[Issue Arborist] Issue Arborist Run — Backlog Already Well-Structured, No New Links

[github-actions[bot]]

🌳 Issue Arborist Report

Issues analyzed: 66 open, non-sub-issue issues (from the pre-fetched dataset)

Parent issues created

None this run.

Links created

None this run.

Suggested (not linked — for maintainer review)

• 🔴 Red Team Audit — High: Shell injection via runtimes.lean.toolchain #855, 🔴 Red Team Audit — High: link-work-items area-path target scope silently fail-opens #2261, 🔴 Red Team Audit — High: shell(git:*) allow-tool rule permits arbitrary command execution via git -c config override #2331 — three independent 🔴 Red Team Security Audit findings (Shell injection via runtimes.lean.toolchain; link-work-items area-path fail-open; shell(git:*) allow-tool bypass). Each is in a distinct subsystem/file with no shared root cause, and there are only 3 of them (below the 5+ cluster threshold), so I did not create a parent for them. A maintainer may want a lightweight "security findings backlog" tracker if more accumulate.
• Feature request: first-class TLA+ / TLC (Java) runtime support #1222 (TLA+/TLC runtime request) and feat: allow enable to target individual pipeline files #1634 (enable target individual pipeline files) remain standalone feature requests with no clear broader parent in the current backlog — left unlinked rather than forced into an unrelated umbrella.
• [aw] No-Op Runs #13 ("[aw] No-Op Runs") and [aw] Detection Runs #793 ("[aw] Detection Runs") are GitHub Agentic Workflows auto-managed system tracking issues (explicitly marked "Do not close/assign to an agent") and were excluded from consideration as ordinary backlog items.

Observations

• The backlog is already heavily structured by prior Issue Arborist runs: the large majority of open issues I inspected (e.g. Add strict validation for untrusted raw step fragments #2068/Hoist deterministic repeated agent work into workflow steps #2067/Add preview-only self-optimization safe output #2069/Ground optimization proposals in recorded telemetry #2070/Preserve comments when updating workflow front matter #2071 → [Parent] Track self-optimization design follow-ups (extracted from #1061) #2076; docs: conclusion job token reference omits SC_WRITE_TOKEN #1766/docs(prompts): use repo-relative paths instead of hardcoded absolute checkout paths #1763/docs(site): refresh IR typed-helper docs to builder-struct API #1192/[agent-issue]: support declarative Azure DevOps pipeline variables in workflow source #2012/[agent-issue]: align GitHub issue-reporting token variable names #1632/feat: align FrontMatter fields with gh-aw schema — run-name, labels, metadata, tracker-id, source, strict #451/[aw]: Allow engine.model to be driven by an ADO pipeline variable / variable group #2035 → [Parent] Compiler internals and pipeline generation improvements (IR types, YAML gen, prompt decoupling) #1286; [agent-issue]: Agents cannot supply work-item fields; custom-fields is compile-time only, so runtime-computed values never reach ADO #2044/fix(safe-outputs): add file staging to upload-workitem-attachment #381/debug: upload-pipeline-artifact fails with ContainerWriteAccessDeniedException when uploading to other builds #471/MCPG step fails with docker: invalid reference format. — extra \ \ after -e ADO_MCP_AUTH_TOKEN in generated YAML (v0.36.0) #1034/add-pr-comment: render inline threads as applyable single/multi-line suggestions #1103 → [Parent] MCPG infrastructure and safe-output tooling improvements #1321; debug: v0.31.1 compiler emits different YAML than committed *.lock.yml files from #861, breaking integrity check #866/compile: directory argument silently no-ops instead of auto-discovering or erroring #867/refactor(compile): unify AzureCLI@2 token-mint steps behind a shared typed helper #1378/Reject unwireable cross-job provider-env macros on engine.env (follow-up to #1372) #1375/feat(ir): add EnvValue::RuntimeExpression variant to prevent $[] in step env #1081/refactor(compile): split agentic-pipeline shape out of standalone_ir.rs; move Agent-job condition contributions into Declarations #987/YAML generation uses manual string building in compile_gate_step_external #384/Inject runtime parameter values into the agent prompt via ado-script (sanitization at runtime, not compile time) #432/feat: decouple prompt body from compiled pipeline output (runtime-import approach) #237/docs: fix AGENTS.md accuracy — add trigger-e2e to ado-script tree and export-fact-catalog to CLI index #1583/[agent-issue]: Mirror gh-aw's runtime model controls in ado-aw #2245/[agent-issue]: target: 1es needs configurable 1ES template wrapper, SDL pool, and network isolation settings #2270 → [Parent] Compiler internals and pipeline generation improvements (IR types, YAML gen, prompt decoupling) #1286; [deps-release-notes] copilot-cli — upstream release action items #2322/[deps-release-notes] awf — upstream release action items #2252/[deps-release-notes] copilot-cli — upstream release action items #2232/[deps-release-notes] mcpg — upstream release action items #2040 → [Parent] Track and act on upstream dependency release-note action items (awf, mcpg, copilot-cli) #1283; test(executor-e2e): add create-github-issue and set-github-issue-type scenarios #1798/fix(smoke): route multi-repo Cargo through the internal feed #1823/chore(security): minimize AWF agent environment and mask unused gh CLI #1818/test(smoke): report scheduled smoke failures as GitHub issues from the orchestrator #1796 → [Parent] Safe-output executor E2E test coverage and tool correctness #1428/[Parent] Compiler internals and pipeline generation improvements (IR types, YAML gen, prompt decoupling) #1286/[Parent] Track agent runtime and execution pipeline improvements #1649) already have real parent links in place via has_parent/sub-issue relationships.
• No orphan cluster of 5+ clearly related, unparented issues was found this run — the remaining unparented items are either system-managed, singleton feature requests, or too heterogeneous (3 unrelated security CVEs) to justify a new umbrella per the conservative-linking policy.
• Recommend re-running after the next batch of deps-release-notes / [aw] failure issues accumulate, since those are the recurring source of new 5+ clusters (as seen in [Parent] Track and act on upstream dependency release-note action items (awf, mcpg, copilot-cli) #1283, [Parent] Track and resolve recurring agentic workflow execution failures (non-rate-limit) #1549, [Parent] Track and resolve recurring AI-credits rate-limit failures in scheduled agentic workflows #1535 historically).

Generated by Issue Arborist · auto · 146.5 AIC · ⌖ 1.69 AIC · ⊞ 9.4K · ◷

• expires on Oct 20, 2026, 8:43 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Issue Arborist.

A newer discussion is available at Discussion #2344.