Agentic OS Status
A live view of the Free For Charity Agentic OS: the automation backlog that sandboxed AI agents pick up, the pull requests in flight, deployment gates awaiting a human, and the latest entries from the Conductor log.
Updated today () · FreeForCharity/FFC-Cloudflare-Automation · raw JSON
203 backlog issues23 of 84 PRs in flight0 gates waiting
Pull requests in flight
What counts: Open pull requests that are agent work on this backlog, across every repository listed in `repos` — the same org-wide scope as the backlog above, and as the pickup query in AGENTS.md. A PR is listed when it carries the agentic-os label, or when its body references an agentic-os issue in its OWN repository (e.g. 'Closes #123' / 'Refs #123'); a bare #123 is repo-local, so the same number in two repos is two different issues. Both paths genuinely fire: some PRs do carry the label, applied by the authoring agent or by hand, but NO automation applies it (see FFC-Cloudflare-Automation#1070), so the referenced-issue path is what makes this listing reliable rather than best-effort. `open_prs_total` is the unfiltered open-PR count over exactly these same repositories.
#1650Draft
docs(agents): re-requesting recovers a Copilot error body; a push and a promotion do not
unassigned · updated 6 days ago · refs #1648, #719
#1645Ready
fix(audit): cap the update-branch batch, which destroys Copilot reviews
unassigned · updated 6 days ago
#1613Ready
docs(agents): an advisory red is dated by publication, not by your last commit
unassigned · updated 6 days ago · refs #1152, #1278, #1493, #1511, #822
#1589Ready
fix(ledger): exempt the lessons ledger from Prettier's table re-pad
unassigned · updated 6 days ago
#1647Ready
fix(hooks): refuse `gh api -f` with no `-X`, which silently POSTs a read
unassigned · updated 6 days ago · refs #1591, #971, #1027
#1586Ready
feat(112,119): ungated preflight names the blast radius before the cloudflare-prod-write gate
unassigned · updated 6 days ago · refs #1509, #778, #1585, #1027
#1587Ready
fix(740): watch FFC-EX-canary's Security Audit — 9 silent scheduled failures on a critical RCE
unassigned · updated 6 days ago · refs #1533, #1511
#1611Ready
fix(740): a failing job needs its duration, not just its conclusion
unassigned · updated 6 days ago · refs #1458, #1404, #1593, #719
#1615Ready
docs(claude): read a policy change's provenance; REST mergeable is null on first touch
unassigned · updated 6 days ago
#1634Ready
feat(hooks): warn that `tee FILE | head` leaves FILE truncated
unassigned · updated 6 days ago · refs #719
#1619Ready
feat(conductor): say at bootstrap when the template's grants have not reached the session
unassigned · updated 6 days ago
#1610Ready
feat(744): a work queue decays on human time, not publication cadence
unassigned · updated 6 days ago · refs #1547, #977
#1612Ready
feat(hooks): nudge when you edit a file the lessons ledger cites by line
unassigned · updated 6 days ago
#1596Ready
test(1552): measure whether the open-PR SET can land, not each PR against main
unassigned · updated 6 days ago · refs #1552, #993, #1119
#1600Ready
fix(747): title the liveness alert with the signal that fired, not a fixed cause
unassigned · updated 6 days ago · refs #1598, #1416, #1433, #1453, #1339
#1599Ready
docs: add FFC-IN-Claude-Plugins to repo map and clarify the -IN-/-EX- rule
unassigned · updated 6 days ago
#1592Ready
test(hooks): refuse `gh api -f key=@file`, which posts the literal path and 201s
unassigned · updated 6 days ago · refs #1591, #719, #1278, #989
#1590Ready
test(ledger): fail a PR whose new ledger id another open PR already claims
unassigned · updated 6 days ago · refs #993
#1584Ready
fix(734): union two query shapes for every waiting-run read (L341 residue)
unassigned · updated 6 days ago
#1588Ready
test(703,734): a gated cron must outlive the janitor's reap threshold
unassigned · updated 8 days ago · refs #719
#56Draft
fix(deps): bump next to ^16.3.8 and patch sharp/source-map-js — clears 1 critical + 3 high (Refs #1511)
unassigned · updated 9 days ago
#1386Draft
fix(deploy): look the required CI run up by head_sha, and let the alarm see a skipped deploy
unassigned · updated 12 days ago · refs #1281
Automation backlog
| Issue | Title | Assignee | Updated |
|---|---|---|---|
| #1458 | 🚨 Scheduled workflow failing: FreeForCharity/FFC-IN-ffcadmin.org — Security Auditbug | unassigned | today |
| #1300 | 🚨 Scheduled workflow failing: FreeForCharity/FFC-IN-freeforcharity.org — Security Auditbug | unassigned | today |
| #1658 | Conductor liveness: the supervising routine may have stoppedbug | unassigned | today |
| #1603 | Key Vault credential health: dead, expiring, or unverifiable credentialssecuritypriority: high | unassigned | yesterday |
| #1659 | 🚨 Scheduled workflow failing: 745. Repo - Agentic OS Board Audit [GH]bug | unassigned | yesterday |
| #719 | Agentic OS Conductor Log | unassigned | yesterday |
| #1445 | WHMCS orders held in Fraud status (FraudLabs Pro review)whmcs | unassigned | 2 days ago |
| #1660 | 🚨 Scheduled workflow failing: 748. Repo - Template Provisioning Matrix [Repo]bug | unassigned | 5 days ago |
| #1640 | feat(website): land green Dependabot PRs in FFC-EX repos (charity-lane fleet hygiene)epic:charity-lane | unassigned | 6 days ago |
| #1648 | audit-open-pr-readiness.py reports 17 unreviewable PRs as `ok`: it has no check for AGENTS.md merge condition 2 | unassigned | 6 days ago |
