Skip to content

Weekly Report 2026-08-18 #2390

Closed
Closed
Weekly Report 2026-08-18#2390

Description

@clawgenti
clawgenti
opened on Aug 18, 2026

Org Weekly Report: 2026-08-11 -- 2026-08-18

Generated for rossoctl by the github-weekly-report skill.

Org-Wide Summary

Repo Merged PRs Open PRs Open Issues New Issues CI Pass Rate Status
cortex 11 20 33 3 19/30 (63%) active
rossoctl 6 24 191 15 19/30 (63%) active
automation 5 4 6 2 30/30 (100%) active
workload-harness 5 1 11 1 14/30 (47%) active
agent-skills 2 1 1 0 22/30 (73%) active
operator 2 5 16 2 30/30 (100%) active
examples 1 36 14 1 22/30 (73%) active
.github 0 1 3 0 22/30 (73%) quiet
TOTAL 32 92 275 24

Cross-Repo Highlights

Multi-repo contributors

  • @rubambiza was the busiest cross-repo contributor, merging into agent-skills, automation, and workload-harness (6 PRs) — largely the org migration work: repointing reusable-workflow refs to rossoctl/.github (automation#51, workload-harness#60, agent-skills#31), decomposing program-lib.sh into portable modules (automation#50), and the link-health fixer breadcrumb (automation#56).
  • @vz-ibm drove cortex and workload-harness (5 PRs) on the SPARC service: WatsonX reasoning-model support (cortex#739), request-logging docs (cortex#741), and the authbridge SPARC plugin integration in the harness (workload-harness#54).
  • @evaline-ju touched cortex, examples, and rossoctl (3 PRs), including the session budget-enforcement plugin (cortex#723) and link fixes.
  • @esnible was the dominant contributor in rossoctl — the busiest repo by issue volume — landing the identity-config endpoint (feat: Add PUT /{namespace}/{name}/identity-config endpoint #2369) and k8s resource-limit overrides (feat: allow k8sResourceLimits/k8sResourceRequests overrides for agents and tools #2383), plus a cortex plugin-catalog doc.

Org-wide CI

  • Aggregate pass rate is 178/240 (74%). automation and operator are the clean repos at 100%.
  • workload-harness drags the average down at 47% — the failing workflows are pr-verifier.yml (3 failures) and project.yml (2). cortex and rossoctl both sit at 63%, with cortex's "Security Scans" (3) and "CI" (2) the main culprits.

Security concerns (open PRs flagged SECURITY, unreviewed >7 days)

Dependabot accumulation

  • 64 open dependabot PRs across the org — well past the batching threshold. Breakdown: examples 36, cortex 16, rossoctl 9, operator 3. The examples backlog alone is the single largest review liability this week.

Shared themes

  • Org rename tail — reusable-workflow repointing and program-lib modularization landed across three repos.
  • AIAC / SPARC buildout — event broker + OPA enforcement (cortex#752/Feat/terraform validation checks #754), plus harness integration, is the dominant feature thread.
  • Link-health automation — clawgenti-authored broken-link fixes and reports recur across rossoctl, automation, and workload-harness.

Active Epics

Epic Lead Key Result (inferred) This Week
rossoctl/rossoctl#2244 Cortex Phase 1 @esnible Ship Cortex data-plane phase 1 1 sub-issue closed (#684), 4 open
rossoctl/rossoctl#2277 AIAC MVP @omerboehm Agent-Identity-and-Access-Control MVP 1 sub-issue closed, 2 open
rossoctl/rossoctl#1461 User access to Kagenti Sandbox with OpenShell @aslom Multi-tenant sandbox access via OpenShell 15 open
rossoctl/rossoctl#1817 Sandbox CRD extensions for agent state & session mgmt @cwiklik Stateful agent infra (CRD extensions) 8 open
rossoctl/rossoctl#1469 Rossoctl Documentation and Usability Improvements @esnible Docs + usability polish 6 open
rossoctl/rossoctl#1460 Authorization and Identity for Event-Driven Agent @aslom Authz/identity for event-driven agents 8 open
rossoctl/rossoctl#2254 Automated cross-version benchmarking for regression @webchang Cross-version regression benchmarking 10 open
rossoctl/rossoctl#2074 Skill-bound agent identity — deny tool access on scope unassigned Deny tool access outside granted scope 6 open
rossoctl/rossoctl#2087 AIAC Quality Framework — Guardrails, Testing @omerboehm AIAC guardrails + testing framework 4 open
rossoctl/rossoctl#1302 Runtime-Attested Agent Card @webchang Runtime attestation for agent cards 6 open

