Daily Fro Bot Report — 2026-09-25 (UTC)

[fro-bot]

Daily Fro Bot Report — 2026-09-25 (UTC)

Run Summary

Category	Status	Notes
Errored PRs	✅	Remediation pass checked #3920 and #3901 (both check runs and legacy statuses); no failures. Re-verified by the scheduled pass (run 36093828964): evidence
Security	⚠️	Re-verified (evidence). No critical/high Dependabot alerts in this repo. 1 medium transitive alert. Scorecard posture findings are open (BranchProtectionID and VulnerabilitiesID rated high).
Control-Plane Integrity	✅	Re-verified (evidence). SHA pinning, strip-only TS, and top-level permissions: verified across all workflows. Guards untouched.
Code Quality	✅	Re-verified (evidence). bootstrap / check-types / lint / test all green (3819 passed).
Oversight	⚠️	5 failing default-branch checks, 2 repos with critical alerts, and a large stale remediation-PR backlog.
Cross-Project Intelligence	⚠️	Coverage partial: 30 of 34 tracked entries scanned from wiki repo pages.
Progressive Improvement	⚠️	10 open learning proposals (pipeline stalled). TypeScript and Vitest are one major behind.

Errored PRs

Refreshed 2026-09-25 ~04:25Z by the scheduled pass (run 36093828964). Both remediation passes opened 0 PRs. #3920 is now BLOCKED even though every check is green, which means it is waiting on required review/merge gating rather than a CI failure.

None. The remediation pass opened no PRs. #3901 is green but BEHIND main. Its only change is to .github/workflows/renovate.yaml, so the branch update was left for merge time.

Security

• Dependabot #59: @humanfs/node, medium, transitive, patched in 0.16.8. Renovate owns it.
• Code scanning: 4 OpenSSF Scorecard posture findings (VulnerabilitiesID high, BranchProtectionID high, FuzzingID, CIIBestPracticesID). These are not code vulnerabilities.

Control-Plane Integrity

Clean. The only broad grant is permissions: read-all in scorecard.yaml, which is the upstream Scorecard pattern and read-only.

Code Quality

Green on main at 5d8f66b.

Oversight

Scope: every public, non-archived repo returned by user/repos (owner + collaborator + org member, paginated). Security is Dependabot only. Not checkable: pro-actions/peter-murray_workflow-application-token-action has Dependabot disabled.

Failing default-branch checks

Repo	Failing check	Next step
bfra-me/github-action	Update Repo Settings	Already tracked in #1611; fix .github/settings.yml.
bfra-me/ha-addon-repository	Renovate / Renovate	Read the latest Renovate run log. #569 (settings 500) may be related.
marcusrbrown/containers	Renovate / Renovate	Read the latest Renovate run log.
marcusrbrown/cortexkit_anthropic-auth	Fro Bot	Its autoheal report #11 has not updated since 2026-06-29. The daemon looks dead. Inspect the workflow run.
marcusrbrown/extend-vscode	Pre-Release Validation (vulnerabilities)	This is caused by the alert load below, not a CI bug.

Security alerts (Dependabot, open)

• Critical: marcusrbrown/containers (1 critical, 1 high, 5 medium) and marcusrbrown/extend-vscode (1 critical, 34 high).
• High: marcusrbrown/gpt 24, marcusrbrown/Presentations 8, bfra-me/github-app 3, marcusrbrown/marcusrbrown 3, marcusrbrown/sparkle 3, marcusrbrown/marcusrbrown.github.io 2, marcusrbrown/cortexkit_anthropic-auth 1.
• Next step: each repo's own autoheal owns remediation. The two critical repos should be triaged first.

Stale PRs (created more than 7 days ago with no update in 14+ days). Most are Fro Bot remediation PRs that have gone past their useful life.

