Daily Fro Bot Report — 2026-10-11 (UTC) #3982

Daily Fro Bot Report — 2026-10-11 (UTC)

Refreshed oversight snapshot begins 05:10 UTC; subsequent deployment, health and check-context readbacks follow. Categories 1–4 are the separate remediation readback, not work performed by this pass. No remediation PR was produced; the current control-repo PR queue is empty. This existing same-day report is reused.

Run Summary

✅ = verified-clean; ⚠️/❌ = warning/error; ❔ = could-not-check. Missing, stale or denied evidence is never an all-clear.

Errored PRs

None. Remediation found zero open PRs on initial/final paginated enumeration. Its main-head check runs have no failure and legacy statuses are empty, not failed. No repair branch or PR needed inspection. Current open PR readback remains empty; Main 38112400504 succeeds.

Security

Remediation: three open Dependabot alerts, two medium and one low. npm audit: three moderate and one low advisory, zero high/critical. Override-floor validation passes. All 17 Actions/reusable-workflow packages were queried against GitHub Advisory Database; no advisory affects their pinned versions. Scorecard #9's high rule label does not elevate lower-severity package advisories. Routine dependency work stays with Renovate through #2828.

Sources used by that pass: npm registry advisories, GitHub Dependabot/Advisory Database and upstream GitHub tags. Affected major ranges were included; latest-version drift was not checked there.

Control-Plane Integrity

Remediation: 31 workflow YAMLs/two composite actions parse; 146 external references have full SHA/version comments; all 17 upstream tags match. All 74 production scripts load under Node 24 strip-only. App scopes, data-origin wiki authority, privacy gates and live protections pass. Surplus CodeQL packages: read / actions: read remain. The effective Systematic workflow guard is unavailable; see #3979. Its unavailability was not repeatedly retried.

Merged #3983 fixes the job-specific persistence/ingest wording: the earlier report's prompt-drift finding is superseded, not carried forward as current. No workflow change occurred in this pass.

Code Quality

Remediation passed pnpm bootstrap, pnpm check-types, pnpm lint, pnpm test: 102 files, 5,358 passed / three todo. This pass independently passed pnpm lint, direct no-emit TypeScript and direct Vitest with the same counts; whitespace check passes. Install/build-writing wrappers were not repeated under the working-dir non-mutating-shell contract.

Read-only wiki validation scans 47 pages; no deterministic finding on the edited dashboard page/index. Two existing links elsewhere remain tracked under #3903. Default ESLint excludes wiki content; wiki schema/link validation, rather than a clean generic Markdown lint claim, is the scoped evidence.

Oversight

Paginated authenticated-account repository enumeration and all returned organization listings (bfra-me, psware-ps2, pro-actions) succeeded. “Can see” means returned repositories with at least read/pull access. Every returned record was inspected; public reporting includes only confirmed-public identities. No enumeration or PR-activity request failed.

Public snapshot: 227 open issues, 124 open PRs, 18 issues created within 24h, 90 issues inactive >30d, 85 PRs aged >7d, 54 PRs inactive >14d, five unassigned bugs. Counts include this report. PR creation age is separate from inactivity; activity comes from paginated commits, reviews, comments and state-change timelines, excluding incidental backlinks. Issue inactivity uses updated_at.

Top three hotspots, ranked by distinct qualifying finding URLs in this snapshot (new/stale issues, aged/stale PRs, unassigned bugs, accessible alerts and latest failing default-head contexts; overlapping criteria count once):

1. extend-vscode — 99: advisory, vulnerability gate. Next: prioritize advisory triage before retrying publication.
2. sparkle — 63: advisory. Next: review dedicated security fixes before routine bumps.
3. containers — 61: package advisory, image finding, aged PR. Next: separate package/image triage and review existing PRs.

Alerts are counted findings, not unique exploitable root causes.

