[uk ai resilience] UK AI Open Code Risk & Resilience Governance — Weekly Review (2026-09-22)

[github-actions[bot]]

Executive summary

Recent-changes-scoped review (7-day lookback, since 2026-09-15) across 83 commits, 274 open code-scanning alerts, 59 open security-tracking issues, and 0 open secret-scanning alerts. Governance discipline is strong: the vast majority of notable (non-bulk) code-scanning alerts are already individually tracked by prior uk-ai-resilience issues with tier classification, risk-scoring, and remediation actions. One genuine new gap was identified — a recurrence of a previously "remediated" finding — plus two pre-existing systemic gaps (CODEOWNERS absence, alert-dismissal hygiene) that remain open and continue to erode operational resilience metrics.

Note on sub-agent orchestration: the asset-tier-classifier and control-verifier sub-agents both failed twice with a backend model-access error (gpt-5.4-mini not accessible). Per guardrails, this report proceeds with direct evidence-based synthesis; sub-agent structured outputs are unavailable this run and this limitation is recorded rather than concealed.

Asset graph summary (recent-change scoped)

Recent-changes asset graph (83 commits, 7-day window)

Segment	Files/Areas	Change signal	Preliminary tier
Go workflow compiler	pkg/workflow/compiler_yaml_ai_execution.go, mcp_cli_mount.go, mcp_setup_generator.go, mcp_github_config.go, graders_config.go	Active edits; 5 go/allocation-size-overflow + 2 go/bad-redirect-check alerts	B/C (tracked)
CLI package-manifest tooling	pkg/cli/add_package_manifest_imports.go, add_package_manifest_includes.go, logs_orchestrator_stdin.go, project_command.go	go/bad-redirect-check, go/useless-assignment-to-field, GraphQL-sprintf warnings	B/C (tracked)
Docs build tooling	scripts/ensure-docs-slide-pdf.js	js/http-to-file-access — recurrence at same location as a prior closed finding	C (new gap — see below)
Container base image	root Dockerfile (alpine:3.24, unpinned)	High-severity SHA-pinning gap	B (tracked, #61166)
GitHub Actions workflows (generated .lock.yml)	246 alerts across dozens of workflows	Bulk npm/uv-pip install non-determinism	B (tracked, #61636)
Dependency supply chain	gh-aw-firewall v0.28.17→22, MCP Gateway v0.4.25, go-sdk 1.7.0→1.8.0	Frequent, incremental pinned-version bumps (healthy cadence)	A
Release-workflow credentials	GitHub App token minting (added+reverted in-window)	No documented sign-off note on revert	C (tracked, #60296)
Ownership/governance	Repo-wide (no .github/CODEOWNERS)	~95% automation-authored commit volume with single informal human reviewer	B (tracked, #61637)

Ownership signal: of 83 commits in-window, 53 are Copilot-authored, 25 are github-actions[bot], 3 by a named human maintainer, 2 by dependabot — consistent with prior findings that review redundancy depends on one individual's Co-authored-by presence rather than an enforced CODEOWNERS mapping.

Tier classification table

Tier classification (this run)

Tier	Count	Examples
A — Open Safe	1	Dependency-bump cadence (firewall/go-sdk)
B — Open With Conditions	3 (all pre-tracked)	CODEOWNERS gap (#61637), Dockerfile pinning (#61166), bulk npm/uv-pip non-determinism (#61636)
C — Restricted Pending Review	2 (1 new, 1 pre-tracked)	New: alert #663 recurrence; App-token-minting revert sign-off gap (#60296)
D — Decommission Candidate	0	None identified this run

