[Alert] Smart Alerts — 2026-03-15T18:20 UTC

[github-actions]

Run: 23116379261 · 2026-03-15T18:20 UTC · Δ from #284 (+6.0h)

---

🔴 Critical

⚠️ CRITICAL ESCALATION — subcog: AWS Key Exposed, ~40h With Zero Response

Field	Value
Issue	subcog#153
Reported	2026-03-14T02:27 UTC (responsible-disclosure scanner)
Age	~40 hours — no response, no commits, issue still OPEN
File	src/security/mod.rs @ commit ad6f61a6
Delta	Was 33.9h at #284 (12:22 UTC) — +6h still unactioned, 0 comments

Remediation steps (in order):

1. Revoke the AWS key immediately at (console.aws.amazon.com/redacted)
2. Remove the key from src/security/mod.rs and commit the change
3. Purge from git history: git filter-repo --path src/security/mod.rs
4. Rotate any dependent services that used these credentials
5. Close subcog#153 once resolved

40 hours exposed in a public commit. This is now a critical incident — revoke the AWS credentials IMMEDIATELY.

---

🔴 CI Failure — rlm-rs Daily QA (Ongoing, ~7h)

Field	Value
Repo	rlm-rs
Workflow	Daily QA
Run	23109317610
Failed at	2026-03-15T11:20 UTC
Root cause	ERR_VALIDATION: Patch file(s) expected but not found — gh-aw agent configured with create_pull_request output type but produced no patch
Delta	Unchanged since #284 — no fix, no new run

Action: Check the agent output for run 23109317610. The agent may need its output type updated if it no longer generates PRs, or the Daily QA agent prompt needs review.

---

🔴 CI Failures — Ongoing (unchanged from #284)

Repo	Workflow	Age	Root Cause
atlatl	CI Checks	~8d	Clippy 1.94 strict lints, broken doc links
atlatl	Pipeline	~7d	ONNX Runtime prebuilt targets dropped
atlatl	Security Audit	~2d	sigstore/cosign-installer v4.1.0 failure
daedalus	Security Audit	~2d	sigstore/cosign-installer v4.1.0 failure (same root cause as atlatl)
atlatl-spec	Validate Specification	~12d	Invalid HTML <br/> in Mermaid diagram
sdlc-quality	CI	~18d	Broken since chore: update dependabot configuration (2026-03-01)
vscode-git-adr	CI	~17d	actions/upload-artifact v6→v7 breaking change
github-project-manager	Agentic Maintenance	~2d	Failure since gh-aw bump to 0.56.2

Quick fix for atlatl + daedalus Security Audit: Pin sigstore/cosign-installer to SHA faadad0cce49287aee09b3a48701e75088a2c6ad (v4.0.0) in both repos.

---

🟠 Warning

Pending External PR — subcog#152 (8d, awaiting 2 approvals)

PR	Author	Age	Status
subcog#152 feat(http): add /healthz endpoint	mgildea (external)	~8d	Awaiting required_approvals_external: 2 — last updated 2026-03-13

---

ℹ️ Info

Check	Status
Issue spike (>5 in 6h)	✅ No organic spike — 0 new issues in monitored repos since 12:20 UTC
Review backlog (>10/reviewer)	✅ Within threshold
Stale critical/high items	⚠️ sdlc-quality#10 SDLC audit 51+ days open, score 86/100, 2 critical violations
rlm-rs#124 CI Failure Doctor	⚠️ Expiry 2026-03-18 in 3 days — Daily QA failure may be related
.github CI	✅ Healthy

---

Summary

Severity	Count	Key Change Since #284
🔴 Critical (security)	1	subcog AWS key — ~40h exposed, +6h, zero response
🔴 Critical (CI) active	1	rlm-rs Daily QA — unchanged, still failing
🔴 Critical (CI) ongoing	6 repos	atlatl (×3), daedalus, atlatl-spec, sdlc-quality, vscode-git-adr, github-project-manager
🟠 Warning	1	subcog#152 external PR, ~8d stale
✅ Healthy	13	All other managed repos

Highest urgency: Revoke subcog AWS credentials IMMEDIATELY — 40 hours exposed with no response.

---

gh-aw-workflow-id: smart-alerts

Generated by Smart Alerts · ◷

Generated by Smart Alerts · ◷

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #290

View newer issue

---

This action was performed automatically by the Smart Alerts workflow.