Daily Fro Bot Report — 2026-09-24 (UTC)

[fro-bot]

Daily Fro Bot Report — 2026-09-24 (UTC)

Run Summary

Category	Status	Notes
Errored PRs	✅	Remediation pass found no failing PRs (evidence). #3920 and #3901 are all green.
Security	⚠️	This repo: 1 medium transitive dev alert, below the remediation threshold. 4 Scorecard posture alerts are old.
Control-Plane Integrity	✅	SHA pinning, strip-only TS and top-level permissions: all verified by the remediation pass.
Code Quality	✅	bootstrap / check-types / lint / test all pass (3710 tests).
Oversight	⚠️	3 repos with a failing latest run on the default branch. 2 repos with critical alerts. 54 stale PRs, 50 of them Fro-Bot-authored.
Cross-Project Intelligence	⚠️	Partial coverage. 1 adoptable pattern. 1 stale wiki page. Non-public tracked entries were not scanned.
Progressive Improvement	⚠️	10 open learning-proposal issues, so the compounding pipeline is stalled. Major drift on TypeScript and Vitest.

Errored PRs

None. The remediation pass (comment) checked both check runs and legacy statuses. #3920 has 15 success / 3 skipped and is BLOCKED waiting on review. #3901 has 14 success / 4 skipped and is BEHIND main.

Security

• This repo: Dependabot chore(deps): update bfra-me/renovate-config action to v1.13.0 #59, @humanfs/node GHSA-p498-v437-472g, medium, transitive dev dependency, fixed in 0.16.8. Renovate owns the fix. The remediation pass opened no security PR.
• The 4 open code-scanning alerts (feat: set default settings #1, feat: add Renovate workflow for dependency auto-updates #5, Update peter-murray/workflow-application-token-action to v2 #7, Uplift sync-settings workflow #9) are Scorecard posture checks with no file location.

Control-Plane Integrity

Verified clean by the remediation pass: every third-party uses: is pinned @<sha> # vX.Y.Z, scripts/*.ts uses only strip-only syntax, and every workflow declares permissions:. No guard was modified.

Code Quality

All four validation gates pass. There was no autofix drift, so no PR was opened.

Oversight

Scope: every public, non-archived repo visible to fro-bot in fro-bot, marcusrbrown, bfra-me, psware-ps2 and pro-actions (35 enumerated). Non-public repos were enumerated but are excluded from this public report. The Dependabot API is disabled for pro-actions/peter-murray_workflow-application-token-action.

Failing latest run on the default branch

• marcusrbrown/marcusrbrown.com — Fro Bot schedule run failed at 03:38 today: APIError status=400 about 1s into execution, reported as "recoverable LLM error" with no delivery surface. This is a provider or model config failure, not a repo defect. Next: check the model/provider inputs in that repo's fro-bot.yaml against the working ones in this repo.
• marcusrbrown/extend-vscode — Publish has been failing for a long time. Next: triage or retire the job.
• bfra-me/github-action — Update Repo Settings. Probably the same root cause as Update Repo Settings job fails with 500 bfra-me/ha-addon-repository#569 (Update Repo Settings returns 500). Next: triage both together.

Critical/high Dependabot alerts

• Critical: marcusrbrown/containers (1 critical, 1 high), marcusrbrown/extend-vscode (1 critical, 34 high).
• High: marcusrbrown/gpt (24), marcusrbrown/Presentations (8), bfra-me/github-app (3), marcusrbrown/marcusrbrown (3), marcusrbrown/sparkle (3), marcusrbrown/marcusrbrown.github.io (2), marcusrbrown/cortexkit_anthropic-auth (1).
• Next: start with the two criticals. Several repos already have Fro-Bot security PRs that are stale (below), so merging or rebasing those comes before opening new ones.