| #1547 | Status feed can publish "no gates pending" from a single unconfirmed empty readagent-ready | unassigned | 6 days ago |
| #1649 | #1647's rule 10b hard-blocks the documented #1127 label-add: an iterating `--jq` is not a conclusive discriminator | unassigned | 6 days ago |
| #986 | Six orphan branches have no open PR and an unknown disposition — decide by content, not by ancestrydocumentationagent-ready | unassigned | 6 days ago |
| #562 | 3 critical next advisories cannot land: #561's build fails on jest-axe typings, not on nextsecurity | unassigned | 6 days ago |
| #1460 | Merging #1379 silently deletes the health alert for an Active, paying domain: Tier 6 is skipped before the health checkbugagent-ready | unassigned | 6 days ago |
| #894 | Fleet security headers: which FFC sites actually serve themsecuritypriority: high | unassigned | 6 days ago |
| #841 | Fleet security-audit coverage gap: Node repos with no vulnerability detectionsecuritypriority: high | unassigned | 6 days ago |
| #893 | Fleet smoke engine drift detectedpriority: highsmoke-failure | unassigned | 6 days ago |
| #1563 | Two more consumers of the unreliable ?status=waiting shape: 734 janitor and approve-waiting-runs.pyagent-ready | unassigned | 6 days ago |
| #1152 | 740 records only the run conclusion, so a failure that changes cause reads as the same outage continuing — 735 moved to the credential step and both rolling issues hid itbugagent-ready | unassigned | 7 days ago |
| #1511 | Four repos red on Security Audit: one shared Next.js next/og RCE, plus two more criticals on freeforcharity.org — bump next to ^16.3.8bugdependenciessecurityclaimedpriority: highagent-ready | unassigned | 7 days ago |
| #822 | Security: bump Next.js to patched 16.2.11 across the fleet (scheduled Security Audit red on both templates)enhancementsecurity | unassigned | 7 days ago |
| #1593 | freeforcharity.org: next 16.3.8 (#561) is red because next build now typechecks __tests__/ — 38 jest-axe + 2 unrelated 'legacy' errors, all latent on mainagent-ready | unassigned | 7 days ago |
| #1295 | Security: two critical Next.js unauthenticated RCE advisories — fleet floor moves 16.2.11 → 16.3.3 (81 repos, 33 of them tilde-pinned below it)securitypriority: highagent-ready | unassigned | 7 days ago |
| #1505 | 502's gate panel publishes an empty approval list on a single stale read, measured 0→9→9 live this run — a safety control that fails open on the public pagebugpriority: highagent-ready | unassigned | 7 days ago |
| #1406 | 701: fail the run when a repo was created but content or maintainers did not run (runtime check, not just a job-graph test)agent-ready | unassigned | 7 days ago |
| #1605 | A failing-test count is not a problem count: make the ledger guards state their cardinality | unassigned | 8 days ago |
| #1552 | CI cannot see cross-PR collisions: four open PRs all read CLEAN while two pairs of them conflict on merge (both pairs DO land, in either order - they need a resolution, not a schedule)testingagent-ready | unassigned | 8 days ago |
| #1591 | gh api -f key=@file posts the literal path: run 240's entire public log is three @-strings, and every signal at the call site said success | unassigned | 8 days ago |
| #1278 | Ledger ids are allocated from the tip, so any two concurrent agentic-os PRs race for the same one — and no per-PR check can see itbugagent-ready | unassigned | 8 days ago |
| #1509 | 112/119 bulk-DNS gates hide their blast radius: the approver sees dry_run and no target, and the preview the safety doc tells them to read cannot be madesecurityclaimedpriority: highagent-ready | unassigned | 8 days ago |
| #1585 | guard_bash: `echo "$(cmd) rc=$?"` reports the substitution's status, not the command's — L50's defect with no pipe, so the L50 rule cannot see itbugagent-ready | unassigned | 8 days ago |
| #1533 | 740's satellite watch list omits FFC-EX-canary: 5 scheduled days of a critical-RCE Security Audit failure, zero alerts — the canary is the one repo meant to fail firstbugsecurityclaimedagent-ready | unassigned | 9 days ago |
| #1571 | Conductor step 4's backlog ceiling is 12x out and unreachable by the Conductor: 178 open vs 5-15, closing 3.3/day | unassigned | 9 days ago |
| #1493 | A 4-line ledger edit costs a PR its automated reviewer: `copilot-pull-request-reviewer` fails `all files are too large to fit within the prompt budget` on #1336bugagent-ready | unassigned | 9 days ago |
| #1311 | guard_bash rule 2 misses every force-push written with a global git option: `git -c x=y push --force origin main` is allowedbugsecurityagent-ready | unassigned | 9 days ago |
| #1309 | guard_bash rule 2 reads a force flag and a branch name from different statements, blocking ordinary feature-branch pushesbugagent-ready | unassigned | 9 days ago |
| #1388 | Bot data PRs land only by beating the Copilot reviewer; the reconciler then loops forever on the ones that losebugagent-ready | unassigned | 9 days ago |
| #1577 | guard_bash: warn that an empty `gh search` result is not absence (it misses months-old issues, not just new ones)agent-ready | unassigned | 9 days ago |
| #1261 | Worker rule 1 has no terminal state: 3 complete PRs have held every slot ~27h, forcing 5 consecutive no-op runs while 56 agent-ready issues waitbugpriority: high | clarkemoyer | 9 days ago |
