Daily Fro Bot Report — 2026-10-30 (UTC) #4073

Daily Fro Bot Report — 2026-10-30 (UTC)

Run Summary

Snapshot: 2026-10-30T05:21:17.597163+00:00. Categories 1–4 are attributed to the preceding remediation pass; this pass performed categories 5–8. ✅ verified-clean; ⚠️ warning; ❌ error; ❔ could-not-check.

Errored PRs

• Remediation handoff found no failures on the two open routine dependency PRs. Current #4069 and #4072 checks remain successful/skipped; separately fetched legacy commit statuses are successful. No repair PR was produced.

Security

• Remediation handoff: Dependabot empty; override-floor gate passed; npm audit found 8 moderate/3 low advisories and zero high/critical. Existing CodeQL #46 / #47 need a nonmechanical parser fix. No security PR was produced. Scorecard aggregate severity is not individual advisory severity.

Control-Plane Integrity

• Remediation handoff: 154 third-party references across 35 workflow/action files satisfy SHA/version-comment checks; Node 24 strip-only imports and live main/data protections passed. Existing Scorecard permission convention remains deferred.

Code Quality

• Remediation validation passed bun run bootstrap, bun run check-types, bun run lint, bun run test: 118 test files; 6,433 passed, 43 skipped, 3 todo. No mechanical-fix PR was produced.

Oversight

Coverage and method. Paginated authenticated-account /user/repos listing (owner/collaborator/organization-member affiliation), /user/orgs, and every returned organization /orgs/{org}/repos were read; inclusion requires returned permissions.pull == true. Public inventory: 41 repositories, including archived repositories. Organization repository listings: bfra-me returned 7; pro-actions returned 1; psware-ps2 returned an empty list, so no positive coverage claim is made for that source. No repository-enumeration request failed. Security-source failures and empty CI evidence are explicit below.
Daily findings. New means created in the preceding 24 hours (open or closed); 13 new issues. Open PRs: 169, 131 aging >7 days, 0 stale >14 days. PR inactivity uses the latest PR update plus paginated issue timeline commit/review/comment/state-change timestamps; all public PR timelines were readable. Stale open issues (>30 days since update): 101; unassigned bugs: 3. New-issue links below include reports; their creation alone is not an incident.
Top three hotspots. Rank counts distinct qualifying issue objects (union of new/stale/unassigned-bug), every open PR once, each unsuperseded failing default-head check/status, and each accessible open security alert. Aging/staleness annotate PRs without double-counting. Counts are current snapshot findings, not historical activity or severity scores.

1. marcusrbrown/extend-vscode — 109 findings; linked finding. Next: prioritize critical/high reachability and existing security-update PRs, then review the oldest work; routine upgrades remain Renovate-owned.
2. marcusrbrown/sparkle — 95 findings; linked finding. Next: prioritize critical/high reachability and existing security-update PRs, then review the oldest work; routine upgrades remain Renovate-owned.
3. marcusrbrown/tokentoilet — 79 findings; linked finding. Next: prioritize critical/high reachability and existing security-update PRs, then review the oldest work; routine upgrades remain Renovate-owned.

A 403 is access denied; a 404 does not distinguish absent configuration from unavailable access. Neither establishes zero alerts. Empty default-head CI is not proof of a healthy pipeline. Code-scanning inventories include Scorecard policy findings, not only exploitable code vulnerabilities. Every linked alert inventory needs reachability/severity triage before a dependency change.

Gateway operator rollout — report-only. All 63 Project 1 items and their corresponding live issue/PR states were read; 0 Project status-versus-live-state mismatches. #3512 remains In Progress / blocked, matching Project 1. Its dated rollup and Project gate prose have drifted:

The latest published agent v0.129.0 agrees with #3512/Project; Gateway source pin remains v0.125.3. Forty deployment/router runs since October 24 were inspected, including nested jobs. Latest actual Gateway deploy remains 40085163753 / 120847159705; newer router 40950645935 has a failed Gateway image-build job and no successful Gateway deployment. Public health was read this run and still returns contract 1.13.0. Authenticated behavioral acceptance was not repeated. Preserve paired 1.14.0 deploy/rollback; .77 source/release completion is not rollout acceptance.

Cross-Project Intelligence

Coverage is partial against the complete tracked registry. All 32 public tracked entries were scanned at current default-branch SHAs, including every discovered workflow plus top-level README/manifest/agent guidance; no public tree was truncated and no selected public source failed. No public tracked entry was inaccessible or unscanned. Full-registry coverage cannot be certified. fro-bot/fro-bot.github.io and fro-bot/systematic expose no workflow/guidance files; absence is not an adoptable pattern.
Adoptable findings only; source configuration does not prove runtime acceptance:

• bfra-me writer queue: job-scoped writer serialization with queue: max, noncanceling write runs, independent dry-run groups. Next: evaluate pending-writer retention for wiki/data writers while retaining page/CAS conflict checks; see existing wiki analysis.
• Dashboard scanner contract: scan-target existence, JSON-array shape, and exit/payload consistency are independently checked. Next: apply these completeness checks to future report scanners so missing sources cannot yield clean results.
• Agent production-shaped image smoke: exercise the image with production security flags and its own Alpine git, with an explicit workspace-agent bundle-identity guard. Next: use artifact-identity and runtime-parity assertions when extending control-plane integration tests.
• Infra packed CLI gate: inspect tarball assets/resolved manifest and perform a clean-room install; negative status probing distinguishes missing assets from expected network failure. Next: evaluate equivalent packed-artifact assertions for future wiki-write package exports.

