[uk ai resilience] UK AI Governance: recent-change risk review (2026-09-04 to 2026-09-11)

[github-actions[bot]]

Executive summary

Recent-changes lookback (7 days, since 2026-09-04T15:31:26Z): 219 commits, 51 flagged as security-signal. No new exploitable code risk was identified. The dominant operational-resilience issue is governance-loop drag, not live vulnerability exposure: the alert-dismissal hygiene gap first raised on 2026-08-31 (#57982) and reaffirmed weekly since (#59490) is still unresolved — three CodeQL alerts continue to sit open despite tracking issues asserting remediation, and this run adds further untracked-alert drift on top of it. One reversed same-day change (GitHub App token minting for the release workflow, #60214 → reverted #60218) is a useful rollback-readiness positive signal but also flags that credential-minting changes are shipping and reverting without a visible external review gate. Zero secret-scanning alerts remain open. 14 code-scanning alerts remain open; none newly introduced this week represent high-severity live risk — most are recurring low/medium false-positive or hygiene-process items already tracked in prior [uk-ai-resilience] issues.

Per UK gov guidance (open code + vulnerability risk in the public sector), the recommended posture is transparency and fast remediation over concealment — that is reflected below: no repository/branch hiding is recommended; findings are routed to visible tracking issues with SLAs.

Asset graph summary (recent-change scoped)

Recent-change asset graph

Area	Recent activity	Runtime surface	Dependencies
Safe-outputs pipeline	External secret validation before activation (#60267); additive global body footers (#60275); replace_label handler registration	Safe-output collect/dispatch jobs in compiled Actions workflows	safeoutputs MCP
Enclave / dynamic-enclave runtime	MCP policy + lifetime wiring (#59524); TTL unit fixes (#59290/#59292); delegation controller wiring (#59046); forcePublicRepos disabled for enclave-only GitHub MCP backends (#60016)	Sandboxed agent execution enclaves	gh-aw-firewall v0.28.15 (bumped #60020)
MCP gateway / config generators	mcp_setup_generator.go, mcp_github_config.go, mcp_cli_mount.go — allocation-size CodeQL alerts (#675-#678); GitHub server guard policy fix (#59816); routing fix in sandbox host-access mode (#58595)	MCP tool wiring for compiled workflows	gh-aw-mcpg
Package-manifest import/include guards	add_package_manifest_imports.go, add_package_manifest_includes.go, graders_config.go — recurring go/bad-redirect-check alerts (#667-#674), long-documented as false positives (#57472)	CLI compile-time manifest resolution	none external
Credential/token minting	GitHub App token minting for release workflow added (#60214) then reverted same window (#60218); Agent Plugin checkout allows runtime-retrieved credentials (#59744); checkout token permission preservation (#59743)	Release automation, checkout auth	GitHub App tokens
Logs / cache pipeline	Workflow run discovery caching in JSONL (#59988); cache budget enforcement with selective pruning (#59049)	Log ingestion/audit tooling	none external
GraphQL query construction	pkg/cli/project_command.go — workflow-go-graphql-injection-sprintf alerts #651/#652, tracked since #52749 (Tier B, low exposure)	CLI project automation	GitHub GraphQL API
Docs/build tooling	scripts/ensure-docs-slide-pdf.js — network data written to file (#663), tracked in #53737	Docs build pipeline	none external

Ownership signal: authorship this week is dominated by the Copilot coding agent (automated PRs) with pelikhan as primary human reviewer/maintainer — consistent with prior weeks. No CODEOWNERS-specific gaps newly observed, but repeat [uk-ai-resilience] issues note "Ownership confidence: Low/Medium" for several of the above files, consistent with automation-heavy authorship and no dedicated file-level owners.

Tier classification table

Tier classification (recent-change scoped)

Area	Tier	Rationale
Safe-outputs secret validation / body footers	A — Open Safe	Defensive hardening merged this week, no open alerts against it
Enclave/dynamic-enclave runtime	B — Open With Conditions	Active churn (TTL unit bugs fixed twice in 3 days) signals fragility; no open alerts but low test-maturity signal
MCP gateway config generators (allocation-size-overflow)	C — Restricted Pending Review	3 open CWE-190 alerts in actively-changed files, previously partially tracked (#58261) but new instances untracked until this run
Package-manifest guards (bad-redirect-check)	B — Open With Conditions	Long-running, well-documented false positive (#57472); low exposure but dismissal process incomplete
Credential/token minting (App token mint add+revert)	C — Restricted Pending Review	Same-week ship+revert of a credential-minting change with no visible external security sign-off artifact
GraphQL query construction (project_command.go)	B — Open With Conditions	Tracked since #52749, low exposure, still open — parameterization not yet landed
Docs build network-to-file (ensure-docs-slide-pdf.js)	B — Open With Conditions	Tracked in #53737, low severity, unresolved for >1 week
Logs/cache pipeline hardening	A — Open Safe	Budget enforcement and pruning are net-positive resilience changes