Stale PRs (>14d since last activity). 50 of these 54 are Fro-Bot autoheal PRs nobody has acted on:

• marcusrbrown/gpt: 15, including a run of 8 near-duplicate a11y contrast fixes (chore(deps): update actions/upload-artifact action to v4.5.0 #2692, docs: add badges to the security info #2688, chore(deps): update bfra-me/.github action to v1.13.0 #2674, chore(deps): update peter-murray/workflow-application-token-action action to v3.0.1 #2673, chore(deps): update actions/checkout action to v4.2.2 #2672, Action Required: Fix Renovate Configuration #2665, Action Required: Fix Renovate Configuration #2664, chore(deps): update bfra-me/renovate-action action to v5.31.2 #2693) and Action Required: Fix Renovate Configuration #2165, 136 days old. Next: consolidate or close the contrast duplicates by hand. The autoheal keeps re-deriving the same fix.
• marcusrbrown/vbs: 8. Five are High-severity security remediations (Action Required: Fix Renovate Configuration #717, Action Required: Fix Renovate Configuration #701, chore(deps): update bfra-me/.github action to v1.11.2 #697, Action Required: Fix Renovate Configuration #688, Action Required: Fix Renovate Configuration #672) aged 46–75 days. Next: review and merge; these are real security fixes rotting.
• bfra-me/github-app Action Required: Fix Renovate Configuration #843, Action Required: Fix Renovate Configuration #842, Action Required: Fix Renovate Configuration #840 and bfra-me/github-action Action Required: Fix Renovate Configuration #1467, Action Required: Fix Renovate Configuration #1466, Action Required: Fix Renovate Configuration #1463: pairs of duplicate security PRs, about 99 days old. Next: keep one per repo and close the rest.
• marcusrbrown/marcusrbrown.com: 6 (Action Required: Fix Renovate Configuration #523, Action Required: Fix Renovate Configuration #484, Action Required: Fix Renovate Configuration #478, Action Required: Fix Renovate Configuration #473, Action Required: Fix Renovate Configuration #471, Action Required: Fix Renovate Configuration #462). Action Required: Fix Renovate Configuration #473 and Action Required: Fix Renovate Configuration #523 are both "refresh stack versions".
• marcusrbrown/containers Action Required: Fix Renovate Configuration #744, Action Required: Fix Renovate Configuration #740, Action Required: Fix Renovate Configuration #727, Action Required: Fix Renovate Configuration #723. marcusrbrown/marcusrbrown chore(deps): update bfra-me/.github action to v1.12.1 #1107, Action Required: Fix Renovate Configuration #1100, Action Required: Fix Renovate Configuration #1095, Action Required: Fix Renovate Configuration #1055. marcusrbrown/opencode-copilot-delegate Action Required: Fix Renovate Configuration #335, Action Required: Fix Renovate Configuration #332, Action Required: Fix Renovate Configuration #241, chore(deps): update bfra-me/renovate-action action to v2.1.18 #135. bfra-me/github-app Action Required: Fix Renovate Configuration #950. bfra-me/renovate-config Action Required: Fix Renovate Configuration #1383 (Copilot, 182 days old).

Aging PRs (>7d, not yet stale): fro-bot/space-bus (5), bfra-me/ha-addon-repository (5), marcusrbrown/mothership (3), marcusrbrown/ha-config (2), bfra-me/renovate-config (1), bfra-me/works (1), fro-bot/agent (1), marcusrbrown/Presentations (1), marcusrbrown/sparkle (1). Next: normal review cadence.

New issues (<24h): bfra-me/renovate-action#3835 (a stale v9 Docker deprecation notice warns on every run). The rest are sibling daily reports.

Stale issues (>30d): marcusrbrown/gpt (19), marcusrbrown/vbs (15), marcusrbrown/renovate-config (5), marcusrbrown/extend-vscode (4), marcusrbrown/marcusrbrown.com (3), plus 1–2 each in 20 other repos. Next: a triage sweep on gpt and vbs.

Unassigned bugs: bfra-me/ha-addon-repository#569, marcusrbrown/marcusrbrown.com#517, marcusrbrown/marcusrbrown.com#465, marcusrbrown/systematic#1005, marcusrbrown/systematic#740.

