Daily Fro Bot Report — 2026-10-06 (UTC)

[fro-bot]

Daily Fro Bot Report — 2026-10-06 (UTC)

Run Summary

Category	Status	Notes
Errored PRs	❌	Seven open PRs fail Lint; three routine updates also have failing legacy artifact statuses.
Security	❌	Remediation delivered #3954; five older high findings remain on that branch, covered by #3941/#3942. None of the dedicated fixes has merged.
Control-Plane Integrity	⚠️	Remediation verified pins/native imports; mint-time permissions, authority, and setup gaps remain deferred.
Code Quality	❌	Remediation's bootstrap/types/tests pass; full lint remains security-blocked.
Oversight	❔	Enumeration completed; six Dependabot and 25 Code Scanning sources unavailable; four CI sources empty and three stale. Rollout live acceptance unverified.
Cross-Project Intelligence	❔	All 35 tracked entries considered; bounded workflow scans, with empty sources in two Pages-only repositories. Coverage is partial, not a fleet-clean certification.
Progressive Improvement	❌	Ten unauthored proposals aged about 15/22 days, degraded publisher/persistence jobs, and Vitest major drift.

Status legend: ✅ verified-clean; ⚠️ warning; ❌ error; ❔ source unavailable, stale, empty, or incomplete. Categories 1–4 are inherited from the separate remediation evidence and current PR-check readback, not re-audited here.

Errored PRs

• Lint still fails on #3954, #3953, #3951, #3948, #3946, #3942, and #3941. The three routine updates additionally fail legacy renovate/artifacts. Next: authorize security integration, then refresh Renovate artifacts; do not rerun unchanged branches or clear statuses manually.
• #3954 checks: all other applicable checks, including mutation guards and privacy status, now pass. Exact causes and PR-execution exclusions: remediation comment.

Security

• New dedicated fix: source-map-js 1.2.2, #3954, high advisory. Remediation audit high findings fell six → five on that branch; this is not merged-main remediation.
• Existing dedicated fixes: undici 8.10.2, #3941, brace-expansion 5.0.12, #3942. Whole-tree Lint still blocks each isolated branch on sibling findings. Source/version/integrity evidence: remediation record, GitHub Advisory Database and npm registry. Same-major security patches; major drift was not surveyed by remediation.

Control-Plane Integrity

• Remediation evidence: 29 workflows, two composites, all 128 external references SHA-pinned with version comments; 62 native production-script imports passed; strict main protection retained.
• Deferred mint-time scopes, authority decision, and Quartz setup are recorded there with paths/verification. Preserve the cache-isolated privacy job. No guards or settings changed in this oversight pass.

Code Quality

• Separate remediation validation: bootstrap/types/tests passed, 88 files and 4,079 passing tests with three todo; independent ESLint and documentation checks passed. Full lint fails on the five inherited undici/brace-expansion floor violations.
• Oversight's additive wiki edit passed direct no-emit TypeScript, direct Vitest (same 4,079 passing tests), independent ESLint, Markdown-link/solution-example checks, frontmatter/wikilink/catalog validation, and whitespace checks. Used cached dependencies and direct checks; install/build-writing wrappers were not repeated under working-dir's non-mutating-shell contract.

Oversight

Paginated authenticated-account and organization listings (bfra-me, psware-ps2, pro-actions) all succeeded; repository read permission defines “can see.” Findings below are publicly attributable, with no restricted identities or contents reproduced. Snapshot: 2026-10-06 05:55 UTC, before report rotation. Sources were read throughout a bounded scan, not atomically.

40 public repositories; 235 open issues; 121 open PRs; 12 new open issues (<24h); 81 issues inactive >30d; six unassigned bugs; 84 PRs created >7d ago; 54 PRs inactive >14d; 250 available Dependabot alerts; 195 Code Scanning security-severity records; seven failing latest default-head check contexts. Counts are observed records, not independent root causes or confirmed exploitability. PR inactivity uses paginated commits, reviews, review comments, and issue timelines (comments/state changes); creation age is measured separately. Latest check per name/app is deduplicated, and legacy statuses are queried separately. Missing alert/CI sources do not count as clean.