Control verification gaps

• Ownership controls — Partial. Automation-heavy authorship (Copilot coding agent) with single human maintainer review; no evidence of per-area CODEOWNERS for enclave runtime, MCP gateway config, or credential-minting paths.
• SDLC controls — Verified (with caveat). Widespread .changeset/*.md usage indicates consistent changeset discipline across the sampled commit range; PRs are merged individually (not squash-averaged), suggesting standard review gates are in use. Caveat: could not confirm required-review-count enforcement from available data.
• Dependency controls — Verified. gh-aw-firewall bumped to a pinned version (v0.28.15, Bump gh-aw-firewall to v0.28.15 #60020) rather than floating; consistent with prior weeks' pinned-bump pattern.
• Secret exposure controls — Partial/Gap. Positive: "Validate external safe-output secrets before activation" (Validate external safe-output secrets before activation #60267) is a proactive control. Gap: GitHub App token minting for the release workflow was added (Add GitHub App token minting for release workflow #60214) and reverted within the same window (Revert GitHub App token minting for release tags #60218) with no visible external security review artifact referenced in the commit trail — this is exactly the kind of credential-adjacent change that should carry a documented sign-off before merge, even if quickly reverted.
• Runtime observability controls — Verified. OTLP endpoint scheme-only authorization header guard (Guard OTLP endpoints against scheme-only authorization headers #59315), debug logging added to audit command dispatch ([log] Add debug logging to audit command dispatch #59357), and logs-cache budget/pruning enforcement (Enforce logs cache budgets with selective pruning #59049) all indicate active observability investment this week.
• Recovery controls — Gap. The alert-dismissal hygiene gap is now tracked across three consecutive weekly issues ([uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472 → [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 → [uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490) with no resolution — process remediation (reconciling CodeQL dismissal state with tracking-issue closure) has stalled for 2+ weeks despite being flagged as "high patchability, process fix only."

Risk-scoring table and rationale

AI-aware risk scoring (high-priority changed areas)

Area	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Overall
MCP gateway allocation-size-overflow (3 alerts)	Low	High	High (CodeQL)	Low	Low	Low-Medium
Package-manifest bad-redirect-check (4 alerts)	Low	High	High (CodeQL)	Low	Medium	Low
Credential/token minting add+revert	Medium	High	Medium (git history only)	Medium	Medium	Medium
GraphQL injection-sprintf (project_command.go)	Low	High	High (CodeQL)	Low	Medium	Low
Alert-dismissal hygiene gap (process)	Medium	High	High (self-reported)	Medium	Low	Medium
Docs build network-to-file	Low	High	High (CodeQL)	Low	Medium	Low

Remediation queue with SLAs

#	Area	Action	SLA
1	Alert-dismissal hygiene process	Reconcile CodeQL alert dismissal state with tracking-issue closure workflow; add an automated check that fails when a tracking issue closes but its referenced alert stays open	High — 2 weeks (already overdue per #57982/#59490 cadence)
2	MCP gateway allocation-size-overflow (#675-#678)	Bound/validate size computations in mcp_setup_generator.go:146 and mcp_github_config.go:84 before allocation, or add explicit overflow-safe helpers	Medium — 2 weeks
3	Credential/token minting add+revert (#60214/#60218)	Document the reason for revert and require an explicit security sign-off note in the PR description before re-attempting App token minting for release workflow	High — next attempt only
4	Package-manifest bad-redirect-check (#667/#668/#669/#674)	Either add CodeQL suppression comments with justification or refactor redirect-check helper to satisfy the analyzer, closing the recurring false-positive loop	Medium — 3 weeks
5	GraphQL injection-sprintf (#651/#652)	Parameterize GraphQL query construction in project_command.go instead of fmt.Sprintf string building	Low — 4 weeks (tracked since 2026-08-14, still open)

Exception register

None active. No permanent hidden-repo or long-lived suppression exceptions are recommended; all open alerts above should remain visible and tracked to closure.

Operational metrics baseline

• MTTR proxy: Alert-dismissal hygiene gap unresolved for 3+ consecutive weekly runs ([uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472 opened ~2026-08-24, still open) — indicates >14 day proxy MTTR for process-class findings.
• Ownership coverage: No CODEOWNERS-level evidence found for enclave runtime, MCP gateway config, or credential-minting code paths — Low coverage confidence.
• Unsupported dependency ratio: Not directly measurable this run; gh-aw-firewall dependency shows disciplined pinned-version bump cadence (v0.28.15 this week).
• Exception aging: 0 active exceptions (register empty) — no aging risk.
• Exposure without recovery capability: 1 case flagged (credential/token minting add+revert) where rollback worked but no documented review artifact confirms recovery was a deliberate, reviewed decision vs. reactive patch.

Generated by UK AI Operational Resilience · copilot · auto · 92.2 AIC · ⌖ 12.7 AIC · ⊞ 8.1K · ◷

• expires on Sep 14, 2026, 7:40 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #60874.