Control verification gaps

• Ownership controls: Confirmed absent .github/CODEOWNERS; already tracked ([uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637, Tier B). No new evidence changes this status.
• SDLC controls: Recurrence of alert [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #663 at the same file/rule as a prior "remediated" alert ([Custom Engine Test] Test Issue Created by Custom Engine #654, closed under [uk-ai-resilience] UK AI Governance: untrusted network data written to file in scripts/ensure-docs-slide-pdf.js (Tier C) #53737) indicates the fix for [Custom Engine Test] Test Issue Created by Custom Engine #654 did not include a regression guard/test, allowing the same untrusted-write pattern to reappear. This is a live SDLC verification gap, not just a hygiene gap.
• Dependency controls: Healthy — frequent small-increment pinned-version bumps for gh-aw-firewall (0.28.17→0.28.20→0.28.22) and go-sdk (1.7.0→1.8.0) via Dependabot/automation, each traceable to a specific PR.
• Secret exposure controls: 0 open secret-scanning alerts — clean, but this reflects detection coverage at scan time only, not a guarantee of absence.
• Runtime observability controls: No evidence of automated re-verification that a closed tracking issue's underlying alert actually stays dismissed — this is the same gap already flagged in [uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490/[uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 (alert-dismissal hygiene) and is the root cause enabling the [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #663 recurrence to go undetected until this run.
• Recovery controls: The App-token-minting revert ([uk-ai-resilience] GitHub App token minting for release workflow added and reverted without documented security sign-off (Tier C [Content truncated #60296) demonstrates functioning rollback capability (bad change reverted within the window), but lacks a documented sign-off trail — a process gap, not a technical one.

Risk-scoring table and rationale

Risk scoring — new/changed findings this run

Finding	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Tier
Alert #663 recurrence (js/http-to-file-access, ensure-docs-slide-pdf.js:197)	Low (docs build script, not user-facing runtime)	High (validate/checksum response before write)	Low (no regression test exists; only re-detected by code scanning)	Medium (recurrence proves fragility in remediation-verification loop)	Medium	C

Rationale: identical rule/file class as a previously closed alert (#654/#53737) recurring at a new alert number (#663) with no new tracking issue is direct evidence that the prior fix either didn't add durable validation or was reverted/bypassed. This breaks the classification → control-verification → remediation loop the governance model depends on.

Remediation queue with SLAs

Priority	Finding	Action	SLA
High	Alert #663 recurrence	Re-apply/verify content validation (content-type check, size limit, checksum) in scripts/ensure-docs-slide-pdf.js; add a regression test or lint rule to prevent silent regression	High
Medium (existing)	CODEOWNERS gap (#61637)	Add .github/CODEOWNERS for pkg/workflow/, pkg/cli/, workflow sources, Dockerfile	Medium
High (existing)	App-token-minting sign-off (#60296)	Document revert rationale; require sign-off before re-attempting	High
Medium (existing)	Bulk npm/uv-pip non-determinism (#61636)	Batch-fix lockfile pinning across affected workflows	Medium

Exception register

None — no new or existing time-boxed exceptions were identified as warranted this run. All open findings have active remediation paths; no permanent hidden-repo or scope exceptions are recommended.

Operational metrics baseline

• MTTR proxy: Not directly measurable this run (sub-agent scoring unavailable); qualitatively, most notable alerts already have tracking issues opened within days of alert creation — good triage velocity, but alert [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #663 shows a case where "closed" tracking issues do not guarantee the underlying alert stays resolved.
• Ownership coverage: 0% formal (no CODEOWNERS); ~100% informal (single-maintainer co-authorship pattern across automation-heavy commits).
• Unsupported dependency ratio: No unsupported/EOL dependencies identified in this window; all bumps observed are supported, pinned upgrades.
• Exception aging: N/A — no active exceptions this run.
• Exposure without recovery capability: Low — the one credential-sensitive change in-window (App token minting) was successfully reverted, demonstrating functioning recovery capability even though sign-off documentation lagged.

---

Generated by UK AI Open Code Risk & Resilience Governance workflow. Sub-agent structured scoring (asset-tier-classifier, control-verifier) was unavailable this run due to a backend model-access error after 2 retry attempts; findings above are synthesized directly from precomputed evidence files.

Generated by UK AI Operational Resilience · copilot · auto · 81.6 AIC · ⌖ 7.77 AIC · ⊞ 7.9K · ◷

• expires on Sep 25, 2026, 7:42 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #62980.