New issues — triage each linked item: bfra-me/renovate-action/issues/3914, bfra-me/works/issues/5069, fro-bot/.github/issues/3979, fro-bot/agent/issues/1780, fro-bot/agent/issues/1778, fro-bot/dashboard/issues/598, fro-bot/dashboard/issues/596, fro-bot/space-bus/issues/207, marcusrbrown/.dotfiles/issues/2835, marcusrbrown/infra/issues/1507, marcusrbrown/infra/issues/1506, marcusrbrown/marcusrbrown.github.io/issues/463, marcusrbrown/mothership/issues/143, marcusrbrown/panthea/issues/202, marcusrbrown/systematic/issues/1076, marcusrbrown/systematic/issues/1073, marcusrbrown/tokentoilet/issues/1605. The report itself is the eighteenth new issue.

Unassigned bugs — reproduce and assign each: bfra-me/ha-addon-repository/issues/569, marcusrbrown/marcusrbrown.com/issues/517, marcusrbrown/marcusrbrown.com/issues/465, marcusrbrown/systematic/issues/1005, marcusrbrown/systematic/issues/740.

Failing default-head contexts — inspect logs/current inputs before retry: settings synchronization, extension vulnerability gate, portfolio desktop/mobile audit and summary. The portfolio failures are October 5 evidence on its current head, not fresh execution. Check runs were reduced to the latest per app/name; legacy statuses were checked separately. Superseded failed runs on the same SHA are not current failures.

Four default heads have no check-run or legacy-status evidence: archived tokentoilet, jobseeker-ai, gala-chain-code, token action. Next: establish intended archive/CI coverage; absence is not health.

Accessible public endpoints return 252 Dependabot / 187 Code Scanning / zero secret alerts. Respectively 6/40, 25/40, 33/40 endpoints return 403/404, named in the table. Empty accessible lists do not prove scanner coverage.

Gateway rollout awareness — category 8

#3512 is Open, while Project 1 is In Progress / waiting; these are consistent with incomplete production acceptance. All 29 Project items were returned. Six source-completion claims in the body disagree with Project status:

Later deployment evidence supersedes today's earlier report:

• Body/live-contract claim 1.8.0 versus fresh public health 1.9.0.
• Body gateway v0.118.2 versus current infra gateway pin v0.119.2; actual gateway deploy job succeeds at 05:02:17 UTC. Reusable-workflow listing alone would miss this router execution.
• Body dashboard 2026.10.15 versus current infra dashboard pin 2026.10.20, with the release digest; actual deploy job succeeds at 05:04:21 UTC. This run was pending earlier; it is no longer pending. 2026.10.18 attempt now fails; 2026.10.19 remains cancelled.
• GitHub Releases authority: latest agent v0.119.2 and dashboard 2026.10.20. Tagged contract files both declare 1.9.0. This comparison includes contract/release drift, not a general major-version survey.

Next: the dedicated tracker should reconcile the body, then verify authenticated SSE ready, checkout projection, question answer/skip/Discord settlement/terminal cleanup, expired-output recovery, cancellation and logout/privacy criteria. Public health does not identify the running image digest or prove those flows. No tracker comment or Project edit occurred here.

Cross-Project Intelligence

Every metadata/repos.yaml entry was processed, using stable database identity where available. Public source scans cover 32 entries / 220 workflow files, all fetched; no truncated public tree or failed public file read. Pattern coverage is partial: fro-bot.github.io and systematic gh-pages have empty default workflow trees. This is a source inspection, not execution verification.

Adoptable findings only:

1. Local delivery, response suppression and late publisher credentials: maintain explicit working-dir/none contracts and mint publisher credentials only after model execution. Preserve its single-job OIDC authority invariant.
2. Failure-surviving executed-suite diagnostic guard: combine !cancelled() with actual suite outcome so diagnostics run after failure, without masking the failed suite. Useful for producer/artifact validation.
3. Release-job-specific alerting: distinguish publisher failure from unrelated CI failure. For adaptation, paginate jobs and search complete marker coverage rather than copying capped/label-filtered dedup unchanged.

No changes in this category.

