[uk ai resilience] UK AI Governance: recent-change risk review (2026-08-24 to 2026-08-31)

[github-actions[bot]]

Executive summary

7-day recent-change scan (2026-08-24 → 2026-08-31, 357 commits) of github/gh-aw found no new high-severity runtime risk introduced by recent changes. The 8 open code-scanning alerts are largely pre-existing, already tracked by prior uk-ai-resilience issues, or non-actionable (a smoke-test dummy finding and a historical/out-of-window binary-in-git-history note). Two go/bad-redirect-check alerts newly appeared on 2026-08-30 (#668/#669) in pkg/workflow/graders_config.go, following the exact same false-positive pattern as the already-open Tier B issue #54037 for a sibling path-guard function. A third go/bad-redirect-check alert (#667) flags cleanManifestRelativePath in pkg/cli/add_package_manifest_includes.go — a second, newer instance of a manifest path-traversal guard using the identical CodeQL-flagged pattern. No open secret-scanning alerts. Recommendation: consolidate the recurring go/bad-redirect-check false-positive pattern into a single tracked remediation (helper-hardening + CodeQL suppression rationale) rather than opening a new issue per occurrence, and confirm existing Tier B/C issues (#54037, #52749, #53737) remain the active remediation vehicles.

Asset graph summary (recent-change scoped)

Recent-change asset graph

Area	Component	Runtime surface	Dependency/rule	Ownership signal
pkg/workflow/graders_config.go (IsValidOperationalValueEvaluatorRunPath)	Workflow compiler — operational-value grader config	Compile-time path validation for evaluator .sh scripts	CodeQL go/bad-redirect-check (#668, #669, new 2026-08-30)	pkg/workflow compiler maintainers
pkg/cli/add_package_manifest_includes.go (cleanManifestRelativePath)	CLI — package manifest include/destination resolution	Path traversal guard for manifest resource copying	CodeQL go/bad-redirect-check (#667) — same rule/pattern as closed-context sibling in add_package_manifest.go (tracked, still open, #54037)	pkg/cli package-manifest maintainers
scripts/ensure-docs-slide-pdf.js	Docs build tooling	Writes HTTP response body to disk without validation	CodeQL js/http-to-file-access (#663) — already tracked, #53737 (Tier C)	docs/build tooling owners
pkg/cli/project_command.go	CLI — GitHub Projects GraphQL client	Builds GraphQL query string via fmt.Sprintf with escaped owner input	Custom rule workflow-go-graphql-injection-sprintf (#651, #652) — already tracked, #52749 (Tier B)	pkg/cli GitHub integration owners
actionlint/gosec binaries in git history	Build tooling / CI	Large pre-built binaries committed in a historical PR (#48979), out of window	workflow-out-of-context (#653)	build/CI tooling owners
README.md	Docs	Smoke-test dummy finding, no real content	workflow-security-finding-1 (#564)	n/a — scanner self-test artifact

Scope: recent commits in the lookback window were dominated by routine chores (dependency bumps, doc updates, trajectory-grader/spec work) with no new externally-reachable attack surface. All substantive alerts map to pre-existing, already-triaged findings or a recurrence of a previously-assessed false-positive pattern.

Tier classification table

Tier classification

Area	Tier	Rationale
graders_config.go bad-redirect-check (#668/#669)	Tier B — Open With Conditions	Same false-positive shape as #54037: a filesystem path-traversal guard, not a redirect handler; low exposure, high patchability
add_package_manifest_includes.go bad-redirect-check (#667)	Tier B — Open With Conditions	Second occurrence of the identical guard pattern already assessed in #54037; consolidate remediation
ensure-docs-slide-pdf.js http-to-file-access (#663)	Tier C — Restricted Pending Review (existing, #53737)	Untrusted network write to disk in build script; no new evidence changes prior tier
project_command.go GraphQL Sprintf (#651/#652)	Tier B — Open With Conditions (existing, #52749)	Escaping present but brittle; no new evidence changes prior tier
actionlint/gosec binaries in history (#653)	Tier A — Open Safe	Historical, non-malicious, already recommended remediation (remove + .gitignore); out of current window
README.md dummy finding (#564)	Tier A — Open Safe	Scanner self-test artifact, no action needed

