[uk-ai-advisory:operational-resilience] Operational resilience advisory for githubnext/gh-aw-cao

Recent repository churn keeps `githubnext/gh-aw-cao` operationally active and therefore a candidate to remain open by default under the UK guidance, but this run cannot verify the minimum automated vulnerability-hygiene baseline. Advisory status is **INCOMPLETE** for the fixed UTC window `2026-09-09T17:01:07Z` to `2026-09-16T17:01:10.673Z`; highest proposed tier is **B — Open With Conditions candidate** because the most decision-relevant gap is unreadable or unavailable alert evidence, not a justified case for closure. Key observed metrics: public MIT-licensed repository, `* @github/next` CODEOWNERS signal, published vulnerability intake in `SECURITY.md`, 14 open dependency vulnerability alerts visible by GraphQL, and 142 workflow-path commits in the seven-day window. This workflow cannot observe branch protection, operational telemetry, deployment topology, incident handling, or patch-SLA attainment outside repository evidence.

**Action:** A maintainer with security-feature authority should verify and document code scanning, secret scanning, and Dependabot alert coverage for `githubnext/gh-aw-cao`; acceptance is a readable state or explicit disabled-state evidence for all three controls plus an owner and remediation path for any gap.

### Advisory Status
INCOMPLETE

### Scope and Evidence
- **Observed:** public repository, not archived, MIT license, default branch `main`, active push at `2026-09-16T16:59:33Z`; `SECURITY.md` routes vulnerability reports to `opensource-security[@]github.com`; `.github/CODEOWNERS` assigns `* @github/next`; root `package.json` uses Node.js/Actions tooling with an explicit `undici` override; recent commits heavily touched dashboard, activity, workflow, and runtime-control surfaces.
- **Observed recent-change focus:** 142 commits in `.github/workflows/` during the seven-day window; recent changes include test-failure fixes, workflow/runtime hardening, action updates, dashboard query changes, and release/runtime path adjustments.
- **Observed security signals:** GraphQL returned **14 open dependency vulnerability alerts** (3 high, 9 moderate, 2 low) affecting `undici`, `vitest`, and `@vitest/mocker`; vulnerability reporting route is present.
- **Inaccessible or unavailable evidence:** prefetch reports `secret_scanning_alerts` inaccessible (`403`) and `dependabot_alerts` inaccessible (`400`); repository metadata does not affirmatively state whether those controls are disabled; no `.github/dependabot.yml` was present in the checked-out target snapshot despite prefetch listing dependency automation separately.
- **Out-of-repository evidence required:** branch protection/trunk enforcement, patch SLA policy and attainment, deployed-service exposure, runtime observability, rollback drills, on-call ownership, and any approved closure exception record.

### Asset Graph
- **Changed surfaces:**
- GitHub Actions control plane and packaged workflows under `.github/workflows/`
- Activity collection, runtime control, and logging paths
- Dashboard data/query engine and browser-worker surfaces
- Dependency/runtime surfaces in root and dashboard `package.json`
- **Ownership signals:** `CODEOWNERS` points to `@github/next`; active maintainer cadence is high; `SECURITY.md` provides a vulnerability intake route.
- **Dependency signals:** npm-based runtime and test dependencies are present; current visible open alerts cluster around `undici` and Vitest-related packages.
- **Provisional concern areas:** high workflow churn, unresolved alert-coverage visibility, and no repository-evidenced rollback/patch-SLA metrics for privileged workflow surfaces.

Recent commits most relevant to resilience review

- `602fbd0` — `[WIP] Fix failing GitHub Actions job 'test' (#12212)`
- `5e3de23` — `Add filtered aggregations to Dashboard Language (#12176)`
- `af7870d` — `Aggregate audit events by workflow and summary (#12199)`
- `d457bdd` — `Check activity and dashboard JavaScript packaging (#12124)`
- `1f48ddf` — `Enhance CAO Activity workflow and logging (#11574)`
- `1740ab3` — `Upgrade agentic workflows to gh-aw v0.89.15 (#11276)`

These indicate continued change on execution, data, and workflow-control surfaces rather than dormancy.

### Proposed Tier Classification
- **Repository advisory tier:** **B — Open With Conditions candidate**.
- **Why not A:** the UK guidance requires credible automated hygiene and remediation capability for public systems; this run cannot verify alert coverage end-to-end, and visible vulnerability alerts remain open.
- **Why not C or D:** the guidance remains open-by-default, and no evidenced, time-bounded closure exception record exists. Missing evidence prevents recommending closure and caps the proposed tier at B.

### Control Verification Gaps
- **Ownership:** partially evidenced by `CODEOWNERS` and active commits; named accountable service owner and maintenance horizon are not fully evidenced.
- **Secure-by-design development:** partially evidenced by workflow-hardening and maintenance activity; no threat model or architecture assurance artefact was observed for this review.
- **Automated dependency and vulnerability hygiene:** incomplete. Open dependency alerts are visible, but secret-scanning and Dependabot state are not verifiable from accessible evidence.
- **Patch SLAs and remediation capability:** remediation activity is visible, but stated SLAs and conformance metrics were not observed.
- **Inbound vulnerability response:** present via `SECURITY.md`; monitored triage performance is not evidenced.
- **Secret exposure prevention:** cannot be confirmed without readable secret-scanning state or equivalent enforcement evidence.
- **Runtime observability:** logging-related changes exist, but operational telemetry coverage and alerting quality are not evidenced.
- **Recovery controls:** rollback readiness for workflow/runtime changes is not evidenced in repository materials reviewed.

