[uk ai resilience] UK AI Open Code Risk & Resilience Review — Week of 2026-08-31

[github-actions[bot]]

Executive summary

Recent-changes scan (7-day lookback, since 2026-08-31) covers 181 commits / 52 security-signal commits in github/gh-aw. Two substantive subsystems changed: the logs-cache pruning/budget enforcement path (PR #59049) and the dynamic enclave delegation controller + mcpg gateway v0.4.17 upgrade (PR #59046). Both required multiple review-driven hardening rounds before merge — a positive SDLC signal, though the logs-cache follow-up-fix cadence (3 patches for concurrency/marker bugs) indicates residual operational fragility.

All 10 open code-scanning alerts and 0 open secret-scanning alerts were cross-checked against the 42 open security issues: every alert already has an active [uk-ai-resilience] tracking issue (see table below). No new code-scanning or secret-scanning finding was identified this cycle that lacks a tracker. Per governance policy, no new GitHub issues were created to avoid duplication; the existing alert-dismissal hygiene gap (#57982) remains the single most consequential open control gap and should be prioritized by the team already assigned.

Asset graph summary (recent-change scoped)

Asset graph (recent-change scoped)

Asset/Segment	Recent Change Evidence	Runtime Area	Dependencies	Ownership Signal
Logs cache subsystem	PR #59049: budget enforcement + 3 follow-up fixes (concurrent pruning, nested marker invalidation)	GitHub Actions runtime cache I/O	none external	pelikhan (author, clear)
MCP gateway / enclave delegation controller	PR #59046: new github-repository-delegation-v1 bootstrap contract, control endpoint wired into runtime	Workflow runtime, network control-plane	gh-aw-mcpg pinned v0.4.17 (digest)	lpcox (reviewer, clear)
Safe-output collect dispatcher	replace_label handler registered in dispatch map	Actions safe-output job	none	no distinct human owner surfaced
Compiler threat-spec docs	1.0.30 changelog/mapping sync	Docs/compiler spec	none	no distinct human owner surfaced
pkg/cli/add_package_manifest_imports.go, _includes.go	Alert #674, #667 (go/bad-redirect-check)	CLI package-manifest parsing	none	tracked via issue #54037/#57472
pkg/workflow/graders_config.go	Alerts #668, #669 (go/bad-redirect-check)	Workflow grader config loader	none	tracked via issue #57472
pkg/workflow/mcp_setup_generator.go	Alert #672 (allocation-size-overflow)	MCP config generation	none	tracked via issue #58261
scripts/ensure-docs-slide-pdf.js	Alert #663 (js/http-to-file-access)	Docs build pipeline	none	tracked via issue #53737
pkg/cli/project_command.go	Alerts #651, #652 (GraphQL injection via Sprintf)	CLI project command / GraphQL client	GitHub GraphQL API	tracked via issue #52749
README.md	Alert #564 (workflow-security-finding-1)	Docs	none	tracked via issue #57981
actionlint config	Alert #653 (workflow-out-of-context)	CI lint	none	tracked via issue #57728

Tier classification table

Tier classification

Area	Tier	Rationale
Logs cache pruning subsystem	B — Open With Conditions	Merged with review, but 3 post-merge concurrency fixes signal fragility; monitor next cycle
Enclave delegation controller / mcpg v0.4.17	B — Open With Conditions	New network control-plane surface, but digest-pinned dependency and multi-round review reduce risk
go/bad-redirect-check alerts (4x)	B — Open With Conditions	Recurring pattern, at least one flagged false-positive; already tracked, low exploitability (redirect-only)
js/http-to-file-access (ensure-docs-slide-pdf.js)	C — Restricted Pending Review	Untrusted network data written to file in build pipeline; already tracked as Tier C (#53737), unchanged this cycle
GraphQL injection via Sprintf (project_command.go)	B — Open With Conditions	CLI-only, requires local invocation; tracked, verification pending (#52749)
Alert-dismissal hygiene process	C — Restricted Pending Review	Structural gap: 3 alerts remain open despite remediation elsewhere; affects recovery/closure velocity across all findings

Control verification gaps

• Ownership controls — Partial. Clear owners exist for the two active PRs (pelikhan, lpcox) but the safe-output dispatcher and threat-spec doc changes have no distinct human owner in commit trailers.
• SDLC controls — Adequate. Both major PRs (Enforce logs cache budgets with selective pruning #59049, Wire dynamic enclave delegation controller into the workflow runtime #59046) show "Address review" iteration commits, indicating enforced human review before merge.
• Dependency controls — Adequate. mcpg gateway is digest-pinned (v0.4.17) with an explicit minimum-version floor (MCPGDynamicRepositoryDelegationMinVersion) that fails closed on older pins.
• Secret exposure controls — Adequate. 0 open secret-scanning alerts; no new secret-adjacent surface introduced (delegation control endpoint is not secret-bearing per commit description, but was not independently verified here).
• Runtime observability controls — Partial. Logs-cache budget enforcement is itself an observability control, but the need for 3 follow-up fixes suggests test coverage for concurrency edge cases was insufficient pre-merge.
• Recovery controls — Gap. Issue [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 documents that CodeQL alerts are not reliably closed even after remediation merges, breaking the patch → close feedback loop that recovery/rollback readiness depends on.

Risk-scoring table and rationale

Risk scoring

Area	Exposure	Patchability	Detectability	Fragility	Ownership Confidence	Tier
Logs cache pruning	Low	High	Med	Med (3 follow-ups)	High	B
Enclave delegation controller	Med (new control-plane)	High (pinned dep)	High	Low (multi-round review)	High	B
go/bad-redirect-check (x4)	Low	High	High	Low	Med	B
js/http-to-file-access	Med	High	High	Low	Med	C
GraphQL injection (Sprintf)	Low (CLI-local)	High	Med	Low	Med	B
Alert-dismissal hygiene gap	N/A (process)	Med	Low (silent drift)	High	Low	C

Remediation queue with SLAs

Item	Action	SLA
Alert-dismissal hygiene gap (#57982)	Automate alert-closure verification when tracking issues close	High
js/http-to-file-access (#53737)	Validate/sandbox untrusted network content before file write in ensure-docs-slide-pdf.js	High
GraphQL Sprintf injection (#52749)	Replace string-built GraphQL queries with parameterized variables in project_command.go	Medium
go/bad-redirect-check cluster (#54037, #57472)	Consolidate fix across add_package_manifest_*.go and graders_config.go, then dismiss alerts in one pass	Medium
Logs-cache concurrency coverage	Add regression tests for concurrent pruning/marker invalidation	Medium

Exception register

None. No temporary exceptions were requested or required this cycle; all findings map to existing, actively tracked issues.

Operational metrics baseline

• MTTR proxy: alerts [uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037/[uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472 (bad-redirect-check) opened but unresolved across multiple cycles — MTTR trending long for this cluster.
• Ownership coverage: 2/4 major recent-change areas have a clear named human owner; 2 (safe-output dispatcher, threat-spec docs) do not.
• Unsupported dependency ratio: 0 — mcpg gateway is current and digest-pinned; no stale dependency floors detected this cycle.
• Exception aging: N/A — no active exceptions.
• Exposure without recovery capability: 1 structural gap identified (alert-dismissal hygiene, [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982) — alerts can remain "open" indefinitely even after code remediation, meaning exposure can persist without a corresponding recovery signal.

Generated by UK AI Operational Resilience · copilot · auto · 38.2 AIC · ⌖ 8.25 AIC · ⊞ 8.1K · ◷

• expires on Sep 10, 2026, 7:36 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #59489.