Control verification gaps

• Ownership controls: Directory-based ownership is inferable (pkg/workflow, pkg/cli) but no CODEOWNERS-level confirmation was performed in this pass (sub-agent dispatch for control verification did not return usable output; treated as a partial-confidence limitation).
• SDLC controls: PRs for all recent commits show squash-merge with "Initial plan" / co-authored-by conventions, consistent with the repo's existing agentic-PR workflow gates.
• Dependency controls: Recent MCP Gateway bump (v0.4.14) and drain3 pattern-weight update are dependency-adjacent; no open Dependabot/dependency-scanning alerts surfaced in this window's inputs.
• Secret exposure controls: 0 open secret-scanning alerts — no gap identified.
• Runtime observability controls: No workflow-run-specific observability changes identified in this window beyond routine grader/trajectory tooling additions.
• Recovery controls: Prior Tier B/C issues ([uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037, [uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings) #52749, [uk-ai-resilience] UK AI Governance: untrusted network data written to file in scripts/ensure-docs-slide-pdf.js (Tier C) #53737) remain open past multiple governance cycles without closure — indicates a remediation velocity gap: false-positive CodeQL findings are being re-identified/re-flagged rather than closed with a documented suppression or fix.

Note on sub-agent coverage: the asset-tier-classifier and control-verifier sub-agent invocations did not return usable structured output for this run; the asset graph and control findings above were synthesized directly from precomputed inputs and direct source inspection with reduced confidence on ownership-control specifics.

Risk-scoring table and rationale

AI-aware risk scoring

Area	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Overall
graders_config.go (#668/#669)	Low	High	High (CodeQL)	Low	Medium	Low-Medium
add_package_manifest_includes.go (#667)	Low	High	High (CodeQL)	Low	Medium	Low-Medium
ensure-docs-slide-pdf.js (#663)	Low	High	Low (no runtime alerting)	Low	Medium	Low-Medium (unchanged from #53737)
project_command.go (#651/#652)	Low	High	High (CodeQL)	Low	Medium	Low-Medium (unchanged from #52749)

Remediation queue with SLAs

Item	Action	SLA urgency
#667/#668/#669 go/bad-redirect-check recurrence	Consolidate: add explicit CodeQL suppression comments (path-traversal guard, not a redirect handler) or tighten the guard to reject any / or \ in the second character, across all three flagged functions in one PR; reference existing #54037 rather than opening duplicates	Medium
#52749 GraphQL Sprintf	Migrate project_command.go GraphQL query construction to typed variables instead of string interpolation	Medium (unchanged)
#53737 docs-slide-pdf http-to-file-access	Add content-type/size validation before writing HTTP response to disk	Medium (unchanged)
Stale Tier B/C backlog (#54037, #52749, #53737)	Triage and close/fix during next maintenance window — these have persisted across multiple governance cycles	High (process, not code)

Exception register

None required this cycle — no new exceptions requested; existing Tier B/C items remain under standard remediation tracking, not exception governance.

Operational metrics baseline

• MTTR proxy: Tier B/C issues [uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037, [uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings) #52749, [uk-ai-resilience] UK AI Governance: untrusted network data written to file in scripts/ensure-docs-slide-pdf.js (Tier C) #53737 remain open for 2+ governance cycles (17+ days) — indicates remediation velocity below target.
• Ownership coverage: Partial — directory-level ownership inferred, CODEOWNERS-level verification incomplete this cycle.
• Unsupported dependency ratio: Not assessed this cycle (no new dependency-scanning alert data in inputs).
• Exception aging: N/A — no active exceptions.
• Exposure without recovery capability: None identified — all flagged areas have clear, low-effort remediation paths (patchability rated High across the board).

Generated by UK AI Operational Resilience · copilot · auto · 55.7 AIC · ⌖ 9.97 AIC · ⊞ 8.1K · ◷

• expires on Sep 3, 2026, 7:38 AM UTC-08:00