| #1185 | 739: a PR with unresolved review findings is invisible next to a PR waiting on a humanagent-ready | unassigned | 9 days ago |
| #848 | Key Vault: read-all-cbm-github-pat is dead (502's deliver job down 3 days), and the read/write split is unenforced (per-secret RBAC + liveness monitoring)securitypriority: high | unassigned | 9 days ago |
| #1557 | L218's citation stayed true while its conclusion went false: the Conductor IS wired, and three rows inherit the dead premisebugdocumentationblocked | unassigned | 9 days ago |
| #1539 | guard_bash.py: two whole-payload false positives block correct commands (rule 5 reads 'Cloudflare' as an rm -rf flag; rule 6 matches 'graphql' as a jq field name)bugagent-ready | unassigned | 10 days ago |
| #1576 | guard_bash rule 6 blocks plain REST --paginate when the word graphql appears anywhere in the command | unassigned | 10 days ago |
| #1574 | guard_bash.py fail-open handler discards warnings the earlier rules already produced | unassigned | 10 days ago |
| #1546 | 703's weekly schedule is answered 3 times in 10: a gated cron degrades silentlyagent-ready | unassigned | 10 days ago |
| #1573 | 120 with skip_cname=true half-migrates: the apex is claimed but public/CNAME stays staging, so the next deploy reverts itbug | unassigned | 10 days ago |
| #1565 | 722 gates the merge queue with no job timeout, so a hang holds the queue for 6h instead of failing in minutestestingagent-ready | unassigned | 11 days ago |
| #1028 | App-identity pushes fire no pull_request event: the PR keeps the previous commit's green checks and reads as CI-verifiedbugagent-ready | unassigned | 12 days ago |
| #1292 | Security: post_edit.py's secret backstop never runs for files written by Bash, which is how the agent writes almost every filesecurityagent-ready | unassigned | 12 days ago |
| #1553 | guard_bash checks the encoding of an inline-Python open() but not its path, so an MSYS /c/... literal fails at runtime insteadagent-ready | unassigned | 12 days ago |
| #1551 | guard_bash conflates a secret's NAME with its VALUE: a printed label is refused, and so is the mandated Actions reference formbugagent-ready | unassigned | 12 days ago |
| #1550 | 702's refusal guards run OUTSIDE the gate, so approving a week-old run writes behind a week-old verification (all 7 targets now fail the guard a fresh dispatch would apply)bugtestingagent-ready | unassigned | 12 days ago |
| #1538 | 702 preflight refuses every freshly-created FFC-EX repo, and the force=true workaround also disables the sibling-domain scanbugsecurityagent-ready | unassigned | 12 days ago |
| #1548 | 67 charity sites cannot report a failed deploy: the alarm watches only the terminal jobagent-ready | unassigned | 12 days ago |
| #1281 | Pages deploy aborts silently when the gate's list query misses a required CI run (9 of 26 deploys today; public feed ~1h stale)buginfraagent-ready | unassigned | 12 days ago |
| #1545 | ffcadmin deploy-failure notifier is blind to the only way the deploy fails: a skipped deploy is not a failed one (7 silent freezes)bugpriority: highagent-ready | unassigned | 12 days ago |
| #1544 | ffcadmin deploy frozen 21h: the CI-status gate reads a filtered, unpaginated run slice and throws 'no run' on a run that succeededbugpriority: highagent-ready | unassigned | 12 days ago |
| #1542 | 207 WHMCS respond: unchecked ticket id spends a write gate, and the failure message is emptybugtestingagent-ready | unassigned | 12 days ago |
| #1089 | Step 4's backlog band has been unmet for 10 consecutive runs and its only lever is disconnected: the queue is over-full with fresh work, not stale work | unassigned | 13 days ago |
| #1537 | 745 signals findings with setFailed, so 740 files a breakage alert for a working audit (#1532 is the false 🚨)bugtestingagent-ready | unassigned | 13 days ago |
| #1091 | 727's behind-count counts merge commits and doc-only churn: two ledger PRs red-line every open PRbugagent-ready | unassigned | 13 days ago |
| #835 | The public Agentic OS board has no auto-add: every Conductor run adds items to Project #9 by handenhancementblocked | unassigned | 13 days ago |
| #1133 | 703 is the last scheduled workflow on a reviewer gate, and 64 runs have declined it because there is nothing to review (#834 tail)priority: highblocked | unassigned | 13 days ago |
| #1514 | Nothing warns that two open PRs touch the same file: #176/#177 fixed one line identically 6h apartagent-ready | unassigned | 13 days ago |
| #1528 | 734: a gate warning should say whether the run's own workflow changed since the run was createdenhancementagent-ready | unassigned | 13 days ago |
| #1526 | Conductor step 6: a 24h health window over daily crons is a sample of one, and hid a 4-run 745 outageagent-ready | unassigned | 13 days ago |
| #1508 | 748's red cell cannot be attributed: the template is a floating input the run never records, and one unchanged PR commit produced three different causes in two runsbugagent-ready | unassigned | 14 days ago |
| #1498 | 740's #1447 watermark cannot see an empty runs page, the one stale shape measured live — a provably stale read counts as a healthy checkbugagent-ready | unassigned | 14 days ago |
| #1517 | Template repos: a stacked PR is reviewed and merged with the whole suite unrun, reporting CLEAN - #1325's fix was never propagatedtestingagent-ready | unassigned | 14 days ago |
