[uk ai resilience] UK AI Open Code Risk & Resilience Report – 2026-11-09

[github-actions[bot]]

Executive summary

Lookback 7 days (since 2026-11-02): 396 commits, 216 security-signal commits, 33 open security issues, 14 open code-scanning alerts, 0 secret-scanning alerts. Most findings are already tracked by open issues. One untracked gap: unpinned pip install in harbor-conformance.yml (alert 1072). Limitation: sub-agents were not dispatched in this run, so classification is direct with partial confidence.

Tier classification

Tier table

Area	Tier
Go/JS scanning findings (alerts 1060-1062)	B (fixes merged, verification pending)
Workflow lockfile npm install (1070-1080)	B
harbor-conformance pip install (1072)	B
Engine network allow-list defaults (7 domains-audit issues)	B
Container image CVEs	B
Credential failures (smoke, sous-chef)	B
Tier C/D	none

Control verification gaps

• Ownership: not verified (low confidence)
• SDLC: non-deterministic installs in generated lock files
• Dependency: unhashed pip install; container CVE backlogs
• Secrets: 0 alerts, but Bad credentials failures suggest token config drift
• Observability: stalled fixer attempts (alerts 1068, 1069)
• Recovery: no per-binary release attestations (open issue)

Risk scoring

Scores (1-5, higher is riskier)

Area	Exposure	Patchability	Detectability	Fragility	Ownership conf.	Priority
Engine domain defaults	4	2	3	3	3	high
Credential failures	2	2	1	4	2	high
npm lockfile installs	3	2	2	2	3	medium
pip no-hash	3	1	2	2	2	medium
Zip/sanitizer/validator	3	1	2	2	3	medium
Container CVEs	3	2	2	3	3	medium

Remediation queue

Action	SLA
Enforce opt-in on domains-audit findings	high
Fix per-handler/side-repo token config	high
Hash-pin pip deps in harbor-conformance	medium
Verify merged fixes, close alerts 1060-1062	medium
Lockfile npm install in generated workflows	medium
Container CVE burn-down	medium

Exception register

None.

Metrics baseline

• MTTR proxy: 3 of 14 alerts have merged fixes in window
• Ownership coverage: not measured
• Unsupported dependency ratio: not measured
• Exception aging: n/a
• Exposure without recovery capability: 1 (release attestations)

Generated by UK AI Operational Resilience · copilot · auto (Claude Sonnet 5.5) · ~17 AIC · ⌖ ~2 AIC · ⊞ 8.8K · ◷

• expires on Nov 12, 2026, 7:31 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #76550.