Top three hotspots, ranked by qualifying finding count (one per qualifying issue, open PR, available security alert, or failing current-head check):

Rank	Repository	Findings	Evidence	Next step
1	extend-vscode	96: four issues + 91 Dependabot alerts + one check	Critical alert, blocked audit	Prioritize one critical/37 high alerts against the release dependency graph before releasing.
2	dashboard	78: two issues + two PRs + 11 Dependabot + 63 Code Scanning	Critical image finding, existing PR	Triage current image-digest findings and four high dependency alerts; deduplicate scanner contexts.
3	sparkle	59: one issue + ten PRs + 48 Dependabot alerts	High alert, existing update	Prioritize 17 high alerts and existing update branches before creating more work.

Unavailable sources can change the true ordering. Containers also has one critical dependency alert. The observed gpt queue has dropped to 11 alerts since yesterday's report; this change in ranking does not establish how those alerts were resolved.

Public repository links, source gaps, ages, and next steps

Issue links are unique qualifying new/stale/unassigned-bug records; PR links cover all open PRs. Aging is creation-based, inactivity is activity-based. Security columns are Dependabot / Code Scanning security-severity counts. CI None means no failing latest context found, not proof of freshness. HTTP 404 does not distinguish unavailable access from disabled scanning. Counts exclude unavailable sources. Next steps apply to each linked finding in the row.