| #174 | Footer.test.tsx gates the Candid seal assertion on profileUrl, but #172 made the seal render on sealUrl | unassigned | 14 days ago |
| #175 | check:drift scans comment text, so every rebranded child fails on two comments that explain the Candid seal | unassigned | 14 days ago |
| #1135 | Nothing observes the pickup query an agent actually types: #1028 sat in the agent-ready results for 3 days while explicitly blockedbugagent-ready | unassigned | 14 days ago |
| #1507 | The two templates' SiteConfig diverged on guidestar.sealUrl, and the shared-schema guard cannot see it — a required field added outside the schema is the one change that defeats check:site-configbugpriority: highagent-ready | unassigned | 14 days ago |
| #1070 | 745 board audit is blind to agent work that was never labelled: expected comes from a hand-applied labelbugagent-ready | unassigned | 15 days ago |
| #1501 | 749's invite script reports a missing jq as 'the API returned no membership state' — a silent failure in a gated write laneagent-ready | unassigned | 15 days ago |
| #1399 | Decision record: NHEG PDFs downsampled to /ebook — archive the originals to permanent storage before DNS cutoverdocumentation | clarkemoyer | 15 days ago |
| #1503 | `guard_bash`'s cp1252 rule scans the whole payload, so the word "open" in an `echo` blocks the command — and its docstring says it does notbug | unassigned | 15 days ago |
| #1415 | AGENTS.md's gate-review recipe is mangled by MSYS path conversion and fails silently to a false absencebugdocumentation | unassigned | 15 days ago |
| #1499 | A failing workflow-logic test cannot report itself on a Windows host: printing the FAIL line raises UnicodeEncodeError, so a red module greps identically to a green onebugtestingagent-ready | unassigned | 15 days ago |
| #1496 | 706: formKind's login test should be scoped to the form's `action` attributebug | unassigned | 15 days ago |
| #1494 | The ledger's highest-churn citations carry no anchor, so a merge-shifted coordinate lands on real-but-wrong code and merges greentestingagent-ready | unassigned | 15 days ago |
| #1491 | 747's Conductor-silence alarm has no assignee: #1269's defect, reproduced in the monitor that replaced it (12 updates, 69h outage, 0 addressees)bugpriority: highagent-ready | clarkemoyer | 16 days ago |
| #1490 | 706: the asset localizer leaves Jetpack CDN (i0.wp.com), gravatar, third-party image and CSS filter:url() references off-site, so the mounted captures fail the charity's asset guardbug | unassigned | 16 days ago |
| #1489 | 706: links between mounted hosts are not rewritten — absolute cross-host URLs and root-relative paths inside a mount still point at the source hostsbug | unassigned | 16 days ago |
| #1477 | The landing sweep mandates work the cloud worker cannot do: 4 consecutive runs re-measured one 1-line patch none of them had authority to pushbugagent-ready | unassigned | 16 days ago |
| #1405 | Fleet rollout: remove next/font/google from the FFC-EX sites (≥78 still download fonts from Google at build time)claimed | unassigned | 16 days ago |
| #1381 | The cloud worker starts every run unguarded and re-renders its own hooks: 7 runs, no owner, and the fix is environment-side (L218/L261)bug | clarkemoyer | 16 days ago |
| #1464 | technologymonastery.org expires 2026-12-30 with auto-renew off: renew or transfer before it becomes the demo domainpriority: high | unassigned | 17 days ago |
| #1471 | Rebuild technologymonastery.org as a superset of the Single-Page templateblocked | unassigned | 17 days ago |
| #1470 | Fleet audit: recognise a program of FFC at Level 2 (its 501(c)(3) claim is FFC's, so detectStatusClaim ignores it) | unassigned | 17 days ago |
| #1469 | Templates: optional consent-gated analytics loading (decide policy first)blocked | unassigned | 17 days ago |
| #1468 | Both templates: demo mode for the footer./single-page. derivatives (noindex or cross-domain canonical, demonstration banner) | unassigned | 17 days ago |
| #1467 | Templates disagree on trailingSlash (Footer-Only true, Single-Page unset): pick one and apply it to both | unassigned | 17 days ago |
| #1466 | Single-Page template: config-driven extra pages (nav, footer, sitemap) and FAQ/Programs sections for charities | unassigned | 17 days ago |
| #1465 | Single-Page template: support a site that is a program of its supporting org (FFC's EIN, parentOrg) without failing check:driftpriority: high | unassigned | 17 days ago |
| #1463 | Technology Monastery as FFC's public demonstration site: flagship at the apex, footer. and single-page. derivatives | unassigned | 17 days ago |
| #1408 | Automate the live end-to-end provisioning test against the permanent test charities | unassigned | 17 days ago |
| #1422 | 213 and 218 are scored burned-down while their artifact-path consumer is unguarded: 0 of 6 and 1 of 6 path guardsbugsecurityagent-ready | unassigned | 19 days ago |
| #912 | 228 has never succeeded: a secrets.* reference against an environment with no secrets, and nothing catches the classsecurity | unassigned | 19 days ago |
| #1417 | 747's first run: both PR-derived signals read empty (no pull-requests: read) and open-pr-cap renders that as a healthy 0bugpriority: high | unassigned | 19 days ago |
