[uk ai resilience] UK AI Open Code Risk & Resilience Governance — 2026-08-18

[github-actions[bot]]

Executive summary

Recent-change window (7 days, 365 commits) is dominated by AI-agent activity: 80% of commits (291/365) were authored by the "Copilot" coding agent, another 18% (67) by github-actions[bot] automation, leaving only ~7 commits from named humans. Security-signal density is high (68/365 commits, ~19%), concentrated in an active container-image CVE burn-down and safe-outputs conformance hardening — both good signs of remediation velocity. No open secret-scanning alerts. Five open CodeQL alerts remain, two of which (GraphQL-injection-via-Sprintf) are already tracked by an existing UK AI governance issue (#52749). The two highest-priority untracked findings are: (1) untrusted network data written to disk in a docs build script (scripts/ensure-docs-slide-pdf.js, alert #654), and (2) ~78MB of opaque prebuilt third-party binaries (actionlint, gosec) committed directly into git history bypassing go install and code review (alert #653). Per governance guidance, the response prioritizes operational resilience (SLA-bound remediation, provenance verification) over concealment.

Limitation note: the three orchestration sub-agents (asset-tier-classifier, control-verifier, ai-risk-scorer) each returned empty output on two attempts; this report was synthesized directly from pre-computed evidence files and direct issue/alert inspection with partial confidence in place of sub-agent structured output.

Asset graph summary (recent-change scoped)

Asset graph — recent-change scoped areas

Area	Signal / Evidence	Initial Tier Hypothesis
scripts/ensure-docs-slide-pdf.js (docs build)	CodeQL #654 js/http-to-file-access — untrusted network data written to file, no validation	C — Restricted Pending Review
Committed actionlint/gosec binaries (repo root, via PR #48979)	CodeQL #653 workflow-out-of-context — ~78MB opaque binaries in git history, bypasses go install, not gitignored	C — Restricted Pending Review
pkg/cli/project_command.go GraphQL query construction	CodeQL #651/#652 workflow-go-graphql-injection-sprintf; already tracked by issue #52749	B — Open With Conditions (tracked, unfixed)
gh-aw-firewall container images (squid, cli-proxy, agent, api-proxy) + Serena MCP + github-mcp-server	68 security-signal commits bumping/removing vulnerable pins 0.27.x→0.28.1; consolidated tracker #52657 (33 Critical / 253 High across 10 images, 7-day Critical SLA)	B — Open With Conditions (active burn-down, SLA defined)
actions/setup/js/stacked_pull_requests.cjs (safe-outputs handler)	Issue #53603 SEC-005 — missing @safe-outputs-exempt self-documentation annotation; code inspection shows upstream allowlist validation already covers the call path	B — Open With Conditions (low residual risk, doc gap only)
Repo-wide commit/review pipeline	291/365 (80%) commits by AI coding agent, 67 by bot automation, ~7 by named humans in 7 days	B — Open With Conditions (systemic, needs sampling-review confirmation)

• Heavy AI-agent commit velocity is now the dominant operating mode for this repository, not an exception — governance controls must assume it as baseline.
• Container dependency risk is the largest single volume driver (10 images, 286 combined Critical+High findings) but has the clearest existing SLA and tracking discipline ([container-image-scan] Container CVE burn-down #52657).
• The two CodeQL findings without an existing tracking issue ([Custom Engine Test] Test Issue Created by Custom Engine #654, #653) are the primary net-new governance gaps from this run.

Tier classification table

Tier	Areas
Tier A — Open Safe	None identified this cycle
Tier B — Open With Conditions	GraphQL-Sprintf query (#52749, tracked/unfixed), container CVE burn-down (#52657, SLA active), safe-outputs conformance annotation gap (#53603, low residual risk), systemic AI-agent commit ownership
Tier C — Restricted Pending Review	ensure-docs-slide-pdf.js untrusted-write (#654), committed actionlint/gosec binaries (#653)
Tier D — Decommission Candidate	None identified this cycle

