[uk ai resilience] UK AI Open Code Risk & Resilience Review — 2026-09-25 (recent-changes cycle)

[github-actions[bot]]

Executive summary

This cycle's recent-changes scan (7-day lookback, 2026-09-18 to 2026-09-25) covered 117 commits (51 flagged for auth/token/secret/permission/firewall/sandbox keywords), 62 open security-labelled issues, 275 open code-scanning alerts, and 0 open secret-scanning alerts. Two of the three planned sub-agents (asset-tier-classifier, control-verifier) failed twice with a backend model-access error (model not accessible via the chat endpoint); this report proceeds with partial confidence, built from direct gh/git/jq evidence in place of sub-agent synthesis. No ai-risk-scorer dispatch was attempted given the prior two failures — scoring below is derived manually from the same dimensions.

The repository shows no new secret leaks and a healthy volume of CI/dependency hygiene commits, but recent changes touched 10 Go compiler/CLI source files that already carry (or newly surface) high-severity CodeQL findings (go/allocation-size-overflow, go/bad-redirect-check, workflow-go-graphql-injection-sprintf), plus a systemic, well-tracked npm-install non-determinism gap spanning roughly 80 compiled workflow lockfiles (issue #61636). Ownership control is weak: repository-root CODEOWNERS exists but has no path-scoped rules — it names four global owners only, with no entries for pkg/workflow/, pkg/cli/, Dockerfile, or scripts/, matching the already-open gap in issue #61637. Recovery posture is mixed: dependency updates flow through Dependabot weekly across nine ecosystems (good), but a recurring pattern of "untracked/stale code-scanning alert" issues (the uk-ai-resilience label series) shows remediation velocity lagging alert creation — several Tier B/C findings from prior cycles remain open.

Recommendation: prioritize closing the CODEOWNERS gap (unblocks ownership-confidence scoring repo-wide) and land two new, specific untracked-alert issues for the highest-severity, most recently-touched files (experiments_command.go, mcp_github_config.go) rather than opening broader duplicate tracking of the already-covered systemic npm-install and Dockerfile gaps.

Asset graph summary (recent-change scoped)

Recently-changed assets with security-relevant alerts (top 15)

#	Path	Area	Alert rule(s)	Severity	Tier hyp.
1	pkg/cli/experiments_command.go	CLI experiments cmd	go/allocation-size-overflow (#942, #943 - untracked)	high	C
2	pkg/workflow/mcp_github_config.go	MCP GitHub server config gen	go/allocation-size-overflow (#675, #676 - untracked)	high	C
3	pkg/cli/project_command.go	CLI project cmd, GraphQL query build	workflow-go-graphql-injection-sprintf (tracked, #52749)	high	B
4	pkg/workflow/graders_config.go	Grader/evaluator compiler	go/bad-redirect-check (#668, #669)	medium	B
5	pkg/workflow/github_app_requirements.go	GitHub App auth/permission compiler	go/bad-redirect-check (#941)	medium	B
6	pkg/cli/add_package_manifest_includes.go / _imports.go	Package manifest/import resolution	go/bad-redirect-check (tracked sibling, #54037)	high	B
7	pkg/workflow/mcp_setup_generator.go	MCP setup generation	go/allocation-size-overflow (tracked, #58261)	high	B
8	pkg/workflow/mcp_cli_mount.go	MCP CLI mount config	go/allocation-size-overflow (tracked, #60876)	high	C
9	pkg/workflow/compiler_yaml_ai_execution.go	Core YAML-to-AI-execution compiler	go/allocation-size-overflow (tracked, #60875)	high	C
10	pkg/cli/logs_orchestrator_stdin.go	Logs orchestration stdin	go/useless-assignment-to-field (tracked, #61821)	high	C
11	.github/workflows/*.lock.yml (~80 files)	Compiled workflow lockfiles	npm-install-non-deterministic (tracked, #61636)	high	B
12	Dockerfile (root)	Base image	dockerfile-non-sha-pinned-image (tracked, #61166)	high	B
13	scripts/ensure-docs-slide-pdf.js	Docs build script	js/http-to-file-access (tracked, #62692)	medium	C
14	README.md	Docs / alert-numbering drift	workflow-security-finding-1 (tracked, #59774/#57981)	low	B
15	Token/sandbox commit cluster (#62416, #62722, #62668, #63034, #63014, #63035, #62944)	CI trigger tokens, step-output tokens, sandbox runtime removal	no open alert; process/behavior change	n/a	B (needs SDLC follow-up)

Ownership note: CODEOWNERS lists only four global owners repo-wide, with zero path-scoped rules — every asset above currently maps to the same generic ownership signal, which is itself the Tier B finding in #61637.