| #1100 | Nothing detects a Dependabot advisory deadlock: 2 PRs each fixing one high advisory kept the main website red for 4 days, and neither could ever go greensecuritypriority: highagent-ready | unassigned | 19 days ago |
| #1392 | Footer-Only template ships alt="Free For Charity" on every provisioned charity site, and its drift check has no identity scan to catch itbug | unassigned | 19 days ago |
| #1080 | Security: freeze and guard free-text dispatch inputs interpolated into run: bodies (34 workflows, 20 gated on write)securityagent-ready | unassigned | 19 days ago |
| #1413 | guard_bash: the graphql --paginate rule judges the whole command, so a word in another statement (or a heredoc body) blocks a correct callbugsecurity | unassigned | 19 days ago |
| #1380 | The #1080 output_file guards rest on @actions/glob's nobrace/noext, which nothing in the tree assertssecurityagent-ready | unassigned | 19 days ago |
| #1425 | Conductor routine's Step 2 gate rule is looser than docs/workflow-safety-and-approvals.md (would auto-approve a wr-all-* write gate)documentationsecurity | unassigned | 20 days ago |
| #1339 | Nothing watches whether the Conductor is alive: it stopped on 2026-09-14 and 39 worker runs reported "terminal state" without noticingbugpriority: highagent-ready | unassigned | 20 days ago |
| #1333 | guard_bash rule 2: `git push origin +main` is ALLOWED — a refspec-level force carries no force flag, so the flag half never arms (second cause, sibling of #1332)bugsecurity | unassigned | 20 days ago |
| #1332 | guard_bash rule 2: `git push --force origin refs/heads/main` is ALLOWED — the fully-qualified refspec bypasses PROTECTED_BRANCH_REbugsecurity | unassigned | 20 days ago |
| #1401 | 706: reuse_capture_from_run silently disables recode_all_images and shrink_all_pdfsdocumentation | unassigned | 20 days ago |
| #1403 | Epic: follow-ups from the Footer-Only default + template live test (test charities, fonts, 701 hardening) | unassigned | 20 days ago |
| #1360 | audit-open-pr-readiness.py is GraphQL-only, so the sandboxed worker — the caller most likely to need it — gets a 403 instead of a reportbugagent-ready | unassigned | 21 days ago |
| #1385 | The lessons-ledger composition recipe reports table-structure errors instead of the coupling it exists to detectbugdocumentation | unassigned | 23 days ago |
| #1123 | Sweep for PRs that are green on a stale base and would fail the merge queueagent-ready | unassigned | 24 days ago |
| #1375 | 706: the asset localizer misses protocol-relative `//host/path` URLs in CSS | unassigned | 24 days ago |
| #1369 | 706: `frontPageCaptured: true` when no front page was captured — the apex homepage is silently replaced by a subdomain'sbug | unassigned | 24 days ago |
| #1372 | 706: a mounted capture must not be ABLE to write a page outside its mount | unassigned | 24 days ago |
| #1030 | 734 publishes an exact reap deadline that has been wrong on 26 of 26 runs: the cron instant is not the delivery instantbugagent-ready | unassigned | 28 days ago |
| #1099 | Conductor PR supervision is hub-only by accident: 79 open PRs across the four satellite repos, oldest 6.5 months, never sweptblocked | unassigned | 28 days ago |
| #1197 | Wix clones keep loading images from Wix: 1259 srcset attributes, 0 assets downloaded, wixstatic/parastorage stay external | unassigned | 34 days ago |
| #1315 | guard_bash rule 2: a backslash inside the branch name evades the protected-branch match — `git push --force origin ma\in` is allowedbugsecurity | unassigned | 34 days ago |
| #1314 | guard_bash: `_strip_single_quoted` is escape-blind, so an escaped-quote `$?` evades the L50 pipeline rulebug | unassigned | 34 days ago |
| #1091 | Security: 12 Dependabot alerts (9 high) in ffcadmin devDependency tree, mostly via @lhci/cli 0.13 → puppeteer-core 21securityagent-ready | unassigned | 35 days ago |
| #1293 | The ledger's Enforced-by contract is contradicted by 17 of its own 277 rows, and no test reads the column's shapeagent-ready | unassigned | 36 days ago |
| #1119 | test(workflow-logic): 104 of 1170 tests fail on Windows while ubuntu-only CI stays green | unassigned | 36 days ago |
| #1289 | 601 never checks $LASTEXITCODE after its native export call, so an export that fails for any reason reports successbugagent-ready | unassigned | 36 days ago |
| #1282 | 42 workflows render in run listings under a run-name carrying no workflow number, so the string you see during triage appears in no doctestingagent-ready | unassigned | 36 days ago |
| #1174 | pwsh step-body tests run bodies as `pwsh -File`, omitting the runner's `exit $LASTEXITCODE` wrapper — so no module can pin a step exit code, and two already dobugtestingagent-ready | unassigned | 36 days ago |
| #1280 | guard_bash rule 8 reads a redirect target as an endpoint, and blocks its own test databugagent-ready | unassigned | 36 days ago |
| #1268 | guard_bash.py blocks 3 real workflow job names as secrets: `WHMCS_[A-Z_]+` under IGNORECASE matches any lowercase `whmcs_*` identifierbug | unassigned | 37 days ago |
| #1210 | Testing: the #1080 frozen-count pin serialises the burn-down — two concurrent lanes cannot both landtestingagent-ready | unassigned | 50 days ago |
| #1203 | Mindful Moves (WHMCS client 432): application pending since 2026-07-07 — requested domain unavailable, 4 decisions open | unassigned | 63 days ago |