Progressive Improvement

• Version truth: authoritative npm registry /latest, fetched this run; major drift included. package.json: ESLint 10.13.0 → 10.13.0; Prettier 3.9.1 → 3.9.10 (patch only); TypeScript 6.0.3 → 7.0.2; Vitest 4.1.11 → 5.0.5. TypeScript/Vitest exceed minor drift. Next: Renovate-owned compatibility review; no routine bump authored.
• Main workflow retains lint, type, unit tests, strip-only loading, dist, actionlint/Renovate, wiki-authority and mutation-guard jobs; remediation validation passed. Degraded survey persistence: run 40866567801 hit a data-ref HTTP 422, then refused replay with CONFLICT_EXHAUSTED because another writer changed a write-set path; the exit-3 page-conflict resurvey job was skipped. Next: fresh-head retry through the normal survey workflow, retaining conflict guards; do not replay a stale payload.
• Open learning proposals: 0; ages: None. No open docs/drafted-solutions PR, so no covered-proposal exception applies. No stall established. Improvement Metrics #3674 was not used as pipeline-health evidence.
• TODO/FIXME scan of scripts, packages and workflow files found no actionable stale annotation. Privacy-test fixture is intentional; workflow prompt prose describes the requested scan.
• Registry convention drift: metadata/repos.yaml says marcusrbrown/copiloting is lost-access, while current repository/tree/source reads succeeded (archived, six workflows). Next: reconcile only through the established registry/data writer.

Needs Human Attention

• Parser ReDoS (existing): remediation handoff, alerts #46/#47. Paths: packages/wiki-write-core/src/markdown-links.ts:7,37, scripts/markdown-links.test.ts, packages/wiki-write-core/src/regex-redos-regressions.test.ts. Root cause: repeated ambiguous unanchored searches on caller-controlled lines. Smallest safe direction: bounded/linear extraction preserving titles, image exclusion and code restart; regenerate dist. Verify an old-parser-failing regression, bootstrap/types/lint/tests, dist consistency, mutation guards and fresh CodeQL. Follow performance-guard calibration. Do not suppress alerts or truncate input.
• Permission convention (existing): handoff; .github/workflows/scorecard.yaml:19 declares read-all. Review effective reads before replacing the default with explicit scopes; preserve job SARIF/OIDC writes. Verify actionlint and an actual Scorecard run. Alert #1 also requests a reviewer-policy change; only the operator may decide that policy. Do not weaken protections or edit credentials.
• Survey persistence: .github/workflows/survey-repo.yaml, scripts/wiki-ingest.ts, packages/wiki-write-core/src/wiki-ingest.ts, and the paired registry writer used by failed persist job. Observed cause: a data-ref HTTP 422 followed by assertWriteSetUnchanged refusing replay because another writer changed a write-set path (CONFLICT_EXHAUSTED), distinct from the exit-3 page-conflict path. Smallest safe operational step: rebuild a fresh survey against current data; verify persistence and registry advancement through the trusted writer. If reproducible, identify the conflicting write-set path and review bounded retries before proposing a code change. Do not replay the stale handoff, manually write metadata, or relax conflict detection.
• Gateway build / rollout reconciliation: reuse #3512, Project 1, infra#1705, and dashboard#729. Paths: infra apps/dashboard/docker-compose.yaml, apps/gateway/upstream.json, Dashboard src/gateway/operator-contract/version.ts, and infra .github/workflows/deploy-gateway.yaml / .github/workflows/deploy.yaml. Tracker/Project prose lag .76 deployment, .77 release and chore(deps): update bfra-me/.github action to v1.11.2 #729 completion. Dedicated tracker workflow owns reconciliation. Inspect failed image build once logs become available; the parent run is still waiting and gh run view --log refused incomplete-run logs, so build root cause is unverified. Do not blindly retry or treat a waiting router as deployment. Verify successful Gateway/Dashboard job evidence, paired 1.14.0 rollback, health/ready parity and outstanding behavioral acceptance before closing rollout gates.
• Source coverage: security HTTP 403/404 and empty default-head CI are named per repository above. Confirm feature enablement/access before rescanning; never translate unavailable evidence into clean status. Reconcile archived copiloting registry status through scripts/reconcile-repos.ts / established metadata writer, then verify a fresh source read.
• Approval-boundary investigation (existing): reuse agent#1970. Paths: apps/workspace-agent/src/main.ts and apps/workspace-agent/src/opencode-server.ts. Prior source report describes tool access colocated with the loopback control server; this pass did not reproduce exploitability. Establish the actual process/network boundary before choosing a minimal isolation change; verify tools cannot submit approval replies while operator approval works. Preserve Action deny rules; a password inherited by tools is not isolation.
• Knowledge handoff: adoptable patterns already have wiki coverage; changing rollout facts remain in this report rather than becoming durable assertions. No new wiki assertion was added. Existing wiki updates and staged metadata present at invocation were preserved for the caller’s trusted handoff. No repository code, workflow or metadata edits were made by this pass.