Tier classification table

Tier assignments

Tier	Definition	Assets in this cycle
A - Open Safe	No material gap	none identified this cycle
B - Open With Conditions	Tracked gap, remediation path known, needs SLA	items 3, 5, 6, 7, 11, 12, 14, 15
C - Restricted Pending Review	Untracked or recurring/stale gap, needs active review	items 1, 2, 8, 9, 10, 13
D - Decommission Candidate	none identified this cycle	none

Control verification gaps

• Ownership controls: CODEOWNERS exists at repo root but has no path-scoped entries for pkg/workflow/, pkg/cli/, Dockerfile, or scripts/ - confirmed by direct file read. This matches open issue [uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637 and is the single largest ownership-confidence gap found.
• SDLC controls: Could not verify branch-protection API (403 - insufficient token scope for this read-only run). Weekly Dependabot cadence exists across nine ecosystems (github-actions, gomod, npm x3, pip, docker x2) per .github/dependabot.yml - a positive SDLC/dependency signal.
• Dependency controls: The npm-install non-determinism finding is systemic (244 of 275 open alerts, about 89 percent) but already tracked in [uk-ai-resilience] Untracked npm-install/uv-pip-install non-determinism across 256 code-scanning alerts (Tier B) #61636 (Tier B) - no new issue needed; this is a compiler-output pattern (compiled lock.yml files lack ci/hash-pinned installs) rather than a source-manifest problem.
• Secret exposure controls: 0 open secret-scanning alerts. Recent commits show active hardening work (step-output token secret fallbacks Allow step-output GitHub tokens with secret fallbacks #62722, CI-trigger-token scoping Add github-token-for-extra-empty-commit: none to keep GH_AW_CI_TRIGGER_TOKEN out of compiled workflows #62416, push-to-PR-branch token retry push_to_pull_request_branch: retry transient workflows-scope timeout on the primary push path #62668) - good remediation-in-progress signal, no new gap found.
• Runtime observability controls: Recent commits added audit/threat-detection improvements (stable finding codes Audit threat-detection results with stable finding codes #62753, gateway steering event reporting Report gateway steering events in audit output #62943, container image override handling for threat-detection Honor container image overrides in threat-detection jobs #63014) - observability posture is actively improving.
• Recovery controls: Mixed. Positive: rapid iteration on CI/token issues within the window. Negative: multiple uk-ai-resilience tracking issues ([uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490, [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982) explicitly flag alert-dismissal hygiene gaps - CodeQL alerts remaining open despite remediated or closed tracking issues - indicating remediation closure lags remediation action.

Risk-scoring table and rationale

Manual risk scoring (sub-agent unavailable - partial confidence)

Asset	Exposure amplification	Patchability	Detectability	Operational fragility	Ownership confidence	Tier
experiments_command.go (#942/#943)	Med - CLI-local, not network-facing	High - simple bounds check	High - CodeQL flags it	Low	Low (no path CODEOWNERS)	C
mcp_github_config.go (#675/#676)	Med-High - feeds MCP server config used by agent runtime	High	High	Med - config-generation path	Low	C
project_command.go (GraphQL sprintf, #52749)	High - GraphQL query injection surface	Med	High	Med	Low	B (already tracked)
npm-install non-determinism (~80 lockfiles)	High - supply-chain, systemic	Med - requires compiler template fix	High - flagged repeatedly	High (compounds each compile)	Low	B (tracked #61636)
Dockerfile unpinned base image	Med	High - single-line pin	High	Low	Low	B (tracked #61166)

Rationale: the two untracked findings (experiments_command.go, mcp_github_config.go) score highest priority for new issue creation because they combine high CodeQL severity, recent code churn, and zero existing tracking - unlike the other Tier B/C items which already have open issues and only need SLA/ownership follow-through.

Remediation queue with SLAs

Priority	Item	Action	SLA urgency
1	CODEOWNERS gap (#61637)	Add path-scoped rules for pkg/workflow/, pkg/cli/, Dockerfile, scripts/	critical
2	experiments_command.go alloc-overflow (#942/#943, untracked)	Bound/validate len(experiments) before make([]ExperimentAnalysis, 0, len(experiments)) at line 384	high
3	mcp_github_config.go alloc-overflow (#675/#676, untracked)	Bound/validate slice-length inputs at lines 85/211/422/638/646 before make([]string, 0, n)	high
4	npm-install non-determinism (#61636, tracked)	Regenerate lockfile compiler template to emit ci/hash-pinned installs	high (existing SLA)
5	Dockerfile base image pin (#61166, tracked)	Pin alpine:3.24 to digest	medium (existing SLA)
6	Alert-dismissal hygiene (#59490/#57982, tracked)	Reconcile closed tracking issues vs. still-open CodeQL alerts	medium

Exception register

No new exceptions requested this cycle. Existing uk-ai-resilience Tier B/C tracking issues remain the governance record; none require temporary hidden-repo or bypass exceptions.

Operational metrics baseline

• MTTR proxy: Not independently measurable this cycle (branch-protection/issue-timeline API reads were rate/permission limited); qualitative signal is "improving but lagging" per alert-dismissal hygiene issues.
• Ownership coverage: 0 percent of security-sensitive compiler/CLI paths have path-scoped CODEOWNERS (four global owners only).
• Unsupported dependency ratio: Not directly measurable this cycle; Dependabot covers nine ecosystems weekly, suggesting low unsupported-dependency risk overall.
• Exception aging: 0 active exceptions.
• Exposure without recovery capability: 244/275 (89 percent) of open alerts are the single systemic npm-install non-determinism class - high exposure concentration but a known, tracked remediation path (Tier B, not Tier D).

Limitation disclosure: asset-tier-classifier and control-verifier sub-agents failed twice on a backend model-access error and were not retried a third time per guardrails; ai-risk-scorer was not dispatched given the pattern. All findings above were reconstructed via direct gh/git/jq reads and should be treated as partial-confidence pending a successful sub-agent run in a future cycle.

Generated by UK AI Operational Resilience · copilot · auto · 80.1 AIC · ⌖ 7.25 AIC · ⊞ 7.9K · ◷

• expires on Sep 28, 2026, 7:40 AM UTC-08:00