| #1196 | clone-site-static.mjs cannot clone a site whose apex redirects to www (702 captures 2 pages, 0 MB) | unassigned | 67 days ago |
| #1190 | fix(check-environment-protection): retry transport failures, never retry an HTTP answer (L244)agent-ready | unassigned | 67 days ago |
| #1177 | docs: write down the data-delivery contract — the Conductor's status deliveries auto-merge, and the window they needagent-ready | unassigned | 68 days ago |
| #1175 | 226 reconcile-report groups duplicates by `clientid` alone, so the same organization applying under two client accounts is structurally invisiblebugagent-ready | unassigned | 68 days ago |
| #1172 | L214 claims pwsh shifts the argument binding on an unset $env: reference; its own evidence says the binder refuses. Three docs and 17 call sites inherit the wrong modelbugdocumentationagent-ready | unassigned | 68 days ago |
| #1171 | Status feed: pending_gates counts runs AT a gate, not runs stopped BY one (703 holds 2, page says 1)bugagent-ready | unassigned | 68 days ago |
| #724 | Migrate remaining value out of FFC-IN-AI-Management into the hub (inventory + first tranche)documentationagent-ready | unassigned | 68 days ago |
| #1084 | 728 never runs in the merge group, so a red hooks suite can land on main — measured on #1018 + #1039bugblocked | unassigned | 69 days ago |
| #1048 | 703's weekly refresh has silently missed 2 runs: both monitors filter status=completed, so a schedule that stops reads greenbugagent-ready | unassigned | 69 days ago |
| #983 | dry_run is enforced per-step, not per-job: every dry run of 701/702/720 parks on a write gate and mints a write credentialsecurityblocked | unassigned | 70 days ago |
| #1111 | Board audit cannot see work that merges before it is carded: #1108 merged uncarded and every category reported 0bugagent-ready | unassigned | 70 days ago |
| #1072 | Bash-tool commands collapse every doubled backslash before the shell: six runs blamed the heredoc, and the surface is the command stringbugagent-ready | unassigned | 71 days ago |
| #788 | Fleet: upload-pages-artifact@v5 silently drops dot-entries — .well-known/security.txt 404s on affected sitesagent-ready | unassigned | 71 days ago |
| #880 | Every FFC Pages deploy silently discards next.config.ts (configure-pages writes its own .js)bugpriority: highagent-ready | unassigned | 71 days ago |
| #755 | Canary drill: prove the smoke engine catches each failure class it claims (child of #752) | unassigned | 71 days ago |
| #934 | Smoke never probes www: the engine only mentions it in an error hint, while 13 of 55 live sites are broken on wwwbugpriority: high | unassigned | 71 days ago |
| #936 | Fleet sync of the www smoke probe will red-line 13 sites at once: SMOKE_REQUIRE_WWW is unset everywherebugpriority: highagent-ready | unassigned | 72 days ago |
| #1103 | Public status feed drops a whole repo's PRs when its last agentic-os issue closes: freeforcharity.org's 22 open PRs vanished 6 minutes after a security fix landedbugagent-ready | unassigned | 72 days ago |
| #823 | WHMCS: auto-populate client custom fields from product-order answers (order → client sync)enhancement | unassigned | 72 days ago |
| #1096 | A close/reopen round trip launders a `claimed` label past both release paths: #986 sat claimed for 4 days with no open PRbugagent-ready | unassigned | 73 days ago |
| #1087 | The ledger's guard-path check proves existence, not enforcement — a row can name a guard its own lesson says is incompleteagent-ready | unassigned | 73 days ago |
| #1024 | Nothing checks that a doc's "Tracked on #N" pointer is still open — 3 of 4 cite closed issues, and one was telling agents to discard real evidenceagent-ready | unassigned | 74 days ago |
| #1085 | Readiness audit models only 1 of 727's 2 fail conditions, so it reports ok on PRs the guard will reject (measured on #1082)bugagent-ready | unassigned | 74 days ago |
| #863 | Establish the canonical URL standard on FFC_Single_Page_Template (trailingSlash + sitemap + canonicals + lighthouserc)enhancementagent-ready | unassigned | 74 days ago |
| #1078 | Open-PR readiness audit is hub-only: 8 of 13 open agentic-os PRs are unwatched, 2 queue-blocked for 9 daysagent-ready | unassigned | 74 days ago |
| #1074 | 229 + 230: split the dry-run preview onto whmcs-prod-read so a rehearsal needs no gate | unassigned | 74 days ago |
| #1026 | guard_bash.py rule numbers are a shared namespace with no uniqueness check: 6 and 7 are each claimed twice across 4 open PRsbugagent-ready | unassigned | 74 days ago |
| #1067 | 737 claim-sync reads only the PR body, so a Refs in the title claims nothing — #823 sat pickable while #825 implemented itbugagent-ready | unassigned | 75 days ago |
| #1065 | A waiting approval gate can be running an unmerged PR branch, and nothing surfaces the ref: the safety doc classifies workflows as they are on mainagent-ready | unassigned | 75 days ago |
| #1060 | pwsh invocation guard skips a call whose script path is a variable: 701's 11-parameter content call is unjudgedbugagent-ready | unassigned | 75 days ago |
| #1057 | Dependabot has capped out in 35 of 62 fleet repos: 793 open PRs, nothing merges them, so Actions updates have stopped being filedpriority: highagent-ready | unassigned | 75 days ago |
| #1006 | candid-prod-read does not exist as a GitHub environment: 801/802 have never been runnable, and it blocks #1005security | unassigned | 75 days ago |
