[uk ai resilience] UK AI Governance: recent-change risk review (2026-09-07 to 2026-09-14)

[github-actions[bot]]

Executive summary

Recent-change-scoped (7-day lookback since 2026-09-07T15:33:33Z; 203 commits, 52 security-signal commits) review of github/gh-aw found 4 open CodeQL/scanner alerts with no matching open tracking issue, breaking the classification → control-verification loop established by prior runs of this workflow. No open secret-scanning alerts. Overall governance posture is functioning (10 of 15 open code-scanning alerts already have tracking-issue coverage from earlier runs), but reconciliation between alert numbers and tracking issues continues to lag by 1–3 days, consistent with the recurring gap flagged in issues #57982/#59490. Two Tier C findings are escalated as new issues below; the workflow's own dispatch of two governance sub-agents (control-verifier, ai-risk-scorer) produced no output on both attempts (including a retry), so risk scoring below reflects direct analysis with reduced confidence on ownership/detectability dimensions — this limitation is recorded rather than concealed.

Asset graph summary (recent-change scoped)

Recent-change asset graph

Segment	Files	Role	Dependencies	Ownership signal
Workflow YAML/AI-execution codegen	pkg/workflow/compiler_yaml_ai_execution.go	Compile-time generation of GitHub Actions workflow YAML for AI execution steps	Go stdlib slice/allocation logic	CODEOWNERS is a single flat global rule (@dsyme @eaftan @pelikhan @krzysztof-cieslak) — no path-specific reviewer, ownership confidence Low-Medium
MCP gateway config generation	pkg/workflow/mcp_cli_mount.go, pkg/workflow/mcp_setup_generator.go, pkg/workflow/mcp_github_config.go	Compile-time generation of MCP container mount/config for agentic workflows	MCP container runtime config	Same flat CODEOWNERS; class already partially tracked in #59773 (Tier C) but one sibling instance (#678) was missed
CLI logs orchestration	pkg/cli/logs_orchestrator_stdin.go	CLI runtime log streaming/orchestration	none directly implicated	Flat CODEOWNERS
Safe-output secret validation / build hygiene	root (test_dup_import, tmp/smoke_test_22524436360.go, {outname}.f), introduced by commit bc736c8 ("Validate external safe-output secrets before activation", #60267)	Build/test artifact hygiene for the safe-output secret-validation feature	.gitignore coverage for compiled binaries/tmp scratch	Flat CODEOWNERS; no automated pre-commit artifact guard evidenced

Recent security-signal commit themes: safe-output entity/log surfacing, GitHub Release safe-output retry/error handling, safe-output temporary-ID propagation into repo memory, external safe-output secret validation (the commit that introduced the stray artifacts below), and recurring weekly/daily agentic report generation.

Tier classification table

Tier classification

Alert	File	Rule	Tier	Tracking issue
#681	pkg/workflow/compiler_yaml_ai_execution.go:92	go/allocation-size-overflow (CWE-190, high)	C — Restricted Pending Review	None — new issue created below
#678	pkg/workflow/mcp_cli_mount.go:378	go/allocation-size-overflow (CWE-190, high)	C — Restricted Pending Review	None — new issue created below (siblings #677/#676/#675 tracked in #59773)
#680	test_dup_import, tmp/smoke_test_22524436360.go, {outname}.f	workflow-out-of-context (Malicious Code Scanner)	B — Open With Conditions	None (recommended as follow-up in remediation queue; not issued this run due to 2-issue cap)
#679	pkg/cli/logs_orchestrator_stdin.go:73	go/useless-assignment-to-field (CWE-563, quality-only)	A — Open Safe	None needed (low risk, quality-only)
#677/#676/#675	mcp_setup_generator.go / mcp_github_config.go	go/allocation-size-overflow	C	#59773 (open)
#674/#669/#668/#667	add_package_manifest_*.go, graders_config.go	go/bad-redirect-check	B	#59491 (open)
#663	scripts/ensure-docs-slide-pdf.js:197	js/http-to-file-access (medium)	C	#53737 (open, references prior alert #654 — numbering drift)
#657	README.md	smoke-test dummy	B	#59774 (open)
#652/#651	pkg/cli/project_command.go	go/graphql-injection-sprintf	B	#52749 (open)

