56.9d)
• bfra-me/github-app: #767 (stale 217.0d), #752 (stale 50.4d)
• marcusrbrown/vbs: #755 (stale 30.1d), #694 (stale 99.0d), #676 (stale 40.1d), #675 (stale 109.0d), #670 (stale 111.0d), #657 (stale 119.0d), #656 (stale 114.0d), #161 (stale 437.3d), #160 (stale 437.3d), #159 (stale 437.3d), #158 (stale 437.3d), #157 (stale 437.3d), #155 (stale 442.9d), #154 (stale 442.9d), #153 (stale 442.9d), #152 (stale 442.9d), #150 (stale 382.9d)
• bfra-me/renovate-action: #3842 (stale 34.1d), #3835 (stale 35.2d)
• bfra-me/github-action: #1611 (stale 41.4d), #1380 (stale 229.2d), #1379 (stale 50.4d)
• marcusrbrown/marcusrbrown: #1087 (stale 102.0d), #1056 (stale 31.0d), #1039 (stale 31.0d), #925 (stale 158.3d)
• bfra-me/.github: #2788 (stale 34.1d), #2546 (stale 74.9d), #2545 (stale 74.9d)
• fro-bot/space-bus: #81 (stale 109.3d), #63 (stale 110.3d)
• bfra-me/ha-addon-repository: #569 (stale 57.0d, unassigned bug)
• marcusrbrown/renovate-config: #1417 (stale 124.5d), #1111 (stale 168.5d), #1096 (stale 233.8d), #1079 (stale 240.8d), #1068 (stale 247.8d)
• marcusrbrown/marcusrbrown.com: #517 (stale 81.0d, unassigned bug), #465 (stale 113.0d, unassigned bug), #411 (stale 167.0d)
• bfra-me/renovate-config: #1395 (stale 227.5d), #1381 (stale 231.2d)
• marcusrbrown/opencode-copilot-delegate: #38 (stale 185.3d)
• marcusrbrown/dev-like: #142 (stale 30.9d), #131 (stale 37.9d), #122 (stale 44.9d), #114 (stale 51.9d), #100 (stale 58.9d)
• marcusrbrown/gala-chain-code: #6 (stale 968.4d)
• marcusrbrown/.dotfiles: #2633 (stale 41.6d), #1924 (stale 125.1d)
• marcusrbrown/encode-2024-q3-grp14-jobseeker-ai: #1 (stale 737.4d)
• fro-bot/systematic: #3 (stale 124.6d), #1 (stale 234.1d)
• marcusrbrown/esphome.life: #298 (stale 322.3d), #8 (stale 1228.9d)
• fro-bot/fro-bot.github.io: #1 (stale 234.1d)
• marcusrbrown/.github: #37 (stale 1180.1d)

Security alert inventory and unavailable sources

Alert lists are linked rather than copied. Prioritize critical/high reachability; match existing PRs before remediation. Code-scanning tool classifications include Scorecard findings.

Repository	Accessible alert inventory	Unavailable / incomplete source
marcusrbrown/extend-vscode	dependabot: 3 critical, 39 high, 14 low, 48 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/sparkle	dependabot: 2 critical, 27 high, 14 low, 31 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/tokentoilet	dependabot: 2 critical, 8 high, 6 low, 12 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
fro-bot/dashboard	code: 46 high, 2 low, 1 medium	None
marcusrbrown/panthea	dependabot: 5 critical, 23 high, 13 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/mothership	dependabot: 5 high, 1 low, 5 medium; code: 15 high, 1 low, 11 medium, 1 note	secrets HTTP 404: not available/not enabled
marcusrbrown/gpt	dependabot: 1 low, 8 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/Presentations	dependabot: 2 critical, 18 high, 1 low, 20 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/marcusrbrown.github.io	dependabot: 6 high, 2 low, 9 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
bfra-me/github-app	dependabot: 2 critical, 7 high, 8 low, 15 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/vbs	dependabot: 3 low, 4 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
bfra-me/renovate-action	dependabot: 11 high, 3 low, 10 medium; code: 3 high, 1 low, 1 medium	secrets HTTP 404: not available/not enabled
bfra-me/github-action	dependabot: 2 critical, 3 high, 5 low, 8 medium; code: 5 high, 1 low, 1 medium	secrets HTTP 404: not available/not enabled
fro-bot/agent	code: 6 high, 4 low, 8 medium, 1 note, 1 warning	None