| #1044 | Nothing validates that a sites-list Repo URL resolves: a 404 sat in the public dataset until another repo's link checker found itbugagent-ready | unassigned | 76 days ago |
| #1023 | test_729 runs the step in the checkout, loses all 5 of its tests, and leaves a stray file — while CLAUDE.md points at closed #945bugagent-ready | unassigned | 76 days ago |
| #1022 | `$?` guard misses the `&&` and `||` separators: `cmd | tail && echo $?` still prints a false EXIT=0bug | unassigned | 76 days ago |
| #1037 | 111's apply job always fails after succeeding: curl.exe does not exist on ubuntu-latest, and the only assertions that could fail are exit-0 warningsbugagent-ready | unassigned | 76 days ago |
| #1035 | 734 reaps a gate on its first visible tick when the run was queued behind a concurrency group: age is measured from created_at, not from when the gate openedbugagent-ready | unassigned | 76 days ago |
| #771 | Standardize on pnpm across FFC templates and repos (migrated from FFC-IN-AI-Management#9) | unassigned | 76 days ago |
| #1031 | ffcadmin's two src/data + public/data pairs are not the same case: guard workflow-catalog.json, delete the dead agentic-os-status.json copybugagent-ready | unassigned | 76 days ago |
| #1019 | Text-scanning guards flag prose about the thing they catch — four instances in 48h, and the newest rule shipped with the bugbug | unassigned | 77 days ago |
| #908 | ffcadmin data-refresh PRs hang forever once they fall behind main — three public dashboards went stale for 6h with all checks greenbug | unassigned | 77 days ago |
| #771 | Guard that the dual-written data feeds cannot drift (public/data vs src/data)agent-ready | unassigned | 78 days ago |
| #860 | Standardize on Node 24, and make the templates the rehearsal surface for every fleet-wide changeenhancementpriority: high | unassigned | 79 days ago |
| #729 | Repo hygiene for the cutover test target FFC-EX-technologymonastery.org (child of #726) | unassigned | 79 days ago |
| #859 | Baseline compliance is unmeasured across the fleet — policy pages, consent and security must hold regardless of template divergenceenhancementpriority: highagent-ready | unassigned | 79 days ago |
| #748 | Conditional basePath missing: default-Pages-URL sites serve pages with 404 assets (technomonasteries, Footer_Only_Template; audit fleet)agent-ready | unassigned | 79 days ago |
| #918 | www is unverified across the fleet: aprilhansen.com serves 526 on www, and both the cutover and the smoke reported OKbugpriority: high | unassigned | 80 days ago |
| #865 | No per-charity traffic data — the traffic-ordered rollout has nothing to order byenhancement | unassigned | 80 days ago |
| #883 | First working telemetry sweep: findings, and why the GA4 mismatch check is unreliable | unassigned | 84 days ago |
| #844 | Credential consistency: 4 environments still hold raw secrets in GitHub instead of Key Vaultsecuritypriority: high | unassigned | 84 days ago |
| #864 | Search Console + Analytics baseline on the two FFC sites — the proof points for the URL standardenhancement | unassigned | 85 days ago |
| #861 | Epic: prove the web standard on FFC first, then propagate to the fleet in order of trafficenhancementpriority: high | unassigned | 85 days ago |
| #838 | Security: 34 of 44 Node FFC-EX repos have no vulnerability detection at all (why #822's scope read 13 instead of 38) | unassigned | 85 days ago |
| #813 | Epic: WHMCS fraud review via FraudLabs Pro + daily agent check (charities mis-flagged as fraud)enhancement | unassigned | 86 days ago |
| #752 | Epic: process assurance — verify the Agentic OS's own processes keep working (monitor the monitors) | unassigned | 86 days ago |
| #816 | Enhance the Charity Website product request (pid 40) to collect full-template content + self-hiding sectionsenhancement | unassigned | 87 days ago |
| #770 | Build a custom WHMCS MCP server (migrated from FFC-IN-AI-Management#3) | unassigned | 87 days ago |
| #778 | Consolidate Cloudflare record-writing: one engine for the apex/www Pages standard + shared API libenhancement | unassigned | 88 days ago |
| #744 | Publish FFC Zeffy campaign list for smoke auto-classification (charity-specific vs ffc-interim donations) | unassigned | 89 days ago |
| #667 | Bot data PRs stuck at CI 'action_required' again despite approval policy fix (#637 regression, different cause) | unassigned | 89 days ago |
| #670 | Weekly Linkinator (external) fails on synthetic issues/new links: skip pattern + 2 stale repoUrl rows | unassigned | 90 days ago |
| #573 | Add session/run budget guidance to governance (Max subscription capacity) | unassigned | 90 days ago |
| #769 | Build a custom Zeffy MCP server (migrated from FFC-IN-AI-Management#2) | unassigned | 90 days ago |
| #574 | [ops-concierge] Autonomy pilot — tracking issueops-concierge | unassigned | 90 days ago |
| #747 | Fleet-status donation badges + campaigns dashboard page on ffcadmin (child of #745) | unassigned | 91 days ago |
| #745 | Epic: charity campaign registry — capture and track every Zeffy campaign across FFC-supported sites, surfaced in the dashboards | unassigned | 91 days ago |
| #738 | Epic: unify fleet smoke patterns into one Agentic-OS-integrated verification system with public visual fleet status | unassigned | 91 days ago |
