[uk ai resilience] UK AI Governance: recent-change risk review (2026-09-17 to 2026-09-24)

[github-actions[bot]]

Executive summary

7-day recent-change sweep (2026-09-17 → 2026-09-24, 109 commits, 44 security-signal commits) found no new untracked risk: all 272 open code-scanning alerts and 0 open secret-scanning alerts already have open, dated uk-ai-resilience tracking issues from prior governance cycles. The governance loop's classification step is therefore healthy. The one persisting operational gap is in recovery/closure hygiene: three alerts (#669, #668, #667) remain open in code scanning despite tracking issues (#57472, #54037, #59491) asserting the underlying go/bad-redirect-check finding is a false positive — and source inspection confirms the proposed shared safe-path-validation helper has still not been implemented. No new issues are created this run to avoid duplicating the 62 open security issues already covering every current finding; this report instead re-confirms and dates the evidence for the existing dismissal-hygiene tracking issues (#57982, #59490) and the redirect-check remediation issue (#59491).

Note: the asset-tier-classifier and control-verifier sub-agents failed twice on an infrastructure model-access error (gpt-5.4-mini not accessible, unrelated to this repo's content) and could not be re-run; findings below were compiled directly from the pre-computed evidence files and direct source/issue inspection, so confidence on the asset-graph and control-verification sections is slightly reduced (recorded as a limitation, not fabricated).

Asset graph summary (recent-change scoped)

Segment	Touched this window	Tier hypothesis	Rationale
pkg/workflow/* (compiler: mcp_*.go, compiler_yaml_ai_execution.go, graders_config.go)	Yes	C	Allocation-overflow / redirect-check CodeQL findings in actively-changed generator code (#59773, #60875, #59491)
pkg/cli/* (add_package_manifest*.go, project_command.go, logs_orchestrator_stdin.go)	Yes	B/C	Bad-redirect-check + useless-assignment + GraphQL-construction findings, all tracked (#59491, #52749, #61821)
.github/workflows/*.lock.yml (254 generated files)	Indirect (compiler-generated)	B	254 install-determinism alerts from one compiler fix point (#61636)
Root Dockerfile	Yes	B	Unpinned alpine:3.24 base (#61166, alert #940)
scripts/ensure-docs-slide-pdf.js	Yes	C	Untrusted network data to file (#62692, #53737)
README.md	Yes	B	Smoke-test alert-numbering drift (#59774)
.changeset/* (694 files)	Yes (high volume)	A	Routine SDLC artifact, no direct risk signal
.github/CODEOWNERS (absent)	N/A — structural gap	B	No owner routing for alert dismissal (#61637)

Ownership is inferred from commit authorship only (no CODEOWNERS): recent window dominated by Copilot/copilot-swe-agent[bot] commits co-authored by pelikhan, plus gh-aw-bot/github-actions[bot] automation merges.

Control verification gaps

• Ownership controls — Gap. No .github/CODEOWNERS (confirmed via direct ls); tracked in [uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637 (Tier B).
• SDLC controls — Adequate/Partial. 694 .changeset/* files and consistent co-authorship trailers indicate disciplined change tracking, but the volume makes manual review of each security-relevant diff impractical without owner routing.
• Dependency controls — Gap. 254 npm/uv-pip non-deterministic install alerts trace to one compiler fix point ([uk-ai-resilience] Untracked npm-install/uv-pip-install non-determinism across 256 code-scanning alerts (Tier B) #61636); root Dockerfile base image unpinned ([uk-ai-resilience] Untracked Dockerfile SHA-pinning gap: root Dockerfile alpine:3.24 unpinned (alert #940, Tier B) #61166).
• Secret exposure controls — Adequate signal, unverified coverage. 0 open secret-scanning alerts; treated as a positive signal but not proof of full scanning coverage across all generated artifacts.
• Runtime observability — Adequate. OTEL/telemetry code present across ~26 files in pkg/workflow, indicating baseline observability instrumentation exists for the compiler pipeline.
• Recovery controls — Gap (confirmed, recurring). Alerts [Custom Engine Test] Test Issue Created by Custom Engine #669, Codex fails to report failure if unauthorised #668, [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667 remain open despite tracking issues ([uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472, [uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037) asserting remediation/false-positive status; direct source grep confirms no shared isSafeRelativePath-style helper exists in pkg/cli or pkg/workflow. This is the same gap raised in [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982 and [uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490, now confirmed still present ~3 weeks later. One partial improvement: alert #653 (previously flagged as stale in [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982) is no longer in the open-alerts list, suggesting some dismissal hygiene progress has occurred.

Risk-scoring table

Area	Exposure amp.	Patchability	Detectability	Op. fragility	Ownership conf.	Tier
npm/uv-pip install non-determinism (254 alerts)	High	High	High	Medium	Medium	B
go/bad-redirect-check recurrence + missing shared helper	Low-Med	High	Medium	Medium	Low	B
Alert-dismissal hygiene gap (#669/#668/#667 open vs. claimed-fixed)	Medium	High	Low (silent staleness)	High	Medium	C
Dockerfile unpinned base image	Low-Med	High	High	Low	Low	B
Missing CODEOWNERS	Low	High	High	Low	Low	B
go/allocation-size-overflow cluster (MCP generators)	Low-Med	High	High	Medium	Low	C
GraphQL query construction (project_command.go)	Low	Medium	Medium	Low	Medium	C

Remediation queue with SLAs (all already tracked — no new issues opened)

Priority	Item	Tracking issue	SLA
Critical/High	Compiler-level fix for npm/uv-pip install determinism	#61636	High
High	Verify + dismiss #669/#668/#667 or land shared safe-path helper	#59491 (+ #57982, #59490)	High
High	Add automated check: alert-state vs. tracking-issue-state before issue closure	#57982	High
Medium	Pin Dockerfile base image to SHA256 digest	#61166	Medium
Medium	Add .github/CODEOWNERS for compiler/CLI security paths	#61637	Medium
Medium	Triage MCP-generator allocation-overflow cluster (#678/#677/#676/#675)	#60876	Medium
Low	GraphQL query parameterization review	#52749	Low

Exception register

No new exceptions proposed this run. Existing accepted-risk candidate (pending, not yet formalized): pinned-version-only installs for AI engine CLIs as a temporary mitigation for the npm/uv-pip determinism cluster, per #61636 — requires an explicit expiry date and mitigation plan before being treated as a governed exception; currently informal.

Operational metrics baseline

• MTTR proxy: degraded by the confirmed dismissal-hygiene gap — alerts believed fixed ([Custom Engine Test] Test Issue Created by Custom Engine #669/Codex fails to report failure if unauthorised #668/[Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667) remain open 3+ weeks after remediation issues were opened.
• Ownership coverage: 0% formal (no CODEOWNERS); informal coverage via commit co-authorship only.
• Unsupported/non-deterministic dependency ratio: 254/272 (93%) of open code-scanning alerts are install-determinism findings from one root cause.
• Exception aging: 0 formal exceptions currently registered (none to age).
• Exposure without recovery capability: Low — all findings have active tracking issues; the gap is in closure verification, not detection or ownership assignment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

Generated by UK AI Operational Resilience · copilot · auto · 86.7 AIC · ⌖ 18.5 AIC · ⊞ 7.9K · ◷

• expires on Sep 27, 2026, 7:42 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #63464.