Daily Fro Bot Report — 2026-11-15 (UTC) #4249

Daily Fro Bot Report — 2026-11-15 (UTC)

Run Summary

Attention: 5 items (2 awaiting you, 1 new today), no new tracking issues, nothing resolved. Remediation learnings: 1 staged for the wiki, 0 skipped.

Refreshed by dispatch run 43690899321 (branch isolate-agent/opt-in, Remediate isolated). Supersedes the 06:02 content from scheduled run 43682281142. Updated in place instead of filing a second report for the same date.

Errored PRs

None. The remediation handoff found zero open PRs. Re-read in this run: 0 open PRs. Since the scheduled pass, main advanced to ca4aabe (#4250, docs only), and Main CI 43691516798 on it succeeded. No branch was repaired.

Security

• Dependabot: 0 open alerts. bun scripts/check-override-floors.ts exits 0 on 9be739e, per the handoff.
• Code scanning: 5 open alerts, re-read in this run: 3 high, 1 medium, 1 low. All are Scorecard posture rules with no file location. Clearing them means changing settings or branch protection, which no automated fix may do.
• The katex (low) and minimatch (moderate) dev-only advisories noted this morning stay with Renovate; the handoff opened nothing for them.
• No security-update PR exists to repair.

Control-Plane Integrity

Per the handoff: 0 floating uses: refs across .github/workflows/*.yaml and .github/actions/**/action.yaml; every workflow declares top-level permissions: and none uses write-all; strip-only lint passes; wiki-authority, privacy gates and branch protection untouched. No PR opened.

Code Quality

Per the handoff, on a clean checkout of 9be739e: bun run bootstrap, check-types and lint pass. bun run test reported 15 failures in 5 files, all in git-subprocess or spawn-exit-code tests. Main CI 43681616030 is green on the same SHA, and the scheduled pass this morning (not isolated) reported 0 failures. I confirmed the git half of the mechanism in the agent's own source (see item 5); the exit-code half is the handoff's claim only. No code fix is warranted: the tests are right and must not be weakened.

Oversight

Scope and method

Listed the authenticated account's repositories (owner, collaborator, organization member; paginated) plus each organization's repositories, deduplicated, and checked each with gh repo view --json visibility. This report covers the 41 that returned PUBLIC. No listing call failed. Snapshot taken at about 07:50 UTC.

Definitions are unchanged: new issue = created in the last 24 hours; stale issue = open, no update for >30 days; aging PR = >7 days since creation; stale PR = >14 days since last update (updated_at covers commits, reviews, comments and state changes, and label edits too, so it can only undercount staleness); failing signal = latest default-branch run of an active workflow failed.

Totals: 21 new issues, 161 open PRs, 138 aging, 87 stale, 95 stale issues and 4 unassigned bugs. The stale-PR count rose from 80 because several Renovate PRs crossed the 14-day idle line since 05:53 (sparkle, tokentoilet, marcusrbrown.github.io, marcusrbrown.com).

Next step for every queue: triage new issues, clear the review or check gate on aging PRs, ask maintainers to refresh or close stale work, and assign and reproduce unassigned bugs. Routine dependency PRs belong to Renovate. Nothing was closed or labeled.

Top three hotspots

Score = distinct open findings: open PRs, new/stale/unassigned-bug issues, open alerts, failing signals. Ties broken by name.

Issue and PR queues

Repos with no open PRs and no qualifying issues are left out.

Security queues and source availability

Next step for every alert queue: confirm severity and reachability, reuse any existing security-update PR, and keep scanner guardrails on. Code-scanning counts can include Scorecard posture findings. "HTTP 404/403" or "not readable" means the source is not enabled or not readable with this token. That means unknown, not zero. No alert details are copied here.

Alert counts were re-read in this run for every public repo and match the 05:53 snapshot exactly.