Control verification gaps

• Ownership: Majority-AI-agent authorship (80%) lacks explicit evidence in this dataset of mandatory human reviewer sign-off per PR; recommend confirming branch-protection reviewer requirements are enforced repo-wide (insufficient evidence to confirm from commit log alone).
• SDLC: Existing per-image CVE tracking issues and a consolidated parent tracker ([container-image-scan] Container CVE burn-down #52657) demonstrate structured triage; the committed binary artifacts (#653) indicate a process gap where build outputs were checked in during a code-review cycle (PR fix: downgrade gosec to v2.27.1 to resolve actionlint yaml/v4 compile failure #48979) without an automated guard (e.g., pre-commit binary-size/type check).
• Dependency: Active, SLA-bound (7-day Critical) burn-down across 10 container images is a strong positive control; several images (Serena MCP with 31 Critical/205 High) remain the largest single exposure and should be prioritized first.
• Secret exposure: Zero open secret-scanning alerts; however, secret-scanning-alerts GitHub App permission plumbing was added this window, expanding scope — recommend a follow-up scan once that permission propagates to confirm no drift.
• Runtime observability: No direct evidence of a runtime detection control for the untrusted-data-to-file-write pattern in ensure-docs-slide-pdf.js (build-time only, CI context) — treat as a detectability gap.
• Recovery: Provenance of the committed actionlint/gosec binaries cannot be automatically re-derived (no build manifest/SBOM entry cited); recommend sha256 verification against upstream releases and removal in favor of go install, restoring rebuildability.

Risk-scoring table and rationale

AI-aware risk scoring

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier
ensure-docs-slide-pdf.js untrusted write (#654)	Low (docs build only)	High (simple validation fix)	Low (no runtime alerting)	Low	Medium	C
Committed actionlint/gosec binaries (#653)	Medium (supply-chain opacity)	High (delete + go install)	Medium (CodeQL caught it)	Medium (78MB dead weight in history)	Low (accidental commit, unnoticed until scan)	C
GraphQL-Sprintf injection (#651/#652, tracked #52749)	Medium	High (parameterize query)	High (already tracked)	Low	Medium	B
Container CVE chain (#52657)	High (10 images, 286 combined findings)	Medium (SLA-bound, some upstream-blocked)	High (daily scan + tracker)	Medium	High (active process)	B
Safe-outputs conformance gap (#53603)	Low (doc-only, upstream validation confirmed)	High (add annotation)	High (automated conformance check)	Low	High	B
Systemic 80% AI-agent commit share	Medium (scale)	Medium (process change needed, not code fix)	Medium (visible in commit metadata, no explicit gate found)	High (single point of process dependence)	Low-Medium (needs explicit review-sampling policy)	B

Rationale: Tier C items (#654, #653) combine low-to-medium exposure with high patchability and were not yet under active remediation, warranting restricted-pending-review status until fixed. Tier B items already have tracking, SLAs, or upstream-validated mitigating controls, keeping exposure managed but not fully closed.

Remediation queue with SLAs

Item	Action	SLA Urgency
scripts/ensure-docs-slide-pdf.js (#654)	Validate/sanitize network response content before writing to disk (e.g., content-type/size checks)	High
Committed actionlint/gosec binaries (#653)	Remove binaries from git tree, add to .gitignore, confirm CI uses go install, verify sha256 against upstream if retained temporarily	High
GraphQL Sprintf injection (#651/#652, tracked #52749)	Parameterize GraphQL query construction in pkg/cli/project_command.go	Medium (already tracked, escalate if stale)
Container CVE burn-down (#52657)	Continue existing 7-day Critical SLA; prioritize Serena MCP (31 Critical/205 High) first	Critical (per existing SLA)
Safe-outputs conformance gap (#53603)	Add @safe-outputs-exempt SEC-005 annotation to stacked_pull_requests.cjs per existing precedent	Low
Systemic AI-agent commit ownership	Confirm/document required human-reviewer count and sampling-based audit cadence for AI-agent-authored PRs	Medium

Exception register

None proposed this cycle — no repository-hiding or permanent exceptions are recommended; all open items above are tracked via standard issues with defined SLAs.

Operational metrics baseline

• MTTR proxy: Container Critical CVEs have a defined 7-day SLA ([container-image-scan] Container CVE burn-down #52657); no equivalent SLA yet documented for CodeQL warning-severity findings ([Custom Engine Test] Test Issue Created by Custom Engine #654, #653).
• Ownership coverage: ~2% of 7-day commits by named human contributors (7/365); coverage of mandatory human review is not directly evidenced in this dataset.
• Unsupported dependency ratio: 10 container images under active CVE remediation; several (Serena MCP, github-mcp-server) still carry Critical findings.
• Exception aging: N/A — no active exceptions this cycle.
• Exposure without recovery capability: Committed opaque binaries (#653) represent the clearest case — no independently verifiable build path currently in the repo state.

Generated by UK AI Operational Resilience · auto · 51.6 AIC · ⌖ 2.27 AIC · ⊞ 9.3K · ◷

• expires on Aug 21, 2026, 7:42 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #54036.