marcusrbrown/containers	dependabot: 2 high; code: 6 high, 3 medium, 3 note, 4 warning	secrets HTTP 404: not available/not enabled
marcusrbrown/marcusrbrown	dependabot: 2 high, 4 low, 4 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
bfra-me/.github	dependabot: 3 low, 2 medium; code: 3 high, 1 low, 5 medium	secrets HTTP 404: not available/not enabled
fro-bot/space-bus	dependabot: 2 high, 2 medium; code: 1 high, 1 low, 2 medium	None
bfra-me/ha-addon-repository	code: 3 high, 1 low, 2 medium	secrets HTTP 404: not available/not enabled
marcusrbrown/renovate-config	dependabot: 1 low; code: 3 high, 1 low, 2 medium	secrets HTTP 404: not available/not enabled
marcusrbrown/marcusrbrown.com	dependabot: 1 low, 2 medium	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/systematic	code: 2 high, 1 low, 3 medium, 3 note, 1 warning	secrets HTTP 404: not available/not enabled
bfra-me/works	code: 2 high, 1 low, 1 medium	secrets HTTP 404: not available/not enabled
bfra-me/renovate-config	code: 2 high, 1 low, 2 medium	secrets HTTP 404: not available/not enabled
fro-bot/.github	code: 4 high, 1 low, 1 medium	None
marcusrbrown/opencode-copilot-delegate	No open alert in successfully read sources	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/dev-like	No open alert in successfully read sources	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/gala-chain-code	No open alert in successfully read sources	dependabot HTTP 403: access denied; code HTTP 403: access denied; secrets HTTP 404: not available/not enabled; default-head CI empty
marcusrbrown/infra	code: 2 high	secrets HTTP 404: not available/not enabled
marcusrbrown/.dotfiles	No open alert in successfully read sources	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai	No open alert in successfully read sources	dependabot HTTP 403: access denied; code HTTP 403: access denied; secrets HTTP 404: not available/not enabled; default-head CI empty
fro-bot/systematic	No open alert in successfully read sources	code HTTP 404: not available/not enabled
marcusrbrown/esphome.life	No open alert in successfully read sources	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/ha-config	No open alert in successfully read sources	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
fro-bot/fro-bot.github.io	No open alert in successfully read sources	code HTTP 404: not available/not enabled
marcusrbrown/.github	No open alert in successfully read sources	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
marcusrbrown/metacogs	No open alert in successfully read sources	code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled
fro-bot/tokentoilet	No open alert in successfully read sources	dependabot HTTP 403: access denied; code HTTP 403: access denied; default-head CI empty
marcusrbrown/copiloting	No open alert in successfully read sources	dependabot HTTP 403: access denied; code HTTP 403: access denied; secrets HTTP 404: not available/not enabled
marcusrbrown/cortexkit_anthropic-auth	No open alert in successfully read sources	dependabot HTTP 403: access denied; code HTTP 403: access denied; secrets HTTP 404: not available/not enabled
pro-actions/peter-murray_workflow-application-token-action	No open alert in successfully read sources	dependabot HTTP 403: access denied; code HTTP 404: not available/not enabled; secrets HTTP 404: not available/not enabled; default-head CI empty

Empty default-head evidence cannot certify CI health. A 404 does not establish zero alerts; confirm feature enablement/access before rescanning. Historical check failures superseded by a later same-name success were excluded: the survey conflict was followed by successful fresh survey/ingest. Do not replay the stale handoff or weaken its conflict check.

