[uk ai resilience] UK AI Open Code Risk & Resilience Governance — 2026-08-14 (7-day lookback)

[github-actions[bot]]

Executive Summary

Recent-change-scoped review (last 7 days, since 2026-08-07, 288 commits / 71 security-signal commits) of github/gh-aw finds an actively maintained, well-instrumented repository with automated security tooling (Sighthound, static-analysis, container-image-scan, code scanning) running daily and generating tracked issues with SLAs. No open secret-scanning alerts. Code scanning currently shows 5 open alerts, all "warning" severity (no critical/error-level open alerts) concentrated in two recently-touched files: pkg/cli/project_command.go (GraphQL query construction via Sprintf) and scripts/ensure-docs-slide-pdf.js (network data written to file). Sighthound's top command-injection findings this week point at exec.Command usage in pkg/workflow/pip_validation.go, pkg/cli/dependabot.go, pkg/cli/grype.go, and pkg/cli/experiments_command.go — largely mitigated by argv-array invocation but lacking confirmed input allow-listing. The new preview Cloud Hypervisor sandbox runtime (privileged strict-isolation AWF host invocation, scoped KVM access) is a high-blast-radius area introduced this week that merits Tier B (conditional) status pending dedicated review, given its privilege level and early maturity. Container image CVE burn-down (33 Critical / 253 High across 10 images) is already governed by a parent tracking issue (#52657) with a 7-day Critical SLA — this is an existing, functioning remediation loop, not a new gap.

Per UK gov.uk AI/open-code guidance, resilience (patchability, ownership, observability) is prioritized over concealment; no repository-hiding recommendations are made.

Sub-agent note: the asset-tier-classifier and control-verifier sub-agents were dispatched but returned empty responses after one retry each; this report was synthesized directly from the precomputed evidence files with partial automation confidence noted where relevant.

Asset Graph Summary (recent-change scoped)

Segment	Component/Files	Runtime Area	Dependencies	Ownership Signal
GraphQL project automation	pkg/cli/project_command.go	CLI (project board sync)	GitHub GraphQL API	Human-reviewed PR merges
Docs build tooling	scripts/ensure-docs-slide-pdf.js	Build/docs pipeline (Node)	HTTP fetch → filesystem write	Docs/build automation
Sandbox runtime (new)	Cloud Hypervisor / AWF host invocation, KVM, virtiofsd, MCP gateway topology	Agent execution sandbox (privileged)	KVM, virtiofsd, MCP gateway	copilot-swe-agent[bot] + gh-aw-bot + human co-authors
Package validation	pkg/workflow/pip_validation.go	Workflow compiler (pip/uv package checks)	PyPI metadata, exec.Command	Core workflow team
Dependency automation	pkg/cli/dependabot.go	CLI (npm install invocation)	npm, package-lock	Core CLI team
Container vuln scanning	pkg/cli/grype.go	CLI (docker run + Grype)	Docker, Grype image	Core CLI team
Git ref inspection	pkg/cli/experiments_command.go	CLI (git show)	git	Core CLI team
MCP gateway & firewall containers	gh-aw-mcpg, gh-aw-firewall/{agent,squid,cli-proxy,api-proxy}	Runtime containers	Multiple base images	Automated container-image-scan issues, 7-day Critical SLA
Workflow compiler/schema	Schema suggestions parser, frontmatter schema, safe-output config	Compiler	N/A	Frequent human+bot commits, active hardening

Tier Classification Table

Area	Tier	Rationale
GraphQL project_command.go	B — Open With Conditions	Only "warning" severity, sprintf-built GraphQL query; needs parameterization/allow-list confirmation, not urgent block
ensure-docs-slide-pdf.js	B — Open With Conditions	Network→file write flagged; docs-build-only blast radius, but should validate source URL trust
Cloud Hypervisor sandbox runtime	B — Open With Conditions	New, privileged (KVM), preview-labeled; needs dedicated security review before default-enable given amplified blast radius
pip_validation.go / dependabot.go / grype.go / experiments_command.go	B — Open With Conditions	Sighthound flags Command-Injection pattern; argv-array mitigates but package/image/ref validation unconfirmed
MCP gateway & firewall containers	B — Open With Conditions	Active, tracked Critical/High CVE burn-down already has SLA and per-image issues in place
Workflow compiler/schema/safe-outputs	A — Open Safe	High commit velocity of hardening/test changes, no open alerts tied to this area
CI/test reliability work	A — Open Safe	Routine reliability improvements, no security signal

No Tier C or D candidates identified this cycle — no open critical/error code-scanning alerts and no exposed secrets in the recent-change window.