Default-branch failure signals

• fro-bot/.github — Merge Data Branch: still the latest run, failed 2026-11-15 01:26 at step "Block private repo names in promotion diff". No run since. See Awaiting you, item 2.
• marcusrbrown/dev-like — Link Check: failed 2026-11-09. Next: read which links broke before retrying.
• marcusrbrown/extend-vscode — Publish: failed 2026-11-14 16:20 in its vulnerability scan. See hotspot 1.
• marcusrbrown/infra — Deploy Gateway (standalone): latest run failed 2026-11-07. Historical: the router delivered Gateway on 2026-11-14. Next: retire or repair the standalone route.
• marcusrbrown/marcusrbrown.github.io — Performance Testing: failed again 2026-11-15 03:40 (newer than the run cited this morning). Next: read the log before retrying.
• Router VPN job: infra job 132606204404 timed out on SSH at 2026-11-14 23:11, the third in a row. Later router runs are green because they deploy nothing. See Awaiting you, item 1.
• Cleared since this morning: fro-bot/agent — Auto Release now has a successful latest run (2026-11-15 05:20).

Program tracker: Gateway (review-only)

Tracker #3512 is unchanged since 2026-11-14 13:19 UTC; its latest tracker run 43598751886 succeeded and none has run since. Project 1 still shows 148 items (147 Done, 1 In Progress), matching the tracker's In Progress / blocked.

The dedicated tracker workflow owns the rewrite. I posted no tracker comment and edited no Project field.

Cross-Project Intelligence

Every entry in metadata/repos.yaml was checked: 32 confirmed-public tracked repos, each read for commits touching .github/ or AGENTS.md since 06:00 UTC (the scheduled pass covered the 24 hours before). No read failed; coverage is complete. No such commits landed, so there is nothing new to adopt.

The scheduled pass's finding stands: the upstream isolate-agent prerequisites (fro-bot/agent#2209, #2213, #2217) ship in the pinned v0.144.1. This dispatch adds first trial evidence: on isolate-agent/opt-in (37ea88f), Remediate ran isolated with persist-credentials: false on its checkout and the job succeeded. The cost showed up in its local test signal (item 5).

Progressive Improvement

• Tool versions in package.json, against the npm registry latest dist-tag read in this run, major drift included:
  • ESLint 10.14.0 → 10.15.0: one minor, under the threshold.
  • Prettier 3.10.0 → 3.10.1: patch.
  • TypeScript 6.0.3 → 7.0.2: a major behind, held on purpose by the <6.1.0 hold. @typescript-eslint/parser 8.72.2 still peers typescript >=4.8.4 <6.1.0. Renovate owns lifting it.
  • Vitest 5.1.0: current.
• CI: main.yaml green on ca4aabe. No required job missing or degraded.
• Conventions: the handoff found no drift from .github/copilot-instructions.md.
• TODO/FIXME: nothing actionable. Only a synthetic fixture in check-private-leak.test.ts and this scan's own prompt text.
• Compounding: open learning-proposal issues: 0. Open docs/drafted-solutions PRs: 0. #4250 merged three solution docs today. Nothing stalled; Improvement Metrics #3674 not used as evidence.

Remediation Learnings

Remediation learnings: 1 staged for the wiki, 0 skipped.

The one item (isolate-agent git trust in the sandbox) was checked against the agent's own v0.144.1 source rather than the run log: writeSandboxGitConfig writes safe.directory for the runner-owned checkout only into the fro-bot-sandbox account's own ~/.gitconfig. Staged on knowledge/wiki/repos/fro-bot--agent.md with a knowledge/log.md entry. The log-only details (exit codes, failure counts) were left out.

Needs Human Attention

Awaiting you

1. Diagnose why the VPN deploy can't reach its host over SSH. Owner: you (@marcusrbrown). Observed. First seen 2026-11-13.
   • Evidence, re-read: the router's deploy-vpn job timed out on SSH three times in a row, latest job 132606204404 (2026-11-14 23:11), after 132156186313 and 131612947330. infra#1906 is open.
   • Step: from an authorized workstation, confirm the instance is running, SSH reaches it, and the firewall/source allowlist admits the runner (docs/runbooks/vpn-egress-box.md in infra). Then re-dispatch and confirm deploy-vpn passes its WireGuard health gate.
   • Don't rotate keys, reprovision or change environment secrets without a separate decision.