**Gateway rollout review — report-only:** - [#3512](https://github.com//issues/3512) says `In Progress / blocked`; [Project 1](https://github.com/users/fro-bot/projects/1) agrees. All **62** linked live issue/PR states were rechecked against Project status: **0 status mismatches**. Implementation `Done` remains distinct from live acceptance. - **Deployment mismatch:** #3512 and its Project `gateway Unit Gate` both say Dashboard **2026.10.74 deployed / .75 undeployed**. [Actual .75 deployment job](https://github.com/marcusrbrown/infra/actions/runs/40642776788/job/122664658183) completed **2026-10-28 13:01:23 UTC**, reporting healthy running `.75`, digest `sha256:30336f76b6c1950d5a66cb223c2815db626b5bb211965407d5c74d200c381dd9` and same-origin health HTTP 200. [Committed compose pin](https://github.com/marcusrbrown/infra/blob/main/apps/dashboard/docker-compose.yaml) still says **.74**; existing [pin PR #1705](https://github.com/marcusrbrown/infra/pull/1705) records **.75**. Next: reconcile deployment/pin/tracker evidence through their owners; reuse #1705. - **Release mismatch:** #3512/Project gate say latest agent **v0.128.0**; authoritative [GitHub release](https://github.com/fro-bot/agent/releases/tag/v0.129.0) published **2026-10-28 23:49:24 UTC** is **v0.129.0**. Release is not deployment. [Gateway source pin](https://github.com/marcusrbrown/infra/blob/main/apps/gateway/upstream.json) remains **v0.125.3**; latest actual router Gateway job remains [40085163753](https://github.com/marcusrbrown/infra/actions/runs/40085163753/job/120847159705). All **32 successful routers since October 24** were checked; no newer router service deployment. [Latest router](https://github.com/marcusrbrown/infra/actions/runs/40798116205) skipped both services. Next: dedicated tracker workflow should refresh its release/deployment claims. - [dashboard#729](https://github.com/fro-bot/dashboard/issues/729) remains open / Project `Todo, ready now`; [dashboard contract source](https://github.com/fro-bot/dashboard/blob/main/src/gateway/operator-contract/version.ts) still pins **1.13.0**. The issue retains an obsolete pending-release-PR #1948 blocker even though #3512 correctly records it merged/released. Next: preserve paired 1.14.0 deploy/rollback and outstanding behavioral acceptance; reconcile stale release-gate wording in the dedicated tracker path. Authenticated behavioral checks were not repeated here. ### Cross-Project Intelligence Coverage is **partial** against [`metadata/repos.yaml`](https://github.com/fro-bot/.github/blob/main/metadata/repos.yaml): all 32 public tracked repository trees were read at their current default-branch SHA, including manifests/README and all discovered workflow/guidance files; no public tree was truncated and no fetched public source failed. Full-registry coverage cannot be certified. [fro-bot/fro-bot.github.io](https://github.com/fro-bot/fro-bot.github.io) and [fro-bot/systematic](https://github.com/fro-bot/systematic) have no workflow/guidance sources; no adoptable automation finding was inferred from that absence. Adoptable findings only; source configuration is not evidence of a successful runtime execution: - [bfra-me writer concurrency](https://github.com/bfra-me/.github/blob/737d27ff96c848836cd46f38c7c6ac81cf488d53/.github/workflows/renovate.yaml#L66): job-scoped `queue: max`, noncanceling write group, separate dry-run groups. Next: evaluate queue retention when multiple autonomous wiki/data writers contend; retain CAS/page-conflict protection. Existing [wiki analysis](https://github.com/fro-bot/.github/blob/data/knowledge/wiki/topics/github-actions-ci.md) distinguishes serializing writers from preserving pending work. - [Dashboard design scan](https://github.com/fro-bot/dashboard/blob/3155fa33aa551cfb575a5a3987874801dd7c598d/.github/workflows/main.yaml#L64): require targets, JSON-array payload and consistent exit semantics. Next: apply the same false-green review to report scanners so empty/denied sources cannot become clean results. - [Agent image CI](https://github.com/fro-bot/agent/blob/5e0629338ec80cef7f97f48c28311cad9b3dcfa8/.github/workflows/ci.yaml#L515): smoke tests run with production container-hardening flags; negative probes distinguish expected startup failures from infrastructure/module-resolution failure. Next: carry failure-phase assertions into future control-plane integration probes. - [Infra package validation](https://github.com/marcusrbrown/infra/blob/cae6f164c18b1588a492adc6b88b32338183f8b1/.github/workflows/ci.yaml#L140): inspect packed package manifest and emitted CLI imports, rather than trusting source/build success. Next: evaluate packed-artifact checks when extending the published wiki-write package. ### Progressive Improvement - Version truth: authoritative **npm registry `/latest`**, fetched this run; **major drift included**. [`package.json`](https://github.com/fro-bot/.github/blob/main/package.json): [ESLint](https://registry.npmjs.org/eslint/latest) **10.13.0→10.13.0**, [Prettier](https://registry.npmjs.org/prettier/latest) **3.9.1→3.9.10** (patch