[uk ai resilience] UK AI Governance: recent-change risk review (2026-09-02 to 2026-09-09)

[github-actions[bot]]

Executive summary

Recent-changes-focused UK AI Open Code Risk & Resilience Governance review, 7-day lookback (2026-09-02 → 2026-09-09), 203 commits, 62 security-signal commits, 12 open code-scanning alerts, 0 open secret-scanning alerts, 45 open security issues in github/gh-aw.

Note on sub-agent tooling: the asset-tier-classifier, control-verifier, and ai-risk-scorer sub-agents each failed to produce output after one retry (per guardrail, retried once and then proceeded with partial confidence). The analysis below was produced directly from precomputed inputs and direct verification against the current open alert/issue lists; treat scoring as lower-confidence than a full multi-agent run and re-run sub-agents next cycle.

Headline finding: 3 CodeQL alerts (go/allocation-size-overflow #677, #676, #675) and 1 alert (workflow-security-finding-1 #657) have no open tracking issue at all, breaking the classification→control-verification loop for this window. Additionally, two pre-existing open issues (#57982, #59490) already document a recurring alert-dismissal hygiene gap — alerts referenced by "remediated" tracking issues remain open in code scanning — which is a systemic recovery-control weakness, not an isolated defect.

Commit velocity this window is unusually high (203 commits) and dominated by bot/agent authors (Copilot 153, github-actions[bot] 31, dependabot[bot] 13; only 6 human-authored commits), which increases reliance on automated review/merge gates and lowers ownership-confidence signal strength for changed files.

Asset graph summary (recent-change scoped)

Repository segments, runtime areas, and ownership signals touched in the window

Segment	Files	Likely runtime/service area	Ownership signal
MCP gateway/tooling config generation	pkg/workflow/mcp_setup_generator.go, pkg/workflow/mcp_github_config.go	GitHub Actions workflow YAML generation, MCP container config assembly	No verified CODEOWNERS entry found; heavy bot-authored churn
Package-manifest path helpers	pkg/cli/add_package_manifest_imports.go, pkg/cli/add_package_manifest_includes.go	CLI manifest include/import path validation	Same false-positive class as prior tracked alert in add_package_manifest.go (#54037)
Operational-value grader path validation	pkg/workflow/graders_config.go	Workflow compiler / grader script path validation	Same false-positive redirect-check class (#57472)
GraphQL query construction	pkg/cli/project_command.go (lines 269, 272)	GitHub project board CLI integration	Tracked in #52749, unresolved
Docs build pipeline	scripts/ensure-docs-slide-pdf.js	Docs slide PDF generation from network content	Tracked in #53737 under an earlier alert number (#654 → now #663)
Repo docs / smoke test signal	README.md	CodeQL smoke-test dummy finding via "Smoke Claude" workflow	Confirms scanning pipeline live; untracked under current alert number #657
Spec conformance	docs/compiler-threat-detection-spec.md (renumbered)	Formal threat-detection rule catalog / test conformance	Human + bot collaboration; no security alert directly tied

Dependency signals: 13 dependabot commits in-window; no alert in this run directly implicates a specific third-party dependency version (all 12 open alerts are first-party code, CodeQL/CLI rules).

Tier classification table

Tier assignments for changed-area findings

Area	Tier	Rationale
Untracked go/allocation-size-overflow #677/#676/#675	C — Restricted Pending Review	Zero tracking issues exist; MCP config generators feed workflow/container setup — an overflow-triggered panic or undersized allocation here has moderate blast radius across all generated workflows
Alert-dismissal hygiene gap (#57982, #59490 already open)	C — Restricted Pending Review	Confirmed recurring: process control for reconciling "remediated" issues against actual alert state is broken
workflow-security-finding-1 #657 untracked (README.md)	B — Open With Conditions	Low real risk (smoke-test dummy finding) but untracked, contributing to backlog-visibility gap
go/bad-redirect-check x4 (#674/#669/#668/#667)	B — Open With Conditions	Already tracked (#59491) as likely false-positive path-traversal-guard pattern, but not yet dismissed/fixed despite 3 prior tracking issues (#54037, #57472, #59491) on the same finding class
workflow-go-graphql-injection-sprintf x2 (project_command.go)	B — Open With Conditions	Tracked (#52749), unresolved since 2026-08-14
js/http-to-file-access #663 (ensure-docs-slide-pdf.js)	B — Open With Conditions	Tracked (#53737), Tier C-worthy content but docs-build-only exposure keeps residual risk moderate
workflow-out-of-context #653 (actionlint)	B — Open With Conditions	Tracked (#57728) as stale/should-be-dismissed — awaiting dismissal action