Repository	Qualifying issues	Open PRs	Security	Default-head CI	Next step
bfra-me/.github	#2546 (stale 51d) #2545 (stale 51d)	#2825	2 / 6	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
bfra-me/github-action	#1380 (stale 206d)	#1467 (age 111d; inactive 102d) #1466 (age 111d; inactive 111d) #1463 (age 112d; inactive 111d)	2 / 7	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
bfra-me/github-app	#767 (stale 193d)	#950 (age 27d; inactive 27d) #843 (age 111d; inactive 111d) #842 (age 111d; inactive 111d) #840 (age 112d; inactive 111d)	17 / ❔ HTTP 404	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories; establish source availability/liveness
bfra-me/ha-addon-repository	#569 (stale 34d; unassigned bug)	#598 (age 19d) #597 (age 21d) #596 (age 21d; inactive 21d) #594 (age 26d) #592 (age 26d; inactive 21d)	0 / 6	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
bfra-me/renovate-action	#3885 (new)	None	2 / 5	None	triage new issues; prioritize/deduplicate advisories
bfra-me/renovate-config	#1395 (stale 204d) #1381 (stale 208d)	#1558 (age 25d; inactive 25d) #1383 (age 208d; inactive 194d)	0 / 5	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
bfra-me/works	#4997 (new)	#5005	0 / 3	None	triage new issues; review existing PRs; prioritize/deduplicate advisories
fro-bot/.github	#3835 (stale 30d)	#3954 #3953 #3951 #3948 #3946 #3942 #3941	10 / 4	Lint Persist survey results Open learning-proposal issues	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories; inspect failing logs
fro-bot/agent	#1716 (new; unassigned bug) #1712 (new) #1532 (stale 31d) #1520 (stale 33d) #1180 (stale 86d)	#1719 #1717 #1714 #1701 #1696	0 / 11	None	triage new issues; reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
fro-bot/dashboard	#193 (stale 87d) #112 (stale 102d)	#549 #538 (age 7d)	11 / 63	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
fro-bot/fro-bot.github.io	#1 (stale 211d)	None	0 / ❔ HTTP 404	❔ stale >30d	reproduce/assign or triage issues; establish source availability/liveness
fro-bot/space-bus	#201 (new) #81 (stale 86d) #63 (stale 87d)	#193 (age 7d) #177 (age 22d) #135 (age 64d) #130 (age 67d) #72 (age 86d)	0 / 4	None	triage new issues; reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
fro-bot/systematic	#3 (stale 101d) #1 (stale 211d)	None	0 / ❔ HTTP 404	None	reproduce/assign or triage issues; establish source availability/liveness
fro-bot/tokentoilet	None	None	❔ HTTP 403 / ❔ HTTP 403	❔ empty	establish source availability/liveness
marcusrbrown/.dotfiles	#2795 (new) #1924 (stale 102d)	#2799	0 / ❔ HTTP 404	None	triage new issues; reproduce/assign or triage issues; review existing PRs; establish source availability/liveness
marcusrbrown/.github	#37 (stale 1157d)	None	0 / ❔ HTTP 404	None	reproduce/assign or triage issues; establish source availability/liveness
marcusrbrown/containers	None	#809 (age 8d) #758 (age 42d) #744 (age 52d; inactive 52d) #740 (age 59d; inactive 59d) #727 (age 66d; inactive 61d) #723 (age 67d; inactive 61d)	8 / 39	None	review existing PRs; prioritize/deduplicate advisories
marcusrbrown/copiloting	None	None	❔ HTTP 403 / ❔ HTTP 403	❔ stale >30d	establish source availability/liveness
marcusrbrown/cortexkit_anthropic-auth	None	None	❔ HTTP 403 / ❔ HTTP 403	❔ stale >30d	establish source availability/liveness
marcusrbrown/dev-like	#148 (new) #100 (stale 35d)	None	0 / ❔ HTTP 404	None	triage new issues; reproduce/assign or triage issues; establish source availability/liveness
marcusrbrown/encode-2024-q3-grp14-jobseeker-ai	#1 (stale 714d)	#27 (age 716d; inactive 715d) #22 (age 721d; inactive 715d)	❔ HTTP 403 / ❔ HTTP 403	❔ empty	reproduce/assign or triage issues; review existing PRs; establish source availability/liveness
marcusrbrown/esphome.life	#298 (stale 299d) #8 (stale 1205d)	None	0 / ❔ HTTP 404	None	reproduce/assign or triage issues; establish source availability/liveness
marcusrbrown/extend-vscode	#319 (stale 414d) #318 (stale 338d) #317 (stale 414d) #142 (stale 845d)	None	91 / ❔ HTTP 404	Pre-Release Validation (vulnerabilities)	reproduce/assign or triage issues; prioritize/deduplicate advisories; inspect failing logs; establish source availability/liveness
marcusrbrown/gala-chain-code	#6 (stale 945d)	#72 (age 945d; inactive 945d) #68 (age 950d; inactive 946d) #65 (age 950d; inactive 950d)	❔ HTTP 403 / ❔ HTTP 403	❔ empty	reproduce/assign or triage issues; review existing PRs; establish source availability/liveness