Progressive Improvement

Authoritative current-version source: npm registry latest stable dist-tags, independently queried with pnpm view --registry=https://registry.npmjs.org; major drift included. Manifest:

All 31 committed workflows are active. Latest Main passes lint, types, tests, strip-only loading, workflow and committed-dist checks; authority/mutation jobs correctly skip on push. Existing Renovate preset validation gap #3793 remains. Production scripts/workflows have no stale TODO/FIXME annotations; the one script TODO is a negative-test fixture. Prompt-persistence drift was fixed by #3983; remaining guard/preflight gaps are under #3979.

Learning proposals: zero open / zero >14d; no ages to report. Zero open docs/drafted-solutions PRs. No uncovered-proposal stall in this snapshot. #3970 documents the cleared backlog. Only Draft Solutions run 37981130113 is available: empty-queue harvest succeeds, drafting/publication skip. Nonempty authorship and publication remain unverified. Metrics #3674 was generated October 5 and reads ambiguous; it does not establish today's proposal authorship state.

Needs Human Attention

1. Rollout reconciliation / acceptance: dedicated tracker owns Track cross-repo Gateway operator control-surface rollout #3512's six Open-versus-Done mismatches and stale 1.8.0/v0.118.2/2026.10.15 claims. Exact source paths: fro-bot/agent/packages/gateway/src/operator-contract/version.ts, fro-bot/dashboard/src/gateway/operator-contract/version.ts, marcusrbrown/infra/apps/gateway/upstream.json, apps/dashboard/docker-compose.yaml, docs/runbooks/gateway-operator-auth-lifecycle.md. Smallest safe next step: reconcile the readback, then run the outstanding authenticated acceptance sweep above. Do not retry superseded dashboard deploy intent or assume health verifies SSE. Retain fail-closed contract matching, sanitizer constraints and paired rollback with the earlier volume-snapshot requirement.
2. Effective guard/security preflight — reuse Fro Bot workflow: ignored inputs, stale prompt text and an unreachable wiki handoff path #3979: opencode.json, effective CI OpenCode initialization and .github/workflows/fro-bot.yaml. Inspect redacted effective guard configuration; verify a future run produces guard evidence. Do not repeatedly retry unavailable guard or widen credentials. Security preflight should distinguish each endpoint's HTTP status from disabled/missing resources; generic 403/404 does not identify a missing scope. Prompt wording fixed by fix(workflows): make Fro Bot's knowledge and ingest instructions match each job #3983 is not current drift.
3. CodeQL least privilege: .github/workflows/codeql-analysis.yaml:27–31 and .github/codeql/codeql-config.yml. Verify pinned Action needs and remove only surplus packages: read / actions: read in reviewed work. Preserve contents: read, security-events: write, scan coverage; validate YAML/action references and execute CodeQL. No failing-run bug qualified this report-only pass to edit the workflow.
4. Preset gate / compounding evidence: reuse CI: no Renovate config validation gate on a preset that ships org-wide #3793 for inherited Renovate preset validation through shared setup. For .github/workflows/draft-solutions.yaml and scripts/drafted-solutions-*.ts, verify the next real nonempty queue through bodies artifact, privacy handoff, focused PR and human merge. Required token wiring and least-privilege scope are separate controls, per docs/solutions/workflow-issues/required-github-token-for-agent-steps-2026-06-22.md. Do not fabricate a learning proposal or relax the publisher boundary.
5. Fleet failures / source coverage: linked failed contexts and endpoint failures above are the handoff; their deeper root causes were not established by this detection-only scan. Inspect exact failed steps and current inputs before retries. Reuse existing security PRs/dashboards; routine dependency and tool updates remain Renovate-owned.
6. Wiki delivery / verification: only this pass's edits to knowledge/wiki/repos/fro-bot--dashboard.md, knowledge/index.md and append-only knowledge/log.md capture the new deployment evidence. Earlier wiki/schema/rename changes and staged metadata overlay are preserved. The dirty tree is left for trusted ingestion; persistence has not yet been verified. No branch/commit/push/metadata/code mutation was delivered. Full remediation commands passed in the prior pass; this pass used direct non-building checks under its delivery constraint, with scoped wiki validation passing.

Run 38113481118 · oversight working-dir · caller owns trusted wiki ingestion.