Top hotspots (score = stale PRs + stale issues + critical/high alerts + failing default-branch runs + unassigned bugs)

1. marcusrbrown/gpt: 58 (15 stale PRs, 19 stale issues, 24 high)
2. marcusrbrown/extend-vscode: 40 (35 critical/high, 4 stale issues, failing Publish)
3. marcusrbrown/vbs: 23 (8 stale PRs, 15 stale issues)

Cross-Project Intelligence

Coverage is partial. I used the survey wiki for public tracked entries in metadata/repos.yaml. Non-public entries were not scanned in this report. marcusrbrown/copiloting is archived and its wiki page was last updated 2026-04-23. Every other public repo page is dated 2026-08-30 or later.

• Adoptable: marcusrbrown/infra runs its privileged schedule job under step-security/harden-runner with egress-policy: block, split from a read-only content-triggered job. None of this repo's 29 workflows use harden-runner. The privileged fro-bot.yaml schedule path is the obvious first candidate.
• Otherwise nothing new beyond earlier reports.

Progressive Improvement

• Learning pipeline stalled: 10 open learning-proposal issues. Learning proposal: (e86b0877) #3887–Learning proposal: (31309d62) #3891 are 10 days old and Learning proposal: (bd4b7e68) #3905–Learning proposal: (374ddfe7) #3909 are 3 days old. None has passed 14 days yet, but 10 open at once already trips the threshold. Improvement Metrics #3674 cannot detect this.
• Tool drift (current version from the npm registry; major drift included): ESLint 10.11.0 = latest. Prettier 3.9.1 vs 3.9.9 (patch only). TypeScript 6.0.3 vs 7.0.2 (major). Vitest 4.1.11 vs 5.0.1 (major). Renovate owns these bumps. Check the Dependency Dashboard (Dependency Dashboard #2828) to see whether they're held deliberately.
• CI/conventions: No degraded jobs. No real TODO/FIXME drift (the two hits are a test fixture and the prompt text).

Needs Human Attention

1. Gateway tracker drift (Track cross-repo Gateway operator control-surface rollout #3512 vs Project 1). Both show Track cross-repo Gateway operator control-surface rollout #3512 as open / In Progress, so the status matches. The body disagrees with current evidence in two places:
   • Track cross-repo Gateway operator control-surface rollout #3512 says the deployed gateway is pinned to fro-bot/agent v0.83.0 and that push (v0.85.0) is "not yet deployed". But marcusrbrown/infra apps/gateway/upstream.json pins v0.113.2. The live /operator/health still returns contractVersion: 1.6.0, so the contract gate holds. Whether push is live (VAPID secrets) is unverified.
   • Track cross-repo Gateway operator control-surface rollout #3512's rollout table lists Operator UI: run cancellation + sanitized failure-reason (contract 1.6.0) dashboard#179 (Cancel UI) as Open, but it is CLOSED, and it has no Project 1 item.
   • Fix: the Gateway Rollout Tracker workflow owns these writes. Re-run it or refresh the body by hand. This report path does not edit it.
2. Autoheal PR pile-up across repos. 50 stale Fro-Bot PRs, including duplicate security PRs (bfra-me/github-app, bfra-me/github-action) and near-duplicate a11y fixes (marcusrbrown/gpt). Root cause: the per-repo autoheal dedup is not matching its own earlier PRs when titles differ. Smallest safe fix: in each affected repo's fro-bot.yaml prompt, make dedup key on the root cause or advisory ID, not the title. A human should close the duplicates; automation must not close PRs.
3. marcusrbrown/marcusrbrown.com Fro Bot APIError 400. Compare that repo's agent/model inputs with this repo's .github/workflows/fro-bot.yaml. Verify with a workflow_dispatch run.
4. Learning proposals. Write up Learning proposal: (e86b0877) #3887–Learning proposal: (31309d62) #3891 and Learning proposal: (bd4b7e68) #3905–Learning proposal: (374ddfe7) #3909 into docs/solutions/, or close any that are rejected.
5. Scorecard alerts feat: set default settings #1/feat: add Renovate workflow for dependency auto-updates #5/Update peter-murray/workflow-application-token-action to v2 #7/Uplift sync-settings workflow #9. Dismiss them with a reason, or accept them.