only), [TypeScript](https://registry.npmjs.org/typescript/latest) **6.0.3→7.0.2**, [Vitest](https://registry.npmjs.org/vitest/latest) **4.1.11→5.0.5**. The latter two exceed minor drift. Next: let Renovate stage compatibility review; no routine bump authored here. - [`.github/workflows/main.yaml`](https://github.com/fro-bot/.github/blob/main/.github/workflows/main.yaml) retains lint, type, tests, workflow/Renovate validation, strip-only loading, package-dist and mutation-guard gates. [Remediation validation](https://github.com//issues/4070#issuecomment-6488577480) passed. The latest successful [survey retry](https://github.com/fro-bot/.github/actions/runs/40681099083) supersedes the prior concurrency refusal; no missing/degraded quality job was established. - [Open learning proposals](https://github.com/fro-bot/.github/issues?q=is%3Aopen+is%3Aissue+label%3Alearning-proposal): **0; ages: None**. No open `docs/drafted-solutions` PR; coverage exception not needed. [Improvement Metrics #3674](https://github.com//issues/3674) was not used as proof of pipeline health. - Production-source TODO/FIXME scan across scripts/packages/workflows found **no actionable stale annotation**. The only script hit is an intentional privacy-test fixture in [`scripts/check-private-leak.test.ts`](https://github.com/fro-bot/.github/blob/main/scripts/check-private-leak.test.ts); workflow prose names the requested scan, not an unfinished task. - Registry convention/freshness drift: [`metadata/repos.yaml`](https://github.com/fro-bot/.github/blob/main/metadata/repos.yaml) records [marcusrbrown/copiloting](https://github.com/marcusrbrown/copiloting) as `lost-access`, but current metadata/tree/source reads succeeded (six workflows and two guidance files). Next: reconcile through the existing registry/data writer; this pass did not edit metadata. ### Needs Human Attention - **Existing parser finding:** [handoff](https://github.com//issues/4070#issuecomment-6488577480), [alerts #46/#47](https://github.com/fro-bot/.github/security/code-scanning/46). Paths: `packages/wiki-write-core/src/markdown-links.ts:7,37`, `scripts/markdown-links.test.ts`, `packages/wiki-write-core/src/regex-redos-regressions.test.ts`. Root cause: repeated ambiguous unanchored regex searches on caller-controlled lines. Smallest safe direction: bounded/linear extraction preserving titles, image exclusion and code restart behavior; regenerate package dist. Verify bootstrap/types/lint/tests, dist consistency, mutation guards and fresh CodeQL. Follow [performance-guard calibration](https://github.com/fro-bot/.github/blob/main/docs/solutions/best-practices/calibrate-performance-guards-before-trusting-bounds-2026-10-09.md); prove the regression fails on the old parser. Do not suppress alerts or truncate input to hide the issue. - **Existing permissions debt:** [handoff](https://github.com//issues/4070#issuecomment-6488577480); `.github/workflows/scorecard.yaml:19` defaults to `read-all`. Review effective scopes and replace only with proven explicit reads, preserving SARIF/OIDC writes. Verify actionlint plus real Scorecard execution. Do not weaken protections or edit credentials to silence [alert #1](https://github.com/fro-bot/.github/security/code-scanning/1). - **Approval-boundary investigation:** reuse [agent#1970](https://github.com/fro-bot/agent/issues/1970). Source-only report, not live reproduction: `apps/workspace-agent/src/main.ts:40-41` and `apps/workspace-agent/src/opencode-server.ts` colocate agent tools with an unauthenticated loopback OpenCode control server. Adding a password inherited by tools does not establish isolation. Determine a minimal enforceable process/network trust boundary, then test that tools cannot submit approval replies while legitimate operator approval still works; preserve Action deny rules. Scope exceeds this report-only pass. - **Rollout/pin reconciliation:** reuse [infra#1705](https://github.com/marcusrbrown/infra/pull/1705), [#3512](https://github.com//issues/3512) and [Project 1](https://github.com/users/fro-bot/projects/1). Paths: `apps/dashboard/docker-compose.yaml`, `apps/gateway/upstream.json`, dashboard `src/gateway/operator-contract/version.ts`. Actual `.75` deployment differs from `.74` checked-in pin and tracker; latest published agent differs from tracker. Verify job 122664658183 logs/runtime digest and pin PR checks before reconciliation; no inference that 1.14.0 or behavioral acceptance shipped. Dedicated tracker workflow owns tracker/Project writes. - **Coverage follow-up:** consult the source-gap table above; security HTTP 403/404 and empty default-head CI are unverified, never clean. Confirm access/feature enablement and rerun those sources. Reconcile registry status only via `scripts/reconcile-repos.ts` / established metadata writer and verify a fresh tree read. Do not write metadata or replay stale wiki handoffs from this daily report path. - **Knowledge handoff:** no new durable wiki assertion was added; adoptable patterns already have grounded wiki coverage or remain proposals. The pre-existing wiki and staged metadata overlays present at invocation were preserved untouched. Categories 5–8 produced no repository-code changes.