[uk ai resilience] UK AI Open Code Risk & Resilience Governance — Weekly Review (2026-08-03)

[github-actions[bot]]

Executive Summary

Recent-changes-focused governance review of github/gh-aw for the 7-day window (2026-07-27 → 2026-08-03), per the [UK AI open code and vulnerability risk guidance]((www.gov.uk/redacted) 399 commits landed in the window (165 flagged with security-relevant keywords), overwhelmingly authored by the Copilot coding agent with human co-authorship/review from @pelikhan and automated merges via gh-aw-bot. Recent activity centers on workflow-compiler and agentic-workflow reliability fixes (repo-memory patch-size gating, tool-denial guardrails, token/credit budget tuning, shellcheck hardening across 269 recompiled workflow lock files) rather than net-new feature surface — a low-novelty, high-remediation-velocity change pattern.

No new distinct high-priority findings emerged that aren't already under active tracking. All 5 open code-scanning alerts and the highest-risk open security issues (GraphQL injection, missing CODEOWNERS, unsafe network-to-file write, XPIA/prompt-injection in memory subsystems) already have dedicated open uk-ai-resilience-labeled issues from prior runs. No new issues are created this run — see Phase 6.

Note on sub-agent orchestration: the asset-tier-classifier and control-verifier sub-agents were dispatched in parallel per the standard workflow but returned empty responses after one retry each. Findings below were therefore compiled directly from precomputed inputs and targeted repository checks (confirmed: .github/CODEOWNERS absent; Makefile correctly uses go install for actionlint/gosec, not vendored binaries — consistent with alert #653 describing a one-off historical commit). This is recorded as a partial-confidence limitation.

Asset Graph Summary (recent-change scoped)

Segment	Nature of recent change	Risk relevance
.github/workflows/*.md → *.lock.yml (269 files)	Bulk recompilation for shellcheck (SC2015/SC2086) fixes, `A && B
Agentic workflow definitions (Metrics Collector, Layout Specification Maintainer, Issue Arborist, arxiv-researcher)	Patch-cap/token-budget/tool-denial guardrail fixes	Safe-outputs & memory subsystem stability
pkg/cli/project_command.go	No new change this window, but GraphQL injection alerts (#651/#652) remain open against this file	Already tracked (#47822)
scripts/ensure-docs-slide-pdf.js	No new change this window; alert #636 (network write) remains open	Already tracked (#47630/#43831)
Repo-memory / cache-memory safe-output subsystem	Active hardening (patch-size net-diff enforcement, cap increases)	Positive resilience signal
Git history (historical, not this window)	Vendored actionlint/gosec binaries from PR #48979 (alert #653)	Dependency-supply-chain hygiene

Tier Classification Table

Area	Tier	Rationale
Repo-memory/cache-memory patch gating (this week's fixes)	Tier A — Open Safe	Active remediation, fast iteration, no outstanding alert
Workflow lock-file recompilation / shellcheck hardening	Tier A — Open Safe	Defensive quality improvement, low risk
pkg/cli/project_command.go GraphQL injection (#651/#652)	Tier B — Open With Conditions	Partially mitigated via escapeGraphQLString(); formal parameterization still pending; already tracked in #47822
Missing .github/CODEOWNERS (#49167)	Tier C — Restricted Pending Review	Confirmed absent on disk; security-sensitive paths (pkg/cli, scripts/, .github/workflows) lack enforced review routing
Vendored actionlint/gosec binaries in git history (#653)	Tier B — Open With Conditions	Historical artifact, Makefile confirms correct go install usage going forward; needs git-history cleanup, not active exploit path
ensure-docs-slide-pdf.js network-to-file write (#636/#47630)	Tier C — Restricted Pending Review	CWE-434/912 pattern, already flagged, remediation still open
XPIA/memory-poisoning in repo-memory & cache-memory (#45777/#28775/#47114)	Tier C — Restricted Pending Review	Unresolved >6 months per prior tracking; this week's patch-cap fixes touch adjacent code but do not address sanitization