Control verification gaps

• Ownership controls: CODEOWNERS coverage for pkg/workflow/mcp_*.go and pkg/cli/add_package_manifest_*.go could not be positively verified this run — flag as an open governance question, not a confirmed gap.
• SDLC controls: 203 commits/7 days with 97% bot/agent authorship implies review gates are largely automated; cannot directly verify branch-protection/required-review settings from available inputs.
• Dependency controls: dependabot active (13 commits) with no directly-implicated vulnerable dependency in this alert set — apparent green signal, not fully verified.
• Secret exposure controls: 0 open secret-scanning alerts — could reflect strong hygiene or reduced scan coverage; treat as unconfirmed green rather than proof of absence.
• Runtime observability controls: presence of a dummy/smoke alert (#657) from "Smoke Claude" confirms the code-scanning pipeline is live and producing signals end-to-end.
• Recovery controls: weakest area — [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 and [uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490 document alerts that stayed open despite tracking issues claiming remediation, meaning the patch/verify/close loop is not reliably closing the gap between fix and alert-dismissal.

Risk-scoring table and rationale

Dimension scoring for top findings (produced directly; ai-risk-scorer sub-agent unavailable this run)

Finding	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Tier
#677/#676/#675 alloc-overflow (untracked)	Low–Medium	High	Medium (CodeQL catches it, but untracked in backlog)	Medium	Low (ownership unverified)	C
Alert-dismissal hygiene gap	Medium	High (process fix)	Low (silent staleness)	High	Medium	C
#657 workflow-security-finding-1 (untracked)	Low	High	Low (untracked)	Low	Low	B
#674/#669/#668/#667 bad-redirect-check (tracked, unresolved 3x)	Low–Medium	High	Medium	Medium	Medium	B

Remediation queue with SLAs

#	Item	Action	SLA
1	#677/#676/#675 untracked alloc-overflow	Guard arithmetic with bounds check or widen to int64/uint64 before allocation in mcp_setup_generator.go:146 and mcp_github_config.go:84; add regression test with large/edge input	High — 7 days
2	Alert-dismissal hygiene gap	Add automated reconciliation step verifying code-scanning alert state before allowing a "remediated" tracking issue to close	High — 14 days
3	#657 untracked smoke-test finding	Confirm it is dummy/test-only and dismiss with documented reason, or open a lightweight tracking issue	Medium — 14 days
4	#674/#669/#668/#667 bad-redirect-check (3rd unresolved cycle)	Land shared path-validation helper across pkg/cli/pkg/workflow and dismiss with rationale, or fix genuine cases — escalate given 3 prior issues without closure	High — 7 days

Exception register

None registered this run — no permanent hidden-repo or scope exceptions requested. Existing "false positive" claims for go/bad-redirect-check (#54037, #57472, #59491) remain unresolved claims, not approved exceptions; they should be converted to either a code fix or a documented, time-boxed CodeQL suppression with expiry, not left indefinitely open.

Operational metrics baseline

• MTTR proxy: alert Hello from Claude #672 (mcp_setup_generator.go) was tracked and resolved between runs, but Test Issue for Commands #677 (same file, new line) reopened the same class untracked — suggests fix-to-alert-closure cycle exists but doesn't prevent recurrence.
• Ownership coverage: unverified this run for MCP-gateway and CLI manifest-path files — flagged as governance gap to confirm, not asserted absent.
• Unsupported dependency ratio: no data this run; no alert directly implicates a specific dependency.
• Exception aging: go/bad-redirect-check false-positive claim has persisted across 3 tracking issues ([uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037 → [uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472 → [uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B) #59491) without a code fix or formal CodeQL suppression — aging risk.
• Exposure without recovery capability: alert-dismissal hygiene gap ([uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982, [uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490) is the clearest instance — alerts stay open despite issues claiming remediation, meaning recovery cannot be verified end-to-end.

Generated by UK AI Operational Resilience · copilot · auto · 80.5 AIC · ⌖ 6.82 AIC · ⊞ 8.1K · ◷

• expires on Sep 12, 2026, 7:40 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #60007.