Daily Fro Bot Report — 2026-09-30 (UTC)

[fro-bot]

Daily Fro Bot Report — 2026-09-30 (UTC)

Run Summary

Category	Status	Notes
Errored PRs	❌	#3941 and #3942 fail required Lint; legacy privacy statuses and mutation checks pass.
Security	⚠️	Two dedicated security fixes delivered but unmerged; combined local audit has zero high/critical findings.
Control-Plane Integrity	⚠️	Remediation findings: pins and strip-only syntax verified; existing Scorecard permissions and wiki-authority policy mismatch deferred.
Code Quality	❌	Combined-tree checks passed, but standalone PRs and main remain audit-blocked.
Oversight	❔	40 verified-public repositories in the public-safe snapshot; six Dependabot sources unavailable and four HEADs lack check/status evidence. Findings below.
Cross-Project Intelligence	❔	Selected workflow definitions inspected across 32 verified-public tracked trees; not an exhaustive automation/prompt audit. Adoption candidates below.
Progressive Improvement	⚠️	Ten learning proposals, major tool drift, and the Renovate validation gap.

Errored PRs

Remediation pass evidence: no PRs existed at its initial scan. Its new undici PR and brace-expansion PR now each fail Lint on the other package's standing advisories. Both legacy Security: Private Leak Scan statuses succeed; mutation guards now succeed on both. Coordinate integration rather than rerunning unchanged branches.

Security

Remediation evidence and advisory links. Each dedicated PR modifies only its package's floor and lockfile resolution. Neither is merged. The pass verified GitHub advisories against npm audit and the npm registry; no major-version drift survey was included in those patch remediations. Its combined local audit retained three moderate findings; Renovate owns routine updates.

Control-Plane Integrity

Remediation audit: 128 third-party references pinned, 143 strip-only files accepted, protections unchanged. Follow its exact-path notes for Scorecard permissions and wiki authority; no control-plane fix was made in this oversight pass.

Code Quality

Remediation verification distinguishes combined local success from the two red remote PRs. Both remote mutation jobs are now green. Oversight's wiki-change verification also passed bootstrap/types/tests (4,079 tests, three todo), new-page formatting and wiki validation; full lint still stops at the same existing five high advisory checks. Existing working-tree wiki and staged metadata changes were preserved.

Oversight

Enumeration used paginated authenticated user/repos plus every organization returned by user/orgs: bfra-me, psware-ps2, pro-actions. “Can see” means returned repositories with at least read access. Enumeration itself succeeded; this public report links only verified-public identities. Snapshot counts are observations, not repository-health all-clears.

• New issues: four recent non-report issues: mrbro.dev #445 (scope deployment permissions), tokentoilet #1553 (high Storybook advisory), #1554 and #1555 (convention drift). Triage the security item first; validate each proposed change against current source.
• Open/aging PRs: 98 open, 77 older than seven days; 50 have a conservative activity upper bound older than 14 days. Ages use creation time; activity considers commits, reviews, comments and state events, with updated_at as an upper bound so label/thread/push activity cannot create a false stale claim. Review aging but active space-bus #135 (58d old, activity Sept 28) and ha-config #777 (139d old, activity Sept 29). Reconfirm stale sparkle #2048 (20d idle), vbs #717 (53d idle), and gpt #2165 (143d idle) before deciding whether to refresh or retire them.
• Stale issues: 75 open issues exceed 30 days without update. Reconfirm ownership or archive after human review; representative queues: gpt #2604, vbs #694, bfra-me/.github #2546, systematic #854.
• Failing default-branch checks: latest check per name/app on the observed HEAD fails in seven repositories: .github Lint, agent Test, github-action settings, dev-like links, extend-vscode vulnerability validation, infra storage agent, mrbro.dev performance. Diagnose latest logs before repairing; historical failed reruns superseded by newer checks were excluded. Legacy statuses were checked separately; no failing legacy statuses were observed.
• Security: 64 high/critical Dependabot alerts across nine public repositories. Prioritize extend-vscode (35), Presentations (8), sparkle (6), gpt (5); then github-app, .github, containers, mrbro.dev, dashboard. Check existing security PRs before proposing fixes. This fleet security count is Dependabot-only, not a full Code Scanning/secret-scanning audit.
• Unassigned bugs: five: ha-addon-repository #569, marcusrbrown.com #517, #465, systematic #1005, #740. Assign an owner or explicitly decline after triage.

Top three public hotspots, counting each qualifying issue URL once, every open PR once, each high/critical Dependabot alert, and each latest failed check/status context; aging/staleness are PR attributes, not extra points:

Rank	Repository	Qualifying findings	First action
1 (tie)	extend-vscode	40: 35 alerts, four stale issues, one failed check	Start with alert #179.
1 (tie)	gpt	40: five alerts, 19 stale issues, 16 PRs	Triage alert #171, then review the stalled queue.
3	vbs	25: 15 stale issues, ten PRs	Reconfirm #694 and #717.

