[uk ai resilience] UK AI Governance: recent-change risk review (2026-09-03 to 2026-09-10)

[github-actions[bot]]

Executive summary

Recent-change-scoped (7-day lookback, since 2026-09-03T15:31:39Z) review of github/gh-aw across 196 commits (53 security-signal). All 12 open code-scanning alerts and 48 open security-labeled issues were cross-referenced against the recent-change window. No open secret-scanning alerts. Two sub-agent delegations (asset-tier-classifier, control-verifier) were attempted but returned empty output after one retry each; findings below rely on direct evidence gathering with noted confidence limitations.

Key finding: the operational governance loop itself has a classification gap — 3 of 12 open CodeQL alerts (#677, #676, #675, all go/allocation-size-overflow in MCP-gateway config generators touched this window) only gained a tracking issue today (#59773), and a near-identical class (4 go/bad-redirect-check alerts) was tracked today as well (#59491) despite being a long-suspected recurring false-positive pattern (#57472). Two older Tier B/C findings — GraphQL-injection-via-Sprintf (#52749, opened 26 days ago) and network-data-to-file (#53737, opened 23 days ago) — remain unremediated past their SLA windows, indicating a patch-velocity gap rather than a detection gap. No repository CODEOWNERS file exists, weakening ownership confidence across all findings.

No new distinct root-cause findings beyond what's already tracked in open issues were identified this run; recommendation is to escalate/consolidate the two oldest stale Tier findings rather than open more parallel tracking issues.

Asset graph summary (recent-change scoped)

Recent-change asset graph (9 surfaces, direct analysis — sub-agent output unavailable)

#	Asset / Component	File(s)	Alerts	Tracking issue(s)	In 7-day window?
1	MCP setup generator	pkg/workflow/mcp_setup_generator.go:146	#677	#59773 (open, today); prior #672 tracked in #58261 (closed)	Yes
2	MCP GitHub config	pkg/workflow/mcp_github_config.go:84	#676, #675	#59773 (open, today)	Yes
3	Package manifest import resolver	pkg/cli/add_package_manifest_imports.go	#674	#59491 (open, today), #57472 (recurring FP pattern)	Yes
4	Package manifest include resolver	pkg/cli/add_package_manifest_includes.go	#667	#59491, #57472	Yes
5	Grader config generator	pkg/workflow/graders_config.go	#669, #668	#59491, #57982, #57472	Yes
6	GitHub Projects CLI (GraphQL)	pkg/cli/project_command.go:269,272	#651, #652	#52749 (open 26 days)	No (0 commits since 2026-09-03)
7	Docs slide-PDF build script	scripts/ensure-docs-slide-pdf.js	#663 (formerly #654)	#53737 (open 23 days)	No
8	README (smoke-test SARIF artifact)	README.md:1	#657	#59774 (open, today); superseded prior #564 tracked in #57981 (still open — alert-number drift)	Ambiguous (artifact of smoke workflow, not repo content)
9	Stale binary-reference alert (hygiene gap)	n/a (binaries removed)	#653	#57728 (open); 6 prior remediation issues already closed	No — process gap only

Ownership note: no .github/CODEOWNERS file exists in this repository — ownership confidence rated Low for all 9 surfaces absent other signals.

Tier classification table

Tier assignments

#	Asset	Tier	Rationale
1–2	MCP config generators (allocation overflow)	C — Restricted Pending Review	Same finding class recurred in a sibling file just days after a prior instance (#672) was remediated — suggests the earlier fix was local, not systemic; feeds workflow/MCP container-config generation broadly.
3–5	Manifest/grader redirect-check alerts	B — Open With Conditions	Long-suspected recurring false positive (#57472); high patchability, but repeated untracked recurrence signals a triage-process weakness rather than a live vulnerability.
6	GraphQL injection via Sprintf	B — Open With Conditions, SLA breach	High patchability/detectability but 26 days open past a 14-day SLA — escalate.
7	Network data written to file (docs build script)	C — Restricted Pending Review, SLA breach	Medium security-severity per CodeQL; 23 days open; low exposure (build-time only) but exceeds review window.
8	README smoke-test SARIF artifact	B — Open With Conditions	Very low real risk (test artifact) but the alert-numbering drift (#564→#657) between tracking issues (#57981/#59774) itself represents a reconciliation gap that should be closed, not left dangling.
9	Stale actionlint/gosec binary alert	C — Restricted Pending Review	Underlying content already removed and remediated 6x elsewhere; this is a pure alert-dismissal hygiene gap contributing to alert fatigue (48 open security-labeled issues total).