key: marcusrbrown/infra#1906 — vpn-deploy-ssh-timeout

2. Clear the promotion leak-gate block on Merge Data Branch. Owner: you (@marcusrbrown). Observed. First seen 2026-11-15.
   • Evidence, re-read: run 43663083818 is still the latest; job Merge data into main failed at "Block private repo names in promotion diff". The 2026-11-14 run 43543306120 passed. No promotion PR is open.
   • Step: open the failed step's log and note the matched file; resolve the redacted token locally with the lookup the gate prints; correct the entry on data through the established writers (never hand-edit main); re-dispatch merge-data.yaml.
   • Don't weaken or bypass the gate. Verify: the --promotion step reports no match and the promotion PR opens.
   • Also check which writer let the entry onto data; the wiki-presence gate should have caught it first.

key: fro-bot/.github/.github/workflows/merge-data.yaml — promotion-leak-gate-block

Other attention

3. Escalated to #4226: exercise the survey page-conflict recovery path. Owner: @marcusrbrown. First seen 2026-11-12. No survey has run since 43681628468; the path is still unexercised.

key: fro-bot/.github/.github/workflows/survey-repo.yaml — survey-conflict-retry-validation

4. Tracked in #4236, which you filed: hold isolate-agent until the prerequisites land. Owner: @marcusrbrown. First seen 2026-11-13. Refreshed: the upstream prerequisites are in the pinned v0.144.1, and this dispatch trialed the flag on Remediate from isolate-agent/opt-in with persist-credentials: false on that checkout; the job succeeded. On main, both agent checkouts still persist credentials. Close condition is yours.

key: fro-bot/.github/.github/workflows/fro-bot.yaml — isolate-agent-adoption

5. Make the sandbox's checkout trust survive a changed HOME. Owner: @marcusrbrown (fro-bot/agent). Observed in source; impact inferred from the handoff. First seen 2026-11-15.
   • Root cause: in fro-bot/agent v0.144.1, writeSandboxGitConfig adds safe.directory for the runner-owned checkout to ~/.gitconfig of the fro-bot-sandbox account only. Any git process the agent starts with its own HOME or GIT_CONFIG_GLOBAL (test suites that isolate git do exactly that) loses the entry and refuses the checkout as dubious ownership. The handoff reported 15 local test failures from this and a related spawn exit-code difference, with Main CI green on the same SHA.
   • Smallest safe fix (in fro-bot/agent, not here): add a safe.directory entry for exactly the workspace path at system level (git config --system, i.e. /etc/gitconfig) during prepare, and remove it at take-back. Environment-based config (GIT_CONFIG_COUNT, GIT_CONFIG_SYSTEM) is not enough: tests that replace the environment wholesale drop it too. Separately, find why spawned commands exit 126 rather than 127 under the read-only mount view.
   • Don't weaken or skip the fro-bot/.github tests to suit the sandbox, and don't use safe.directory=*.
   • Verify: run bun run test on fro-bot/.github main inside an isolated step and expect 0 failures.

key: fro-bot/agent — isolate-agent-sandbox-git-trust

Re-checked before publishing (~07:55 UTC):

• infra#1906 is open and the VPN job's latest attempt timed out.
• Merge Data Branch has no run newer than the failed one.
• Exercise the survey page-conflict recovery path in production #4226 and Hold isolate-agent on the scheduled agent jobs until the upstream rollout prerequisites land #4236 are open.
• Escalation: items 1 and 2 are "Awaiting you"; item 3 is already Exercise the survey page-conflict recovery path in production #4226; item 4 is tracked by your Hold isolate-agent on the scheduled agent jobs until the upstream rollout prerequisites land #4236; item 5 is new today. No tracking issue filed, none closed (Exercise the survey page-conflict recovery path in production #4226's path is still unexercised; #4164 was already closed).

I did not branch, commit, push, open a PR, change labels on existing issues, or edit metadata or the index. The working tree arrived already carrying data-branch wiki/metadata changes; I left those untouched and added only the fro-bot--agent.md section and one log entry.

Run 43690899321 · Earlier run today 43682281142 · Previous report #4227