Control Verification Gaps

• Ownership: Partial — bot-assisted PR pipeline (github-actions[bot], gh-aw-bot, Copilot App co-authorship) suggests review gates, but explicit CODEOWNERS coverage for new Cloud Hypervisor sandbox code not confirmed in this pass.
• SDLC: Adequate — daily static-analysis (zizmor, runner-guard, grype, actionlint, yamllint, shellcheck) and Sighthound scans run continuously; 0 critical zizmor/poutine/actionlint findings this cycle.
• Dependency: Partial — automated "deps: bump safe patch updates" commits show a working pipeline; 1649 grype container CVEs (67 Critical) remain against tracked SLA, so not yet fully remediated.
• Secret exposure: Adequate — 0 open secret-scanning alerts.
• Runtime observability: Partial — insufficient evidence in this pass to confirm dedicated telemetry for the new privileged Cloud Hypervisor path specifically.
• Recovery/rollback: Adequate — container CVE burn-down issue defines explicit 7-day Critical SLA and per-image remediation tracking; sandbox runtime changes are compile-time gated ("Reject unsupported cloud-hypervisor combinations at compile time").

Risk-Scoring Table & Rationale

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Overall
GraphQL sprintf (project_command.go)	Low	High	High (code scanning caught it)	Low	Medium	Low-Medium
ensure-docs-slide-pdf.js	Low	High	High	Low	Medium	Low-Medium
Cloud Hypervisor sandbox runtime	High (privileged KVM)	Medium (preview/compile-gated)	Medium (new code, less battle-tested)	Medium	Medium	Medium-High
exec.Command sites (pip/dependabot/grype/experiments)	Medium	High (argv-array already)	High (Sighthound flags it)	Low	High	Low-Medium
Container images (mcpg/firewall)	Medium	High (tracked SLA)	High (daily scan)	Low	High	Low-Medium

Remediation Queue with SLAs

1. Confirm/parameterize GraphQL query construction in pkg/cli/project_command.go (lines 269, 272) — SLA: High (14 days). Verify inputs are not attacker-controlled or add explicit escaping/parameterization.
2. Validate trust boundary for network data written in scripts/ensure-docs-slide-pdf.js:197 — SLA: Medium (30 days). Confirm the fetched source is a pinned, trusted origin.
3. Add/confirm allow-list validation for exec.Command argv inputs in pip_validation.go, dependabot.go, grype.go, experiments_command.go — SLA: High (14 days), tracked already via Sighthound [sighthound] Security findings in github/gh-aw #52640.
4. Dedicated security review of Cloud Hypervisor sandbox runtime privileged path (KVM access scope, virtiofsd bundle verification, MCP gateway topology) before broader rollout — SLA: High (14 days), human-review trigger recommended given privilege escalation surface.
5. Continue container CVE burn-down per existing [container-image-scan] Container CVE burn-down #52657 7-day Critical SLA — no new action needed, already governed.

Exception Register

None required this cycle — no Tier C/D findings and no requests for temporary risk acceptance beyond the existing, already-documented container CVE SLA in #52657.

Operational Metrics Baseline

• MTTR proxy: Container CVE tracking issue defines explicit 7-day Critical SLA — functioning proxy metric.
• Ownership coverage: Partial confidence — bot/human co-authorship pattern observed, but explicit CODEOWNERS mapping for new sandbox code not verified this cycle.
• Unsupported dependency ratio: Not directly measurable from available data this cycle; grype flags 1649 container CVEs but package-level EOL/support status not enumerated.
• Exception aging: N/A — no active exceptions.
• Exposure without recovery capability: None identified — all Tier B items have identified remediation paths and none are unpatched/unrecoverable.

Generated by UK AI Operational Resilience · auto · 51.5 AIC · ⌖ 2.25 AIC · ⊞ 8.7K · ◷

• expires on Aug 17, 2026, 7:45 AM UTC-08:00