[uk ai resilience] [uk-ai-resilience] Governance report 2026-10-01

[github-actions[bot]]

Executive summary

Window: 2026-09-24 → 2026-10-01 (7d). 106 commits (28 security-signal), 69 open security issues, 277 open code-scanning alerts, 0 secret-scanning alerts. Sub-agent dispatch was not used; analysis was done directly from the pre-computed inputs (limitation: lower confidence on commit-level detail).

Key finding: every non-trivial open alert class already has an open [uk-ai-resilience] tracking issue, so no new issues were created (duplicate rule). The main risk is remediation velocity: alerts persist and recur rather than being untracked.

Asset graph summary

Asset graph (recent-change scoped)

Segment	Alerts	Rules	Tracking issue
.github/workflows (CI install steps)	~256	npm/uv/pip non-deterministic install, unpinned setup-node	#61636, #61378, #61379
pkg/workflow (compiler, MCP config)	8	allocation-size-overflow, bad-redirect-check	#59773, #60875, #60876, #63466, #64043, #64044, #59491
pkg/cli	7	allocation-size-overflow, bad-redirect-check, GraphQL sprintf, useless assignment	#63465, #64527, #61821, #57472
scripts/	1	js/http-to-file-access (#663)	#62692
Root Dockerfile	1	unpinned base image (#940)	#61166
Misc artifacts	3	#657, #680 smoke-test/stray files	#59774, #61165

Ownership signal: no .github/CODEOWNERS exists (#61637 open).

Tier classification

Tier table

Area	Tier
CI install determinism (npm/uv/pip)	B
allocation-size-overflow in compiler/CLI/MCP config	C (review pending, no owner)
bad-redirect-check path guards	B (recurring likely false positive)
GraphQL sprintf in project_command.go	B
ensure-docs-slide-pdf.js http-to-file	C
Dockerfile / setup-node pins	B
Stray test artifacts (#680, #657)	B (cleanup)

Control verification gaps

• Ownership: no CODEOWNERS → gap.
• SDLC: alerts reopen/recur without dismissal rationale ([uk-ai-resilience] Alert-dismissal hygiene gap persists across CodeQL tracking issues (Tier C) #59490, [uk-ai-resilience] Alert-dismissal hygiene gap: 3 CodeQL alerts remain open despite closed/remediated tracking issues (Tier C) #57982).
• Dependency: ~256 non-deterministic install alerts; unpinned Dockerfile image.
• Secrets: no open alerts — OK.
• Runtime observability / recovery: not evidenced from inputs; patch path is normal PR flow, rollback not verified.

Risk scoring

Scores (1 low risk – 5 high risk; ownership confidence inverted)

Area	Exposure	Patchability	Detectability	Fragility	Ownership conf.	Priority
allocation overflow (9 alerts)	3	2	2	3	low	high
CI install non-determinism	4	2	2	2	low	high
bad-redirect-check	2	2	2	2	low	medium
GraphQL sprintf	3	2	2	3	low	medium
docs-slide-pdf.js	2	2	2	2	low	medium
Dockerfile pin	2	1	2	2	low	medium

Remediation queue

Action	SLA
Add CODEOWNERS for compiler/CLI paths (#61637)	high
Pin/lock npm & uv installs in workflows (#61636)	high
Bounds-check or dismiss with rationale allocation alerts	high
Dismiss/document bad-redirect-check false positives	medium
Parameterize GraphQL queries (#64527)	medium
Pin Dockerfile base image, setup-node version	medium
Human review trigger: any alert dismissal, and the Tier C items above lacking owners.

Exception register

None granted. No permanent exceptions are recommended.

Operational metrics baseline

• MTTR proxy: tracked alerts #651/[Custom Engine Test] Test Issue Created by Custom Engine #652 (opened Sep) still open → >14d for oldest in window.
• Ownership coverage: 0% formal (no CODEOWNERS).
• Unsupported dependency ratio: not computable from inputs; ~256/277 alerts (92%) are install-pinning related.
• Exception aging: 0 exceptions.
• Exposure without recovery capability: not evidenced; rollback readiness unverified.

Generated by UK AI Operational Resilience · copilot · auto · 18 AIC · ⌖ 6.23 AIC · ⊞ 7.8K · ◷

• expires on Oct 4, 2026, 7:40 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #65050.