Control verification gaps

• Ownership controls — gap. CODEOWNERS is a single flat, repo-wide rule with no path-specific reviewers for pkg/workflow/, pkg/cli/, or scripts/; ownership confidence is Low-Medium for every finding in this report.
• SDLC controls — gap. Commit bc736c8 merged three stray build/test artifacts (a 2.3MB compiled binary, a "safe to remove" smoke-test placeholder, and a broken-template empty file) directly to main without being caught pre-merge; no .gitignore rule currently blocks compiled Go test binaries or tmp/ scratch files.
• Dependency controls — not directly implicated in this run's findings; no dependency-version alerts in scope.
• Secret exposure controls — adequate. 0 open secret-scanning alerts.
• Runtime observability controls — partial gap. CodeQL/Semgrep/custom scanners are correctly detecting these issues, but alert-to-tracking-issue reconciliation lags (4 alerts untracked this run; alert-numbering drift previously noted in [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982/[uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490/[uk-ai-resilience] Untracked code-scanning alert #657 in README.md — smoke-test alert-numbering drift from #564 (Tier B) #59774). Both risk-scoring sub-agent invocations (control-verifier, ai-risk-scorer, each retried once) returned no output — a supplementary agent-tooling reliability gap is recorded here rather than papered over.
• Recovery controls — adequate. All four untracked findings are trivially patchable (bounds-check/widen intermediate type to uint64; git rm + .gitignore entry; remove dead assignment) with no rollback complexity.

Risk-scoring table and rationale

Risk scoring

Finding	Exposure Amp.	Patchability	Detectability	Op. Fragility	Ownership Conf.	Tier	Rationale
#681 (compiler_yaml_ai_execution.go)	Low–Medium	High	Medium	Medium	Low-Medium	C	Feeds workflow-YAML generation for all AI execution steps; overflow-triggered panic/undersized allocation could affect generated workflows repo-wide, but exploitation requires attacker-controlled huge input at codegen time.
#678 (mcp_cli_mount.go)	Low–Medium	High	Medium	Medium	Low-Medium	C	Same CWE-190 class as already-tracked siblings in #59773, but this specific instance is untracked, degrading confidence in the reconciliation loop for MCP config generation.
#680 (stray artifacts)	Low	High	Low	Low	Low-Medium	B	Tool's own threat score is 3/10 (binary is a benign 2-line hello-world with no network/exec symbols); real risk is process hygiene (unreviewed build artifacts landing on main), not exploitation.
#679 (useless assignment)	Low	High	Medium	Low	Low-Medium	A	Quality-only CWE-563 finding, not security-tagged; dead code, no exploit path.

Remediation queue with SLAs

Priority	Item	Action	SLA
Critical	#678 mcp_cli_mount.go:378	Bounds-check or widen size computation to uint64/int64 before slice-length conversion; add regression test for large/edge-case input; verify alert transitions to fixed before closing	7 days
Critical	#681 compiler_yaml_ai_execution.go:92	Same overflow-guard pattern as above; add regression test	7 days
Medium	#680 stray artifacts	git rm test_dup_import "tmp/smoke_test_22524436360.go" "{outname}.f"; add .gitignore rules for compiled Go test binaries and tmp/ scratch files; audit the commit bc736c8 process for why these were committed	14 days
Low	#679 logs_orchestrator_stdin.go:73	Remove or fix the dead assignment to the Message field	30 days

Exception register

None required this run — all findings have a clear, low-effort remediation path; no temporary-hidden-repo or long-lived exceptions requested.

Operational metrics baseline

• MTTR proxy: alert-to-tracking-issue reconciliation currently lags 1–3 days across recent runs (e.g. rename to correct terminology #680/Hello from Claude #681/better logging of safe outputs #679/E2E test status #678 created 2026-09-11–09-12, still untracked as of this run's cutoff).
• Ownership coverage: 0% path-specific CODEOWNERS coverage for implicated segments (flat global rule only).
• Unsupported dependency ratio: not applicable — no dependency-version findings in scope this run.
• Exception aging: 0 active exceptions.
• Exposure without recovery capability: 0 findings — all four untracked items have a documented, high-patchability remediation path.

Sub-agent note: both control-verifier and ai-risk-scorer were dispatched and retried once each per the orchestration contract; both returned empty responses on every attempt. This report reflects direct evidence-based analysis in their place, with reduced confidence flagged above where those agents would normally have supplemented ownership/detectability scoring.

Generated by UK AI Operational Resilience · copilot · auto · 82.3 AIC · ⌖ 8.97 AIC · ⊞ 8.2K · ◷

• expires on Sep 17, 2026, 7:44 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #61164.