marcusrbrown/gpt	#2604 (stale 50d) #2524 (stale 121d) #2519 (stale 122d) #2505 (stale 52d) #2175 (stale 191d) #2174 (stale 191d) #2173 (stale 191d) #2172 (stale 191d) #2171 (stale 191d) #2170 (stale 191d) #2169 (stale 191d) #2168 (stale 191d) #2162 (stale 191d) #2146 (stale 194d) #2144 (stale 194d) #2143 (stale 194d) #2142 (stale 194d) #2141 (stale 194d) #2140 (stale 194d)	#2790 (age 8d) #2693 (age 68d; inactive 68d) #2692 (age 69d; inactive 69d) #2688 (age 70d; inactive 70d) #2674 (age 80d; inactive 80d) #2673 (age 85d; inactive 84d) #2672 (age 86d; inactive 86d) #2665 (age 89d; inactive 89d) #2664 (age 90d; inactive 90d) #2662 (age 91d; inactive 79d) #2599 (age 107d; inactive 106d) #2587 (age 109d) #2586 (age 109d) #2440 (age 145d; inactive 79d) #2320 (age 169d; inactive 79d) #2165 (age 191d; inactive 149d)	11 / ❔ HTTP 404	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories; establish source availability/liveness
marcusrbrown/ha-config	None	#896 (age 31d) #777 (age 145d)	0 / ❔ HTTP 404	None	review existing PRs; establish source availability/liveness
marcusrbrown/infra	#1162 (stale 42d)	#1478	0 / 2	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
marcusrbrown/marcusrbrown	#1087 (stale 79d) #925 (stale 135d)	#1255 #1107 (age 72d; inactive 29d) #1100 (age 76d; inactive 29d) #1095 (age 77d; inactive 69d) #1055 (age 90d; inactive 58d)	6 / ❔ HTTP 404	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories; establish source availability/liveness
marcusrbrown/marcusrbrown.com	#517 (stale 58d; unassigned bug) #465 (stale 90d; unassigned bug) #411 (stale 144d)	None	1 / ❔ HTTP 404	None	reproduce/assign or triage issues; prioritize/deduplicate advisories; establish source availability/liveness
marcusrbrown/marcusrbrown.github.io	#457 (new) #455 (new) #334 (stale 33d)	#456 #454 #448 #440 (age 9d) #439 (age 9d) #435 (age 12d) #430 (age 14d) #429 (age 14d) #426 (age 15d)	2 / ❔ HTTP 404	Performance Audit (mobile) Performance Audit (desktop) Performance Summary	triage new issues; reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories; inspect failing logs; establish source availability/liveness
marcusrbrown/mothership	#137 (new) #19 (stale 78d)	#132 #122 (age 13d) #111 (age 21d) #108 (age 23d)	0 / 28	None	triage new issues; reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
marcusrbrown/opencode-copilot-delegate	#38 (stale 162d)	#335 (age 65d; inactive 55d) #332 (age 66d; inactive 51d) #278 (age 91d) #241 (age 105d; inactive 55d) #135 (age 143d; inactive 55d)	0 / ❔ HTTP 404	None	reproduce/assign or triage issues; review existing PRs; establish source availability/liveness
marcusrbrown/panthea	#142 (new)	#141	0 / ❔ HTTP 404	None	triage new issues; review existing PRs; establish source availability/liveness
marcusrbrown/Presentations	None	#54 (age 63d)	34 / ❔ HTTP 404	None	review existing PRs; prioritize/deduplicate advisories; establish source availability/liveness
marcusrbrown/renovate-config	#1417 (stale 101d) #1111 (stale 145d) #1096 (stale 210d) #1079 (stale 217d) #1068 (stale 224d)	None	1 / 6	None	reproduce/assign or triage issues; prioritize/deduplicate advisories
marcusrbrown/sparkle	#876 (stale 363d)	#2122 #2107 #2101 #2090 (age 11d) #2082 (age 14d; inactive 14d) #2077 (age 15d; inactive 15d) #2074 (age 16d; inactive 16d) #2069 (age 19d; inactive 17d) #2048 (age 26d; inactive 26d) #2036 (age 28d)	48 / ❔ HTTP 404	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories; establish source availability/liveness
marcusrbrown/systematic	#1005 (unassigned bug) #854 (stale 42d) #740 (stale 64d; unassigned bug)	#1056 #1052	0 / 6	None	reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories
marcusrbrown/tokentoilet	#1591 (new) #1171 (stale 107d)	#1590 #1589 #1587 #1583 #1579 #1573 #1567 #1559 #1552	4 / ❔ HTTP 404	None	triage new issues; reproduce/assign or triage issues; review existing PRs; prioritize/deduplicate advisories; establish source availability/liveness
marcusrbrown/vbs	#694 (stale 76d) #675 (stale 86d) #670 (stale 88d) #657 (stale 96d) #656 (stale 91d) #161 (stale 414d) #160 (stale 414d) #159 (stale 414d) #158 (stale 414d) #157 (stale 414d) #155 (stale 419d) #154 (stale 419d) #153 (stale 419d) #152 (stale 419d) #150 (stale 359d)	#740 (age 42d) #717 (age 59d; inactive 59d) #701 (age 72d; inactive 61d) #697 (age 75d; inactive 61d) #693 (age 76d; inactive 76d) #688 (age 77d; inactive 77d) #674 (age 86d; inactive 86d) #672 (age 88d; inactive 88d) #671 (age 88d; inactive 88d)	0 / ❔ HTTP 404	None	reproduce/assign or triage issues; review existing PRs; establish source availability/liveness
pro-actions/peter-murray_workflow-application-token-action	None	None	❔ HTTP 403 / ❔ HTTP 404	❔ empty	establish source availability/liveness