Control verification gaps

• Ownership controls — Gap. No .github/CODEOWNERS file exists; every finding above carries "Low" ownership confidence by default.
• SDLC controls — Adequate. CodeQL and multiple recurring automated security-scanning agentic workflows (sighthound, vulnhunter, static-analysis, container-image-scan, domains-audit) run on schedule, giving strong detection coverage — but alert→issue linkage lags (same-day issue creation for [uk-ai-resilience] Three untracked go/allocation-size-overflow alerts in MCP-gateway config generators (Tier C) #59773/[uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B) #59491 despite alerts existing earlier).
• Dependency controls — Not directly assessed this run (no dependency-specific alerts in scope); container-image-scan issues exist in the broader backlog but fall outside the 7-day recent-change and code-scanning-alert focus.
• Secret exposure controls — Strong. 0 open secret-scanning alerts.
• Runtime observability controls — Weak. No evidence of runtime alerting tied to the flagged code paths (e.g., allocation-overflow panics, GraphQL injection); detection relies solely on static CodeQL scanning.
• Recovery / patch-rollback readiness — Mixed. Demonstrated ability to patch (issue [uk-ai-resilience] Untracked code-scanning alert #672 in mcp_setup_generator.go (Tier B) #58261 closed for Hello from Claude #672), but recurrence in a sibling file suggests fixes aren't systemic/reusable; two Tier B/C findings ([uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings) #52749, [uk-ai-resilience] UK AI Governance: untrusted network data written to file in scripts/ensure-docs-slide-pdf.js (Tier C) #53737) remain unpatched well past their stated SLA, indicating patch-velocity risk for lower-priority-looking but SLA-committed items.

Risk-scoring table and rationale

Risk-scoring breakdown

#	Asset	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier
1–2	MCP config generators	Low–Medium	High	Medium (untracked until today)	Medium	Low	C
3–5	Manifest/grader redirect-check	Low–Medium	High	Medium	Medium	Medium	B
6	GraphQL injection (Sprintf)	Low	High	High	Low	Medium	B (SLA breach)
7	Network data to file	Low	High	Low (no runtime alerting)	Low	Medium	C (SLA breach)
8	README smoke-test artifact	Low	High	Low (untracked/mislinked)	Low	Low	B
9	Stale binary alert	Low	High (process fix only)	Low (masked by 48 open issues)	Medium (alert fatigue)	Low	C

Remediation queue with SLAs

1. [uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings) #52749 (GraphQL injection, Sprintf) — Critical/High: 26 days past initial 14-day SLA. Either parameterize the GraphQL query construction or document/verify all interpolated values are compile-time constants, then close.
2. [uk-ai-resilience] UK AI Governance: untrusted network data written to file in scripts/ensure-docs-slide-pdf.js (Tier C) #53737 (network data written to file) — High: 23 days open. Add validation before writing docs-build network response data to disk.
3. [uk-ai-resilience] Three untracked go/allocation-size-overflow alerts in MCP-gateway config generators (Tier C) #59773 / [uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B) #59491 (untracked allocation-overflow & redirect-check alerts) — High: guard size computations with bounds checks / widen types in mcp_setup_generator.go and mcp_github_config.go; land a shared systemic fix (not per-line patches) to prevent recurrence. Triage the 4 redirect-check alerts as a batch against the known false-positive pattern ([uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472) and either land a shared safe-path helper or dismiss with documented rationale.
4. [uk-ai-resilience] Stale code-scanning alert #653 not dismissed despite remediated actionlint/gosec binaries (Tier C) #57728 / [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 / [uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490 (alert-dismissal hygiene) — Medium: reconcile the stale #653 (removed binaries) and any other remediated-but-undismissed alerts; establish a lightweight post-remediation dismissal checklist to prevent recurrence of this hygiene gap.
5. [uk-ai-resilience] Untracked code-scanning alert #657 in README.md — smoke-test alert-numbering drift from #564 (Tier B) #59774 / [uk-ai-resilience] Untracked code-scanning alert #564 in README.md (Tier B) #57981 (alert-numbering drift, README smoke-test artifact) — Medium (14 days): confirm #657 is a smoke-test dummy artifact and dismiss with rationale; consolidate/close the superseded [uk-ai-resilience] Untracked code-scanning alert #564 in README.md (Tier B) #57981 tracking issue.

Exception register

None proposed this run — no permanent or hidden exceptions are warranted; all findings above are either actively patchable or already governed by open, time-bound tracking issues.

Operational metrics baseline

• MTTR proxy: [uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings) #52749 and [uk-ai-resilience] UK AI Governance: untrusted network data written to file in scripts/ensure-docs-slide-pdf.js (Tier C) #53737 are 26 and 23 days open respectively against a 14-day SLA — current MTTR trend exceeds target by ~60-85%.
• Ownership coverage: 0% — no CODEOWNERS file exists repo-wide.
• Unsupported dependency ratio: Not assessed this run (no dependency-specific alerts in the 7-day recent-change scope).
• Exception aging: No open exceptions currently registered.
• Exposure without recovery capability: Low — all 12 open alerts have a demonstrated or clearly available patch path; the risk is patch velocity and alert-dismissal hygiene, not recoverability itself.

Note: asset-tier-classifier and control-verifier sub-agent delegations were attempted (including one retry each) but returned no output; the above synthesis was produced via direct evidence review with correspondingly reduced confidence on ownership/SDLC nuance that those sub-agents would otherwise have supplied.

Generated by UK AI Operational Resilience · copilot · auto · 81.5 AIC · ⌖ 12.5 AIC · ⊞ 8.1K · ◷

• expires on Sep 13, 2026, 7:40 AM UTC-08:00