### Risk Scoring and Rationale
- **Exposure amplification:** medium-high. The repository is public and changes rapidly on workflow and automation surfaces where AI-assisted analysis can shorten discovery-to-exploit time.
- **Patchability:** medium-positive. High maintainer activity suggests capacity to remediate, but open alerts and absent SLA evidence prevent a stronger score.
- **Detectability:** uncertain. Missing secret-scanning / Dependabot verification weakens confidence in early detection.
- **Operational fragility:** medium. Frequent changes on workflow, automation, and dashboard runtime surfaces increase the chance of regression if controls drift.
- **Ownership confidence:** medium. Team ownership signal exists, but support horizon and accountable owner details are not explicit.
- **Overall rationale:** keep open by default, but only with stronger evidence that automated hygiene and remediation controls are functioning and reviewed.

Alert snapshot used in scoring

Visible open dependency vulnerability alerts from GraphQL: 14 total.
- High: 3 (`undici` WebSocket / decompression-related advisories)
- Moderate: 9 (`undici`, `vitest`, `@vitest/mocker`)
- Low: 2 (`undici` cookie/queue poisoning-related advisories)

Oldest visible open alert in the returned set was created `2026-09-07T07:51:20Z`, which predates the seven-day analysis window slightly. Patch-SLA compliance cannot be determined because no SLA was evidenced.

### Prioritized Remediation Queue
1. **Verify and restore complete alert visibility for code scanning, secret scanning, and Dependabot controls**
- Urgency: **high**
- Validation evidence: readable control state for all three features, or explicit metadata/policy evidence that a feature is intentionally disabled
- Human owner or owner gap: repository security-feature maintainer required; owner not evidenced in reviewed materials
- Review trigger: any control still unreadable after review, or any newly confirmed critical/high alert without an assignee and due date
2. **Triage the 14 visible open dependency vulnerability alerts and record patch expectations**
- Urgency: **high**
- Validation evidence: disposition for each alert, patched versions or justified exceptions, and documented target timelines for the 3 high-severity items
- Human owner or owner gap: package/runtime maintainer required; explicit owner gap if none is nominated
- Review trigger: any high-severity alert remains open beyond the agreed SLA
3. **Document rollback and observability controls for workflow/control-plane changes**
- Urgency: **medium**
- Validation evidence: repository-accessible description of rollback path, key runtime signals, and how failed workflow changes are detected quickly
- Human owner or owner gap: workflow/control-plane maintainer
- Review trigger: future privileged workflow incidents or repeated hotfix/revert cycles

### Recommended Next Action
The single highest-return action is to **verify and restore complete automated alert visibility**. That comes first because the UK guidance treats openness as acceptable when teams can detect and remediate quickly; right now the biggest blocker is uncertainty about whether important security-hygiene controls are active, readable, and reviewed for a public, fast-changing automation repository. Once that evidence is restored, maintainers can judge the visible dependency alerts and any remaining risk with far less ambiguity.

Agent prompt

Verify the `githubnext/gh-aw-cao` automated vulnerability-hygiene controls for code scanning, secret scanning, and Dependabot alerts. Determine for each control whether it is enabled and healthy, intentionally disabled, or failing because of permissions or configuration drift. Do not change repository visibility. Produce or update repository-accessible evidence that records the control state, the accountable owner, any owner gap, and the exact remediation needed to restore verifiable alert coverage for public workflow, dependency, and automation surfaces. Completion evidence is: (1) readable alert state or explicit disabled-state evidence for all three controls, (2) a named owner for each control, and (3) any required remediation tracked with an acceptance check.

### Open-Code Exception Register
none

### Operational Metrics Baseline
- Open-alert age against the stated patch SLA: **not measurable**; no explicit SLA was evidenced
- Inbound vulnerability reporting route: **present** via `SECURITY.md`
- Ownership coverage: **partial**; team-level CODEOWNERS signal present, named accountable owner not evidenced
- Unsupported dependency ratio: **not measurable** from reviewed evidence
- Exception aging: **none evidenced**
- Exposure without recovery capability: **partially evidenced risk**; public high-churn automation surfaces are visible while rollback evidence is absent

### Human Review Required
- Determine whether secret scanning and Dependabot alert access failures represent disabled features, permission scope, or configuration drift.
- Review the 14 visible dependency vulnerability alerts, especially the 3 high-severity items, against current patch expectations.
- Confirm named accountable ownership, patch SLAs, and rollback readiness for workflow/control-plane surfaces.
- Confirm whether any subset of the repository relies on an open-code exception; if so, record attacker, added publication risk, path to harm, bounded scope and duration, compensating controls, expiry, and re-approval owner.

### Control Plane
- Correlation ID: `35124888896-325`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/35124888896

> Generated by [:shield: UK AI Advisory / Resilience](https://github.com/githubnext/gh-aw-cao/actions/runs/35125342587) · pi · gpt54 · 59.7 AIC · ⊞ 10K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fuk-ai-advisory-operational-resilience%22&type=issues)
> - [x] expires on Oct 16, 2026, 5:05 PM UTC

Inspect SECURITY.md, .github/CODEOWNERS, .github/workflows/, and the root package.json, then verify code scanning, secret scanning, and Dependabot state through the repository’s GitHub security controls. Done means each control has readable or explicit disabled-state evidence, a named owner, and tracked remediation for any gap; also record dispositions and target timelines for the 14 visible dependency alerts.

Written by the indexing model from the issue text.