Gateway rollout awareness: Project 1 has 20 items Done; #3512 is In Progress / readiness waiting, consistent with unfinished live verification. Narrative mismatches:

Claim	Current evidence	Next step
Tracker body: dashboard #179 Open	#179 is CLOSED, July 11	Dedicated tracker reconciles stale text; no board write from this pass.
Tracker body: revocation runbook missing	infra #711 is CLOSED, July 12	Link delivered runbook and retain runtime verification tail.
Tracker body: daemon v0.83.0, latest release v0.85.0	infra source pin v0.113.2; latest upstream release v0.117.5	Reconcile source/release claims; a workflow Action bump does not upgrade the daemon.
Latest tracker comment: run 35930438231 waiting	That run is completed/cancelled; newer dashboard runs are pending and waiting	Dedicated tracker refreshes which deployment is waiting; do not approve environments here.
Body's 1.6.0 match is historical; comment proposes 1.7.0 mirror	Agent source is 1.8.0; dashboard source remains 1.6.0	Coordinate daemon configuration and contract adoption in one verified deploy window.

These are source/narrative values, not a fresh live-deployment contract measurement. ❔ Browser-session acceptance and current runtime contract were not verified. Latest gateway deploy succeeded September 21; its conclusion alone does not prove current browser-session acceptance. No tracker comments or Project edits were made.

Cross-Project Intelligence

All 35 entries in tracked metadata were considered without filtering on onboarding status; stable node-ID lookup recovered renamed entries. Accessible entries received a recursive tree and bounded workflow/prompt scan (up to eight relevant workflows). This is partial source coverage, not a full-file or execution audit. Public inaccessible entries after recovery: None. Empty workflow sources: domain holder and generated site; do not infer a missing operational daemon from a Pages-only layout.

Adoptable findings, source-verified in this scan:

• Infra's deterministic report reconciler: freezes date/run identity, checks author+label+marker, and gives post-run reconciliation ownership of supersession and final readback. Adapt this to make daily-report identity/rotation mechanical here; do not copy the source prompt's write authority into this job. Source contract verified; no successful reconciler execution is claimed by this scan.
• Agent's OSV PR/full-tree split: introduced-vulnerability PR checks plus standing-findings reporting. Adopt only as an additional posture channel; keep this repository's required advisory-floor gate intact.
• Renovate Action's trusted Release observer: filters trusted default-branch events and checks the specific Release job before reporting failed publication. Apply the terminal-delivery observation principle to learning capture; strengthen discovery rather than copying its bounded label-filtered search unchanged.