Run Summary

• Run: 35953969280 (schedule, oversight half, working-dir)
• Remediation evidence: Daily Fro Bot Report — 2026-09-23 (UTC) #3917 comment 5807426578 (0 mutations)
• Repos enumerated: 38 (35 public reported). Dependabot unavailable on 1.
• Wiki writes: none from this pass. The working tree carries a data-branch wiki sync from earlier in the job, which I left untouched.

[fro-bot]

Autoheal Remediation Pass: 2026-09-25 (UTC), categories 1–4

Nothing needed fixing. No branches, commits, or PRs were created this run. Categories 5–8 and the daily report run in the next pass.

1. Errored PRs: none

PR	Author	Check runs	Legacy statuses	Merge state
#3920 fro-bot/agent → v0.115.1	app/fro-bot (Renovate flow)	no failures	Security: Private Leak Scan success	MERGEABLE
#3901 renovate global-config comment	fro-bot	no failures	Security: Private Leak Scan success	MERGEABLE, BEHIND main

I did not update #3901's branch. It touches .github/workflows/renovate.yaml, it is not failing, and bringing it up to date is a merge-time choice.

2. Security: no critical/high advisories

• Dependabot: 1 open alert, chore(deps): update bfra-me/renovate-config action to v1.13.0 #59 @humanfs/node (GHSA-p498-v437-472g). It is medium severity, a transitive dependency, and patched in 0.16.8. That is below the auto-remediation bar, so Renovate owns it.
• Code scanning: the 4 open alerts are all OpenSSF Scorecard posture findings (VulnerabilitiesID high, BranchProtectionID high, FuzzingID, CIIBestPracticesID), not code vulnerabilities. VulnerabilitiesID counts the open Dependabot alert above. BranchProtectionID is a settings finding, and this run never modifies branch protection.

3. Control-plane integrity: clean

• SHA pinning: every non-local uses: in .github/workflows/*.yaml and .github/actions/** is @<40-char sha> # vX.Y.Z. No floating tags.
• Strip-only TS: scripts/*.ts has no enum, namespace, import x =, or parameter properties. The only hit was an explanatory comment in scripts/repos-metadata.ts:476.
• Least privilege: every workflow declares top-level permissions:. The only broad grant is scorecard.yaml's read-all, which is the upstream Scorecard pattern and read-only.
• Guards: I did not touch the wiki-authority guard, the privacy gates, or branch protection. main HEAD 5d8f66b: Main, CodeQL, and Scorecard all succeeded.

4. Code quality: green

pnpm bootstrap ✅ · pnpm check-types ✅ · pnpm lint ✅ · pnpm test ✅ (84 files, 3819 passed, 3 todo)

Needs Human Attention

• docs(renovate): correct the global-config comment to state the input is inert #3901 is behind main. It is mergeable and its checks are green. Update the branch before merging. Verify with gh pr view 3901 --json mergeStateStatus.
• Scorecard BranchProtectionID (high). This is a repo-settings posture finding and outside autoheal scope. Evaluate it in the settings UI, and do not relax any existing protection to clear other findings.
• No durable wiki knowledge came up this run, so there is nothing to persist.

Run Summary

--- Fro Bot Run Summary ---
Event: workflow_dispatch
Repo: fro-bot/.github
Run: 36090469764
Delivery mode: branch-pr (no mutations required)
Categories: 1 clean · 2 clean (1 medium transitive, deferred to Renovate) · 3 clean · 4 green
PRs opened/updated: none
Issues opened: none

[fro-bot]

Superseded by #3927.