| #638 | Lighthouse CI failing on main: performance 0.67 vs 0.9 budget (bootup-time, CLS, DOM size, contrast) | unassigned | 91 days ago |
| #572 | Quarterly inventory refresh + reflection session | unassigned | 91 days ago |
Latest Conductor log
### 745 Agentic OS board audit — 4 finding(s) Board: FreeForCharity project #9 (Agentic OS) · `expected=224` `board=715` · repos swept: 132 Both denominators are printed deliberately: run 62 reported "0 missing" off an expected set that was one item short, and a short denominator was the only thing a reader could have found suspicious (#966). #### Missing from the board: 2 _open `agentic-os` items with no card — add them to org project #9_ - [FreeForCharity/FFC-Cloudflare-Automation#1658](h… (truncated)
### 745 Agentic OS board audit — 4 finding(s) Board: FreeForCharity project #9 (Agentic OS) · `expected=224` `board=715` · repos swept: 132 Both denominators are printed deliberately: run 62 reported "0 missing" off an expected set that was one item short, and a short denominator was the only thing a reader could have found suspicious (#966). #### Missing from the board: 2 _open `agentic-os` items with no card — add them to org project #9_ - [FreeForCharity/FFC-Cloudflare-Automation#1658](h… (truncated)
### 745 Agentic OS board audit — 4 finding(s) Board: FreeForCharity project #9 (Agentic OS) · `expected=224` `board=715` · repos swept: 132 Both denominators are printed deliberately: run 62 reported "0 missing" off an expected set that was one item short, and a short denominator was the only thing a reader could have found suspicious (#966). #### Missing from the board: 2 _open `agentic-os` items with no card — add them to org project #9_ - [FreeForCharity/FFC-Cloudflare-Automation#1658](h… (truncated)
### 745 Agentic OS board audit — 4 finding(s) Board: FreeForCharity project #9 (Agentic OS) · `expected=224` `board=715` · repos swept: 132 Both denominators are printed deliberately: run 62 reported "0 missing" off an expected set that was one item short, and a short denominator was the only thing a reader could have found suspicious (#966). #### Missing from the board: 2 _open `agentic-os` items with no card — add them to org project #9_ - [FreeForCharity/FFC-Cloudflare-Automation#1658](h… (truncated)
### 745 Agentic OS board audit — 3 finding(s) Board: FreeForCharity project #9 (Agentic OS) · `expected=222` `board=715` · repos swept: 132 Both denominators are printed deliberately: run 62 reported "0 missing" off an expected set that was one item short, and a short denominator was the only thing a reader could have found suspicious (#966). #### Missing from the board: 1 _open `agentic-os` items with no card — add them to org project #9_ - [FreeForCharity/FFC-Cloudflare-Automation#1658](h… (truncated)
### Run 259 — addendum: #1650 is fixed and green, and Copilot caught a second error of mine in it Closing the loop on three things the END comment and the correction left mid-flight. **1. Copilot found an arithmetic error in the correction itself, and it was right.** On #1650 it flagged that the paragraph could not be internally consistent: for the review to be "~20 seconds from completing", the re-read cannot have been "20 minutes after the POST" against a 13:14Z → 13:23:01Z timeline. The re-… (truncated)
### Run 259 — CORRECTION: the re-request DOES work. Clarke, you do not need to do anything. **My escalation earlier this run was wrong on its central claim, and the recommendation it asked you to act on is withdrawn.** I said re-requesting a Copilot review returns "HTTP 200, no effect". It works. I measured the wrong field and published the conclusion before the remedy had time to land. #### What actually happened The POST I cited as a no-op **succeeded**. On #1589 a `copilot-pull-request-rev… (truncated)
### Run 259 — END (2026-10-12, ~13:1xZ–14:0xZ) Step 0 verifiers rc=0 both. Hub `main` **`4b9a2632` at open → `c882488e` at close** — the live session landed 5 PRs mid-run. Close: core 5000/5000, graphql ~4990/5000, search 30/30. **Nothing merged, nothing enqueued, no gate approved.** Separate [escalation comment](https://github.com/FreeForCharity/FFC-Cloudflare-Automation/issues/719#issuecomment-6125166144) carries the one decision I need from Clarke. --- #### Run 258's deciding question is a… (truncated)
### Run 259 — ESCALATION for Clarke: half the hub's open PRs cannot satisfy the merge condition, and all three recovery paths are dead One decision needed. Everything below is measured this run, not inferred. **The situation.** Of **34** open PRs on the hub, **17** carry a Copilot *error body* on their current head — "Copilot encountered an error and was unable to review this pull request" — instead of a review. All 17 are stamped **07:27–07:49Z**, run 257's `update-branch` sweep window. AGENT… (truncated)
### Run 259 - START 2026-10-12 ~13:1xZ. Run number from this issue (258 END 10:53:10Z, addendum 11:06:03Z). **Step 0 clean.** `verify-conductor-clones.py` rc=0 (all 5 core clones on `main`, level with origin, no uncommitted paths); `verify-conductor-hooks.py` rc=0 (wired, blocks the L50 shape). Hub `main` `4b9a2632` -- unchanged since run 258 opened, so nothing landed in the ~2h gap. AGENTS.md "Who merges" merge condition and the safety doc re-read from the clone, not memory. Tooling verified:… (truncated)