[uk ai resilience] UK AI Open Code Risk & Resilience Report — 2026-09-08 (recent-changes scope)

[github-actions[bot]]

Executive summary

Recent-changes focus (7-day lookback, since 2026-09-01): 188 commits, 58 security-signal commits, 0 open secret-scanning alerts, 10 open code-scanning alerts, 43 open security-labeled issues. No new critical exposure was found in this window, but the alert-remediation loop is showing systemic friction: several CodeQL findings remain open despite prior "remediated" tracking issues, at least three new code-scanning alerts in actively-changed files have no tracking issue at all, and a 43-issue security backlog (17 of them stale [container-image-scan] reports) suggests triage throughput, not concealment, is the binding constraint. Per UK AI Open Code guidance, the recommendation is to keep the repository open and improve remediation velocity — not to restrict visibility.

Asset graph summary (recent-change scoped)

Recent-change asset graph

Area / File	Runtime Role	Dependencies Implicated	Ownership Signal	Initial Tier
pkg/cli/add_package_manifest_imports.go	CLI: package-manifest import resolution	none flagged	Copilot-bot authored, gh-aw-bot/dsyme reviewed	B
pkg/cli/add_package_manifest_includes.go	CLI: package-manifest include resolution	none flagged	same pattern as above	B
pkg/workflow/graders_config.go	Compiler: grader config loading	none flagged	workflow compiler core, actively maintained	B
pkg/workflow/mcp_setup_generator.go	Compiler: MCP setup code-gen	none flagged	tracked (#58261, Tier B)	B
pkg/cli/project_command.go	CLI: GitHub Projects GraphQL calls	GitHub GraphQL API	tracked (#52749, Tier B)	B
scripts/ensure-docs-slide-pdf.js	Docs build: fetch+write untrusted network content	external HTTP fetch	tracked (#53737, Tier C)	C
CI actionlint step	SDLC control (workflow linting)	actionlint binary	tracked (#57728, Tier C, stale)	C
README.md	Docs	n/a	tracked (#57981, Tier B)	B

Tier classification table

Tier classification

Tier	Count	Basis
A — Open Safe	—	no changed area qualified this cycle
B — Open With Conditions	6 areas	tracked, low exploit likelihood, needs confirmation/closure
C — Restricted Pending Review	2 areas	stale hygiene gap (#57728) + untrusted-network-write pattern (#53737)
D — Decommission Candidate	0	none identified

Control verification gaps

• SDLC / remediation loop: Issue [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 documents 3 CodeQL alerts remaining open despite tracking issues marked closed/remediated — a dismissal-hygiene gap, not a code defect. This is the top operational-resilience issue this cycle.
• Alert coverage vs. tracking: Alerts #674 (add_package_manifest_imports.go), [Custom Engine Test] Test Issue Created by Custom Engine #669/Codex fails to report failure if unauthorised #668 (graders_config.go), [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667 (add_package_manifest_includes.go) have no matching open tracking issue found in the current open-issues set — a gap in the "classification → control verification" loop for newly introduced findings in this week's commits.
• False-positive backlog: [uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472 asserts go/bad-redirect-check recurs as a false positive across path-traversal guards; without a suppression/annotation this pattern will keep generating new untracked alerts (as seen with #674/[Custom Engine Test] Test Issue Created by Custom Engine #669/Codex fails to report failure if unauthorised #668/[Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667).
• Dependency controls: no dependency-CVE alerts present this cycle — not evaluated further.
• Secret controls: 0 open secret-scanning alerts — reflects a clean current state, not a proof of scanning breadth.
• Runtime observability: positive signal — recent commits (Add oldest-run pruning mode to logs downloads #59453 "oldest-run pruning for logs downloads", Resolve remote workflow names for logs targets #59454 "resolve remote logs workflow names") show active investment in log/observability tooling.
• Ownership: automation (Copilot bot / gh-aw-bot) plus a small human reviewer set (dsyme) drives nearly all recent commits — adequate for velocity but concentrates review bandwidth.

Risk-scoring table and rationale

AI-aware risk scoring

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier
CodeQL alert-dismissal hygiene (#57982 gap)	Medium	High (process fix)	Low (silent staleness)	High	Medium	C
Untracked graders_config.go / add_package_manifest_*.go bad-redirect-check alerts	Low–Medium	High	Medium	Medium	Medium	B
ensure-docs-slide-pdf.js untrusted network write	Medium	High	Medium	Medium	Medium	C
project_command.go GraphQL construction	Low	High	Medium	Low	High (tracked)	B
Stale actionlint workflow-out-of-context alert	Low	High	Low	Medium	Low	C

Rationale: none of the findings show high exploit-acceleration potential in isolation; the dominant risk driver is process fragility — alerts persisting past their intended remediation, and new findings entering the pipeline without a tracking issue.

Remediation queue with SLAs

Action	Owner Area	SLA Urgency
Reconcile/close or re-open the 3 stale CodeQL alerts referenced in #57982; add dismissal-reason audit step to the alert-tracking automation	SDLC tooling	High
Open/confirm tracking issues for alerts #674, #669, #668, #667 (currently untracked)	pkg/cli, pkg/workflow owners	High
Land a go/bad-redirect-check suppression or shared helper for path-traversal guards to stop recurring false positives (per #57472)	pkg/cli, pkg/workflow	Medium
Triage/close stale [container-image-scan] backlog (17 open issues) to restore signal-to-noise in the security queue	Container image owners	Medium
Consolidate duplicate "Activity Signals: Review Queue" issues (#56649, #55136, #39661, #39034)	Triage process	Low

Exception register

None required this cycle — no Tier D items and no time-bound exception requests identified.

Operational metrics baseline

Metric	Value
MTTR proxy (open tracking issue → alert closure)	Not closing reliably — 3 alerts stale despite "remediated" issues (#57982)
Ownership coverage	High for compiler/CLI core (dsyme + bot automation); backlog areas (container scans) show weaker coverage
Unsupported/stale dependency ratio	0 dependency-CVE alerts open this cycle (not independently verified against SBOM)
Exception aging	N/A — no active exceptions
Exposure without recovery capability	Low — all open alerts have a plausible remediation path; gap is process velocity, not irrecoverable exposure

_This report was generated by the UK AI Open Code Risk & Resilience Governance workflow using a recent-changes focus strategy, per (www.gov.uk/redacted)

Generated by UK AI Operational Resilience · copilot · auto · 55.1 AIC · ⌖ 12.6 AIC · ⊞ 8.1K · ◷

• expires on Sep 11, 2026, 7:39 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #59772.