Control Verification Gaps

Control Domain	Status	Evidence
Ownership	Missing	.github/CODEOWNERS confirmed absent; tracked in open issue #49167
SDLC	Partial	Makefile has security-gosec, security-govulncheck, correct go install targets (lines 637-638); but historical commit still vendored binaries per #653
Dependency	Partial	Build path is sound going forward; git-history cleanup for the 8MB/69MB binary blobs not yet done
Secret exposure	Present	0 open secret-scanning alerts
Runtime observability	Present	Namespaced DEBUG=cli:* logger infra, audit/log tooling exist per repo conventions
Recovery	Present (strong)	Multiple same-window PRs (#49970, #49966, #49974, #49965, #49894) show same-day/next-day remediation of newly discovered gating/guardrail failures — good MTTR signal

Risk-Scoring Table and Rationale

Finding	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier
GraphQL injection (#651/#652, tracked #47822)	Medium (authenticated CLI context, not public web)	High (fix is a parameterization change)	High (CodeQL/Semgrep already flags it)	Low	Medium (no CODEOWNERS routing)	B
Missing CODEOWNERS (#49167)	Low direct, High indirect (weakens all other controls)	High (single config file)	High (structural check)	Medium	Low (this is the gap itself)	C
Vendored binaries in history (#653)	Low (build path already fixed)	Medium (requires history rewrite or accept-and-forget)	High	Low	Medium	B
Network-write in ensure-docs-slide-pdf.js (#636/#47630)	Medium	Medium	High	Low	Medium	C
Memory/cache XPIA poisoning (#45777 et al.)	High (prompt injection can chain to broader agent compromise)	Low (needs sanitization-layer design, not a one-line fix)	Low-Medium (no runtime detection layer yet)	Medium	Medium	C

Remediation Queue with SLAs

Item	Action	SLA Urgency	Tracking
CODEOWNERS gap	Add .github/CODEOWNERS covering pkg/cli/, scripts/, .github/workflows/	High	#49167 (open)
GraphQL injection	Replace manual escaping with parameterized/typed GraphQL query builder in project_command.go	High	#47822 (open)
Vendored binaries	Purge historical blobs from git history or accept via documented exception; confirm CI enforces go install only	Medium	#653 / #50020 (open, dedup tooling in progress)
Network-write CWE-434	Validate/sandbox network response before file write in ensure-docs-slide-pdf.js	Medium	#47630 (open)
Memory/cache XPIA sanitization	Implement sanitization layer for repo-memory/cache-memory content (design + implement)	Critical (>6mo unresolved)	#45777, #47114, #28775 (open)

No new issues created — all above already tracked with uk-ai-resilience/security labels from prior runs; duplicate check via gh api search/issues confirmed each remains open.

Exception Register

None proposed this run. No temporary hidden-repo or scope-reduction exceptions are recommended; all findings route to standard remediation tracking.

Operational Metrics Baseline

• MTTR proxy: Strong — same-week guardrail/gating regressions (e.g. Increase Metrics Collector repo-memory patch cap to prevent push_repo_memory gate failures #49970, [aw] Prevent Layout Specification Maintainer early termination from tool-denial guardrail #49966) were fixed within 1-2 days of introduction.
• Ownership coverage: 0% formal (no CODEOWNERS); informal coverage via single human reviewer (@pelikhan) across nearly all Copilot-authored PRs.
• Unsupported dependency ratio: Low for Go modules (govulncheck gate present); container image findings (18+ open container-scan issues) represent the largest untriaged dependency surface.
• Exception aging: N/A this run (no exceptions registered); however XPIA/memory-poisoning issues aging >6 months indicate a real remediation-velocity gap outside the fast-moving CI/workflow-compiler track.
• Exposure without recovery capability: Low for this week's changes (fast iteration, immediate fixes observed); Medium for the memory-sanitization backlog, which lacks a design/implementation path despite long tracking.

Limitations: asset-tier-classifier and control-verifier sub-agents did not return substantive output after retry; analysis above was completed directly from precomputed context files and targeted repository checks, and should be treated as partial-confidence pending a future run with functioning sub-agents.

Generated by UK AI Operational Resilience · auto · 49.5 AIC · ⌖ 4.75 AIC · ⊞ 8.8K · ◷

• expires on Aug 6, 2026, 8:18 AM UTC-08:00