• marcusrbrown/vbs: 7 fro-bot PRs from July, including 5 fix(security) (#672, #688, #697, #701, #717). Grouped Renovate #740 has been blocked for 32 days.
• marcusrbrown/gpt: 15 open PRs, the newest from 2026-07-29. They include the six-PR Ollama-contrast cluster (#2664 through #2692) and HeroUI v3 #2165 (last update 2026-05-10).
• bfra-me/github-action #1463, #1466, #1467; bfra-me/github-app #840, #842, #843, #950. These are June security-override PRs, and Action Required: Fix Renovate Configuration #1463/Action Required: Fix Renovate Configuration #1467 are duplicates of each other.
• marcusrbrown/containers #723, #727, #740, #744; marcusrbrown/marcusrbrown #1055, #1095, #1100, #1107; marcusrbrown/opencode-copilot-delegate #135, #241, #332, #335; bfra-me/renovate-config #1383 (Copilot, March), #1558; fro-bot/space-bus #72, #130, #135.
• Next step: close or rebase them by cohort. A CONFLICTING remediation PR suppresses a fresh refile through the dedup rule, so it counts as exposure, not coverage.

New since yesterday (substantive only)
fro-bot/agent#1663 (workspace container has no init), bfra-me/renovate-action#3835 (stale v9 deprecation notice), and fro-bot/agent#1666 (deterministic termination test). Triage in their repos.

Unassigned bugs
bfra-me/ha-addon-repository#569, marcusrbrown/marcusrbrown.com#465, #517, marcusrbrown/systematic#740, #1005. Assign an owner or fold them into each repo's autoheal queue.

Report sprawl
marcusrbrown/.dotfiles has 4 open daily reports (#2682, #2685, #2695, #2699), which means its close-older step is not running. marcusrbrown/renovate-config still has 3 open weekly reports from February and March.

Stale issues (more than 30 days)
There are many, concentrated in gpt (HeroUI #2162–#2175 and techdebt #2140–#2146, all March), vbs (2025 roadmap #150–#161 and convention drift #670–#694), and extend-vscode (#317–#319). Close or re-scope them in bulk; they are roadmap residue, not active work.

Top 3 hotspots (ranked by finding count)

1. marcusrbrown/gpt: 15 stale PRs, 24 high alerts, and more than 15 stale issues.
2. marcusrbrown/vbs: 10 stale PRs (7 are Fro Bot remediation), the grouped update frozen for 32 days, and more than 15 stale issues.
3. marcusrbrown/extend-vscode: 1 critical and 34 high alerts, a failing default-branch check, and stale roadmap issues.

Cross-Project Intelligence

Coverage is partial. metadata/repos.yaml lists 34 entries. 30 were scanned through their wiki repo pages and the [[github-actions-ci]] topic. marcusrbrown/copiloting is archived and was skipped. 3 entries are excluded from public reporting.

These findings apply to this repo:

1. Key dedup on merge state, not just on "an open PR exists" (source: vbs and gpt, wiki section A Security Remediation PR Has a Shelf Life, 2026-09-21). This repo's autoheal dedup rule reuses any open Fro Bot PR for the same root cause, so a CONFLICTING remediation PR can block a live refile indefinitely. The fleet-wide stale-PR list above is that failure at scale. Adopt: treat mergeStateStatus: DIRTY older than 14 days as "no usable PR".
2. Verify tracker claims against deployed truth (source: category 8 below; recorded in the wiki as A Rollup Tracker Whose Structured Source Omits the Rows It Narrates). The Gateway Rollout Tracker preflight keys on Project/issue state, which cannot see drift in rows the Project never held.
3. Split the Fro Bot workflow into a read-only content job and a privileged scheduled job (source: marcusrbrown/infra, 2026-09-06). Evaluate whether fro-bot.yaml here already separates attacker-reachable triggers from the credentialed autoheal. This is report-only and was not verified this run.

Progressive Improvement

• Learning-proposal pipeline stalled. 10 open: #3887–#3891 (11 days old) and #3905–#3909 (4 days old). None has passed 14 days yet; the first cohort does on 2026-09-28. Having two or more open means authoring into docs/solutions/ is not keeping up. #3674 reading healthy is not evidence against this.
• Tool-version drift (source: npm registry npm view <pkg> version; major drift included): TypeScript 6.0.3 → 7.0.2 (major), Vitest 4.1.11 → 5.0.1 (major), Prettier 3.9.1 → 3.9.9 (patch, within minor), ESLint 10.11.0 (current). Renovate owns these; check the Dependency Dashboard #2828 for pending majors.
• Stale TODO/FIXME: none. The only match is a fixture string in scripts/check-private-leak.test.ts:219.
• Wiki lint #3903 has been open since 2026-09-20. Its fix must land through the data branch.