Progressive Improvement

• Compounding stalled: ten open proposals. About 15d old: #3905, #3906, #3907, #3908, #3909. About 22d old: #3887, #3888, #3889, #3890, #3891. Expected action for each: author and validate its learning in docs/solutions/; another report does not codify it.
• Degraded delivery: latest weekly capture remains failed at publication, repeating the missing-bodies handoff. Latest manual survey also failed at Persist survey results; root cause was not established by this bounded scan. Metrics #3674 says ambiguous, pending backlog zero; that metric's population excludes unauthored proposals and cannot certify this queue healthy.
• Tool drift: authoritative npm registry latest comparisons include major drift: ESLint 10.11.0 → 10.12.0 (one minor, below the “more than a minor” trigger), Prettier 3.9.1 → 3.9.9 (patch), TypeScript 6.0.3 → 7.0.2 (major), Vitest 4.1.11 → 5.0.3 (major). TypeScript has an explicit compatibility hold; leave routine upgrades to Renovate and verify major compatibility after security integration.
• Conventions/TODOs: remediation's authority/setup/scope notes remain the actionable drift evidence. No production TODO/FIXME found in scripts; the sole match is a test fixture. Historical wiki prose is not source-code debt.
• Durable evidence added to security-remediation integration knowledge: an old combined green security test is not current proof after the advisory population changes on unchanged main. Topic/index/log remain dirty for caller-owned ingestion; persistence is not yet claimed.

Needs Human Attention

1. Security integration: #3941, #3942, #3954; paths pnpm-workspace.yaml, pnpm-lock.yaml, scripts/check-override-floors.ts. Authorize an integration preserving each dedicated package diff. Revalidate the integrated tree and current audit; the September 30 two-fix green result is historical, because a sixth high finding appeared. Do not suppress advisories, force-push, bypass protections, or rerun unchanged inputs.
2. Learning handoff/codification: workflow, publisher, failed run. Diagnose producer output and require parseable bodies before artifact upload; distinguish intentional zero candidates from absent output. Preserve separate token scopes. Separately author all ten linked proposals in docs/solutions/ and verify documentation gates; transport repair alone does not clear the queue.
3. Survey persistence: failed job, .github/workflows/survey-repo.yaml, scripts/wiki-ingest.ts, and scripts/commit-metadata.ts. Inspect full job evidence and trusted handoff before selecting the smallest fix; cause remains unproven. Preserve data-authoritative/privacy gates. Do not equate a successful source survey with committed knowledge or retry missing inputs blindly; verify a resulting data commit.
4. Rollout reconciliation: #3512, Project 1, apps/gateway/upstream.json, apps/gateway/src/deploy.ts, and dashboard src/gateway/operator-contract/version.ts/stream consumers. Dedicated tracker refreshes stale closed-item/pin/deploy claims. Before changing the daemon pin, verify startup/trusted-proxy configuration and coordinated contract adoption, then live OAuth/CSRF/stream/approval/privacy flows. Do not relax exact-match gates or approve deployments from this report path.
5. Coverage gaps and deterministic rotation: the linked inventory names six denied Dependabot sources, 25 denied/unavailable Code Scanning sources, four empty and three stale CI sources. Establish intended scanner/access/liveness before certifying clean. For .github/workflows/fro-bot.yaml and a focused report-reconciliation script, consider the verified Infra author+marker+frozen-run identity pattern in a separately directed change. Preserve this invocation's exactly-one-comment and caller-owned wiki-write contracts; verify duplicate, denied-listing, uncertain-create, and final-single-report cases.

Run Summary

Field	Value
Event / repository	schedule / fro-bot/.github
Run ID	37419929311
Cache	hit
Scope	Categories 5–8; categories 1–4 inherited from the separate remediation pass
Delivery	working-dir; caller owns wiki ingestion/commit/push
GitHub output	One current daily-report issue; one marked supersession comment on the prior report, which is closed
Wiki	Additive security-topic/index/log edits left dirty; existing wiki changes and staged metadata preserved
Verification	Direct types/tests/ESLint, Markdown links/examples, topic schema/catalog, and whitespace checks passed
Limitations	Alert/CI source gaps above; bounded source scans; live rollout acceptance unverified; workflow guard unavailable

[fro-bot]

Superseded by #3957. Run Summary — oversight: partial security-source coverage; all 35 tracked records attempted; 10 learning proposals aged 16/23d; live Gateway contract 1.6.0 versus published 1.8.0; three additive wiki files left dirty for caller ingestion; 4,079 tests passed; lint remains blocked by existing security floors; working-dir delivery, no commit/push/PR/tracker mutation. Run 37575318509.