Cross-Project Intelligence

Every metadata/repos.yaml entry was considered; 32 verified-public trees received a selected CI/agent-workflow content survey. This is partial content coverage: supporting actions/scripts and unselected workflow files were not exhaustively audited. The fro.bot domain holder and published Systematic site have no workflow definitions on their default branches; no workflow pattern is inferred there.

Adoptable, source-verified candidates:

• infra's failure reporter: a separate workflow_run observer, bounded exact readback and owner-only synthetic validation can expose a failed scheduled control-plane writer even when that writer never reaches its reporting step. Adapt to named trusted writer workflows with privacy-safe bodies and deduplication; do not copy privileged checkout behavior.
• Systematic's host-contract guard: prove expected suites actually ran, enforce a pass floor, and make skip exemptions bidirectional. Adapt the execution-evidence invariant to critical integration checks; do not import its repository-specific counts/exemptions.
• agent's differential/full-tree OSV split: add an independent full-tree advisory reporting channel alongside PR-introduction evidence. Preserve this repository's existing required override-floor gate. These are workflow contracts, not claimed successful live deployments.

Progressive Improvement

• Compounding stalled: ten open learning proposals: five created Sept 14 (16 days), five Sept 21 (nine days). Both the >14-day and two-open thresholds trip. Author accepted learnings into docs/solutions/, or record a deliberate disposition; Improvement Metrics #3674 cannot count unauthored proposals.
• Tool drift: npm registry (pnpm view) reports ESLint 10.11.0 (installed 10.11.0), Prettier 3.9.9 (installed 3.9.1), TypeScript 7.0.2 (installed 6.0.3), Vitest 5.0.2 (installed 4.1.11). Major drift included; no greater-than-minor same-major drift observed. Routine bumps belong to Renovate. The TypeScript hold is intentional and has an upstream compatibility/lift condition; do not remove it merely to chase latest.
• CI gap: #3793 still tracks the missing Renovate config validation gate on an org-wide preset. Validate candidate presets semantically before promoting them. Current required mutation checks on the remediation PRs are green, not missing.
• Annotations/conventions: no production-script TODO/FIXME drift found; the only match is an intentional test fixture. The authority contract mismatch remains an evidence-backed governance follow-up. Separately, cortexkit's Fro Bot workflow is still disabled_inactivity; a green current HEAD check is not proof its scheduled agent is active.

Needs Human Attention

• Security integration: review #3941 and #3942 together. Required whole-tree Lint prevents either standalone branch landing first. Arrange an authorized integration and rerun the four required commands; do not lower thresholds or bypass protection. Exact paths, remaining risks and verified combined evidence.
• Rollout drift: #3512 is open and Project 1 says In Progress, so those values agree. Its matrix says dashboard #179 Open, but GitHub says CLOSED / COMPLETED. The body repeatedly claims infra pin v0.83.0 and latest agent v0.85.0; current upstream.json is v0.113.2, and the authoritative latest release is v0.117.0. The latest Gateway deploy and dashboard deploy succeeded; pinned-agent and dashboard contract source both declare 1.6.0. Source/deploy evidence does not establish current live browser flows or VAPID enablement; live health/browser evidence was not checked. Let the dedicated tracker reconcile these exact claims and perform live verification. No tracker comments or Project edits were made.
• Coverage: Dependabot reads were unavailable for fro-bot/tokentoilet, copiloting, cortexkit, jobseeker-ai, gala-chain-code, and pro-actions token action. Repeat authorized reads before any all-clear. Four of those repositories also have empty HEAD check/status evidence: fro-bot/tokentoilet, jobseeker-ai, gala-chain-code and the pro-actions action. Empty evidence is unknown, not green.
• Guard/permissions/wiki: use the remediation notes for smallest safe fixes and verification on scripts/check-wiki-authority.ts, its paired test, .github/workflows/scorecard.yaml, and existing wiki-lint #3903. Data-authoritative repairs must use the established writer. No metadata was edited here.
• Knowledge handoff: added knowledge/wiki/topics/security-remediation-integration.md, its catalog entry and an append-only log entry. New-page wiki validation found no findings; formatting passed. These changes remain dirty for caller ingestion. Pre-existing wiki edits and staged metadata were preserved; there was no branch switch, commit or push in this pass.

[fro-bot]

Superseded by Daily Fro Bot Report — 2026-10-01.

Run Summary

Run 36818273959; oversight categories 5–8 completed with partial security-source coverage; categories 1–4 linked from remediation evidence; 103 PR timelines checked, 50 stale; wiki activity-measurement learning left dirty for caller ingestion; types and 4,079 tests passed, full Lint blocked by known advisories; no PR, Project, or metadata mutations; this is the sole comment from the oversight invocation.