Needs Human Attention

1. Gateway rollout tracker #3512 is stale (Project 1 status is In Progress, which is consistent). The body claims the deployed gateway is v0.83.0; marcusrbrown/infra apps/gateway/upstream.json shows ref: v0.113.2. The body claims the latest release is v0.85.0; the actual latest is v0.115.1 (2026-09-24). The matrix lists fro-bot/dashboard#179 as Open, but it is CLOSED. Project 1 has no items for dashboard#179, agent#1109, agent#1111, or push #1152–#1165. Health still returns contractVersion 1.6.0, which matches the body. Fix: refresh the body's pin, release, and chore(deps): update bfra-me/renovate-action action to v2.2.4 #179 rows, and add the missing items to Project 1. Tracker writes belong to the Gateway Rollout Tracker workflow, not to this report.
2. Gateway deploy awaiting manual approval since 2026-09-21T20:02Z: marcusrbrown/infra#1412. This is a human gate.
3. Critical alerts in marcusrbrown/containers and marcusrbrown/extend-vscode. Triage those first.
4. Learning proposals: author the 10 open proposals into docs/solutions/ or close the rejected ones.
5. #3901: update the branch before merging.

[fro-bot]

Autoheal Remediation Pass: 2026-09-25 (UTC), categories 1–4

Nothing needed fixing, so this run created no branches, commits or PRs. Checks ran against main at 5d8f66b, which includes #3926 (data-branch writes restricted to trusted jobs).

1. Errored PRs: none

PR	Author	Check runs	Legacy statuses	Merge state
#3920 fro-bot/agent → v0.115.1	fro-bot (Renovate)	all pass (Fro Bot jobs skipped by design)	Security: Private Leak Scan success	MERGEABLE
#3901 renovate global-config comment	fro-bot	all pass	Security: Private Leak Scan success	MERGEABLE

2. Security: no critical/high advisories to fix

• Dependabot chore(deps): update bfra-me/renovate-config action to v1.13.0 #59: @humanfs/node, GHSA-p498-v437-472g, medium, transitive, dev scope, fixed in 0.16.8. This is below the critical/high bar, so I left it to Renovate and opened no PR.
• Code scanning: the only open alerts are repo-level Scorecard findings with no file attached (VulnerabilitiesID, BranchProtectionID, FuzzingID, CIIBestPracticesID). No code fix applies. VulnerabilitiesID should clear once the @humanfs/node bump lands.

3. Control-plane integrity: clean

• a. SHA pinning: every third-party uses: in .github/workflows/*.yaml and .github/actions/**/action.yaml is pinned as @<40-char sha> # vX.Y.Z. No floating tags.
• b. Strip-only TS: scripts/*.ts has no enum, namespace, parameter properties or import x = aliases. The only grep hit is a comment in scripts/repos-metadata.ts:476 that documents the rule. The Test Scripts Load job passes on both open PRs.
• c. Least privilege: every workflow declares a top-level permissions: block, and none uses write-all.
• d. Guard integrity: Check Wiki Authority, Security: Private Leak Scan and Check Mutation Guards all run and pass on the open PRs. Nothing was weakened.

4. Code quality: green

pnpm bootstrap ✅ · pnpm check-types ✅ · pnpm lint ✅ · pnpm test ✅ (84 files, 3819 passed, 3 todo). Nothing needed autofixing, and the working tree stayed clean.

Needs Human Attention

• None this run. Dependabot chore(deps): update bfra-me/renovate-config action to v1.13.0 #59 depends on Renovate picking up @humanfs/node@0.16.8. If it's still open after the next Renovate cycle, find which dev dependency pulls it in with pnpm why @humanfs/node.

Run Summary

Field	Value
Event	schedule
Run	36093828964
Thread	schedule-898cd73a-36093828964
Mode	branch-pr (no mutations required)
PRs inspected	#3920, #3901
Branches / PRs created	0 / 0
Wiki persistence	none (branch-pr mode)

[fro-bot]

Oversight Pass Refresh: 2026-09-25 ~04:25Z (UTC), categories 5–8

Today's report already existed (dispatch run 36090469764, 03:36Z), so I updated this issue in place instead of opening a second one. #3927 is the only open daily report.

