Daily Org Oversight Report — 2026-05-26 (UTC)

[fro-bot]

Scope: all repositories in the fro-bot GitHub organization. Data pulled via gh at run start. Links only; no content duplication.

Previous report: #3374.

Privacy gate failed twice — confirmed blocking pattern. Today's Merge Data Branch workflow_dispatch retry (08:05Z) hit the same 🔒 Block private wiki pages failure as yesterday's scheduled run. Two failures in a row on the same step, including a manual retry. This isn't transient — the data-branch merge cadence is broken until someone reads the gate output and either patches the false positive or acts on the real catch.

Summary metrics

Metric	Count	Δ vs yesterday
Repositories scanned	5 (tokentoilet archived)	—
New issues (last 24h, org-wide)	2 (1 autohealing, 1 oversight — both bot-generated)	+1
Open issues, org-wide	31	+1
Open PRs (org-wide)	6	0
Aging PRs (>7d no activity)	1	0
Stale PRs (>14d no activity)	1	0
Stale issues (>30d no activity)	5	0
Failing main-branch workflows	2 (agent → Auto Release ~65d; .github → Merge Data Branch ~2d, retry failed)	0
Open code-scanning alerts	8 (.github=3, agent=5)	0
Open Dependabot alerts	1 (agent brace-expansion CVE-2026-45149, no upstream fix)	0
Untriaged audit backlog from #3352	14 issues	0 (day 6 unchanged)

Critical items

Repo	Item	Link	Recommended action
fro-bot/.github	Merge Data Branch failed twice on 🔒 Block private wiki pages (scheduled 2026-05-24 + manual retry 2026-05-25 08:05Z). Same step, same failure. Last successful run was 2026-05-17.	latest run... yesterday's	P0. Read the gate output (job log → 🔒 Block private wiki pages step). The manual retry proves the input is sticky. Decide: (a) patch the gate (matches #3327 defense-in-depth gaps), or (b) remove the offending content from the data branch. Either way, the merge cadence is paused until someone acts.
fro-bot/agent	Dependabot #72 brace-expansion CVE-2026-45149, CVSS 6.5, no upstream fix yet (day 2).	alert 72	Check upstream once more; if no fix, document the runtime-exposure assessment in the alert.
fro-bot/.github	Governance bug #3369 — day 3 untouched. Agent still blocked from merging its own PRs cleanly.	#3369	Patch the agent's review-submission path to use formal gh pr review --approve.
fro-bot/.github	Privacy-gate cluster (P0, day 6 untouched). Now actively in production — see above.	#3326, #3327, #3328, #3345	#3327 is the most likely match for the symptom. Read it alongside the failing log.
fro-bot/.github	Reconciler cluster (P1, day 6 untouched).	#3319, #3320, #3332–#3337, #3340	One hardening pass.
fro-bot/.github	Social broadcast TOCTOU (P1, day 6 untouched).	#3325	Patch.
fro-bot/agent	Auto Release failing on main since 2026-03-22 (~65d red). Ninth report.	run 23399265449	Delete or fix.
fro-bot/agent	Scorecard (5).	code scanning	Verify #13 Vulnerabilities. Carryover.
fro-bot/.github	Scorecard (3).	code scanning	Carryover.

Aging PRs (>7d no activity)

Repo	PR	Age
fro-bot/systematic	#2 feat(deps): configure Renovate	30d

All 5 agent PRs are Renovate, updated within the last 24h. Healthy churn.

Stale issues (>30d no activity)

Repo	Issue	Age	Recommended next step
fro-bot/systematic	#1	78d	Decide or close. Ninth report.
fro-bot/fro-bot.github.io	#1	78d	Close as N/A. Ninth report.
fro-bot/.github	#3161, #3160, #3159	~35d	Triage. Close if surveys complete.
fro-bot/.github	#2828 Dependency Dashboard	~297d	Renovate-managed; pin and stop reporting.

Unassigned bugs or high-signal issues

bug label still doesn't exist on fro-bot/.github. 17 unlabeled high-signal items:

Cluster	Issues	Days untouched
Privacy gates (now actively failing in CI)	#3326–#3328, #3345	6
Reconciler correctness	#3319, #3320, #3332–#3337, #3340	6
Social broadcast	#3325	6
Governance bug	#3369	3
Enhancement	agent#671	3

Repo hotspots

1. fro-bot/.github — 27 open issues (17 carryover + 4 autohealing + 3 surveys + 1 dep dashboard + 2 today). Plus the actively-failing privacy gate. The center of gravity hasn't moved.
2. fro-bot/agent — 5 Renovate PRs, 3 open issues. Steady churn; only Auto Release stays red.
3. fro-bot/systematic — Tenth report on the same orphaned PR (fix: add @fro-bot as a collaborator to prevent it from being "removed" #2, 30d) and issue (feat: set default settings #1, 78d). At a month cold, the Renovate PR has probably gone semantically stale even if mechanically the rebase would still work.

Recommended actions (checklist)

• P0 (urgent — merge cadence broken): Read the Merge Data Branch failed log (the run → Merge data into main job → 🔒 Block private wiki pages step). The retry proves it's sticky. Patch or remove the trigger.
• P0 (carryover): Recheck Dependabot #72 upstream status.
• P0 (carryover): Fix #3369.
• 30-second closes: fro-bot.github.io#1; .github#3161/#3160/#3159 if surveys done.
• 2-minute delete: agent → Auto Release workflow.
• High-leverage security (now urgent): Assign #3328; read #3327 against the failing log.
• Label hygiene: Create bug + security labels on fro-bot/.github.
• Carryover: Audit cluster, systematic#2/#1, Scorecard triage.

---

Run Summary

• Event: schedule
• Repo: fro-bot/.github
• Ref: refs/heads/main
• Run ID: 26431515614
• Cache: hit
• Sessions used: ses_1c6ba9e0dffe7oK9VLD2oWDr9c (prior thread)
• Logical Thread: schedule-898cd73a
• Mode: branch-pr (single summary issue)
• Repos scanned: 5
• Data sources: gh issue list, gh pr list, gh api actions/workflows, gh api code-scanning/alerts, gh api dependabot/alerts

[fro-bot]

Auto-closed: daily report retention policy (3 days). Superseded by newer reports.