What changed in the body

• The Errored PRs, Security, Control-Plane Integrity and Code Quality rows now link to this run's remediation evidence. All four are unchanged: 0 PRs opened, no critical/high alerts, pinning and permissions clean, 3819 tests green.
• chore(deps): update fro-bot/agent to v0.115.1 #3920 moved to BLOCKED with every check green. It is waiting on merge gating, not failing CI.

Checked again and still true

• Learning-proposal backlog: 10 open (Learning proposal: (e86b0877) #3887–Learning proposal: (31309d62) #3891 at 11 days, Learning proposal: (bd4b7e68) #3905–Learning proposal: (374ddfe7) #3909 at 4 days). The first cohort passes 14 days on 2026-09-28.
• #3512 and marcusrbrown/infra#1412 are both still open. The gateway deploy is still waiting on a human approval.
• bfra-me/github-action Update Repo Settings still fails on main. marcusrbrown/extend-vscode Publish failed at 2026-09-24T04:33Z.

One caveat on oversight data. Looking at each workflow's latest run on main: bfra-me/ha-addon-repository Renovate succeeded (01:27Z) and marcusrbrown/containers Renovate was skipped. The 03:36Z report marked both as failing because it read check-runs on the HEAD commit, which is a different source. Tomorrow's pass should reconcile which source counts as "failing main". The rest of categories 5–8 is less than an hour old, so I did not rerun it.

Run Summary

Field	Value
Event	schedule
Run	36093828964
Thread	schedule-898cd73a-36093828964
Mode	working-dir (report-only)
Report issue	#3927 (updated, not duplicated)
Older reports closed	0 (none open)
Wiki writes this pass	none. The tree was already dirty from an earlier step and I left it for ingestion.

[fro-bot]

Autoheal Remediation Pass — 2026-09-26 (UTC), categories 1–4

No minimal repair was needed; no branch, commit, or PR was created. Inspected main at 7339707.

Errored PRs

• Open PR #3901: check runs have no failures; the separate legacy Security: Private Leak Scan commit status is success. No failing PR to repair.

Security

• Dependabot alert chore(deps): update bfra-me/renovate-config action to v1.13.0 #59 (@humanfs/node, development/transitive, medium, first patched in 0.16.8 per GitHub Dependabot advisory data) remains open. Below the critical/high remediation threshold; routine dependency upgrades belong to Renovate. No high/critical alert or failing security PR was found. Repository security advisories: none published; secret-scanning alerts: none open. Four open code-scanning Scorecard findings (VulnerabilitiesID, FuzzingID, CIIBestPracticesID, BranchProtectionID) are not confirmed high/critical direct-dependency or Action advisories.

Control-Plane Integrity

• All third-party uses: entries across 29 workflows and 2 composite actions are pinned to 40-character SHAs with # vX.Y.Z comments. No strip-only TypeScript construct surfaced; pnpm lint passed. Workflows scope permissions; the Scorecard read-all default is overridden by job permissions for SARIF upload/publishing, and the private-leak gate intentionally bypasses shared setup to avoid a PR-poisonable cache (.github/workflows/check-private-leak.yaml:12-13). Main branch protection has enforce_admins: true, required review, and required Check Wiki Authority / Security: Private Leak Scan contexts. No guardrail changes needed.

Code Quality

pnpm bootstrap, pnpm check-types, pnpm lint, and pnpm test all passed on main (86 files, 3,890 passed, 3 todo). Working tree clean.

Needs Human Attention

None for this pass. The medium transitive advisory remains with Renovate; no version comparison or major-version drift assessment was needed for an eligible security fix.

Run Summary

Field	Value
Event	schedule
Run	36217580903
Thread	schedule-898cd73a-36217580903
Mode	branch-pr; no mutations required
PRs inspected	#3901
Branches / PRs created	0 / 0
Wiki persistence	none (branch-pr mode)

[fro-bot]

Superseded by the 2026-09-26 daily report.

Run Summary

Field	Value
Event	schedule
Run	36217580903
Thread	schedule-898cd73a-36217580903
Mode	working-dir (report-only)
Daily report	#3930
Older reports closed	1 (#3927)
Wiki writes	none; no validated new public finding