Action Items

# Action Repo Owner Priority
1 Merge APPROVED security fix #490 (go.sum regen), open+approved 28 days operator @Ibrahim2595 P0
2 Merge or re-triage APPROVED security PR #677 (tls_bridge upstream_insecure), open 31 days cortex @aslom P0
3 Investigate workload-harness CI at 47% — pr-verifier.yml (3 fails) and project.yml (2 fails) workload-harness @vz-ibm P0
4 Review 21–31 day security dep bumps #704, #2224, #2235–2240 cortex, rossoctl @esnible P1
5 Fix cortex CI — "Security Scans" (3) and "CI" (2) failures at 63% pass rate cortex @oblinder P1
6 Batch-review the 36 open dependabot PRs (many SECURITY-flagged, 17–31 days) examples @evaline-ju P2
7 Batch-review the 16 open dependabot PRs cortex @vz-ibm P2
8 Batch-review the 9 open dependabot PRs rossoctl @esnible P2
9 Triage 24 broken-link issues opened this week (#2373–#2382, workload-harness#62) rossoctl @clawgenti P3
10 Resolve stale non-dependabot PRs >16 days: #2335, #2327 rossoctl @w3lld1, @Alan-Cha P3

cortex

Merged PRs (11)

Top contributors: @app/dependabot (4), @vz-ibm (3), @oblinder (2), @esnible (1), @evaline-ju (1)

# Title Author Merged
#757 Docs: Add plugin catalog @esnible 2026-08-14
#754 Feat: AIAC Event Broker + Keycloak SPI listener (phase 2,... @oblinder 2026-08-16
#752 Feat: AIAC OPA plugin integration + live enforcement (pha... @oblinder 2026-08-13
#750 chore(sparc-service): bump agent-lifecycle-toolkit to 0.11.0 @vz-ibm 2026-08-11
#749 build(deps): Bump github/codeql-action/upload-sarif from ... @app/dependabot 2026-08-11
#748 build(deps): Bump github/codeql-action/init from 4.37.4 t... @app/dependabot 2026-08-11
#747 build(deps): Bump rojopolis/spellcheck-github-actions fro... @app/dependabot 2026-08-11
#743 build(deps): Bump docker/login-action from 4.2.0 to 4.6.0 @app/dependabot 2026-08-11
#741 docs(sparc-service): document SPARC_LOG_REQUESTS and SPAR... @vz-ibm 2026-08-11
#739 fix(sparc-service): WatsonX reasoning-model support + Doc... @vz-ibm 2026-08-11
#723 feat: ✨ Session budget enforcement plugin @evaline-ju 2026-08-12

Open PRs (20)

Ready to Merge (1)

# Title Author Notes
#677 Feat: Add tls_bridge.upstream_insecure to skip ori... @aslom SECURITY, stale (31d)

Changes Requested (1)

# Title Author Days Notes
#760 Fix: Propagate every plugin header mutation in ext... @JoshSag 1 SECURITY

Needs Review (16)

# Title Author Days Notes
#774 build(deps): Bump github/codeql-action/init from 4... @app/dependabot 0
#773 build(deps): Bump github/codeql-action/upload-sari... @app/dependabot 0
#772 build(deps): Bump github/codeql-action/analyze fro... @app/dependabot 0
#771 build(deps): Bump github.com/maximhq/bifrost/core ... @app/dependabot 0 SECURITY
#770 build(deps): Bump golang.org/x/net from 0.57.0 to ... @app/dependabot 0
#769 build(deps): Bump langchain-core from 1.4.9 to 1.5.5 @app/dependabot 0
#768 build(deps): Bump github.com/envoyproxy/go-control... @app/dependabot 0
#767 build(deps): Bump langchain-openai from 1.3.5 to 1... @app/dependabot 0
... +8 more

Draft PRs (2)

  • #762 — Feat: Add the lineage demo — per-request lineage from the sidecar
  • #761 — Feat: Lineage telemetry plugin — two facts-only spans per exchange

CI Health

  • 19/30 (63%) passed
  • Failing: "Security Scans" — 3 failure(s)
  • Failing: "CI" — 2 failure(s)

New Issues (3)

# Title Created
#759 feature: token-budget human-in-the-loop approval when bud... 2026-08-14
#758 Add JTI-based revocation to token exchange cache 2026-08-14
#756 [dep-bump] Stale routine bump: github.com/rossoctl/contex... 2026-08-13

rossoctl

Merged PRs (6)

Top contributors: @app/dependabot (3), @esnible (2), @evaline-ju (1)

# Title Author Merged
#2386 build(deps): Bump astral-sh/setup-uv from 9.0.0 to 10.0.1... @app/dependabot 2026-08-18
#2383 feat: allow k8sResourceLimits/k8sResourceRequests overrid... @esnible 2026-08-17
#2372 build(deps): Bump the minor-and-patch group across 1 dire... @app/dependabot 2026-08-13
#2369 feat: Add PUT /{namespace}/{name}/identity-config endpoint @esnible 2026-08-13
#2366 fix: 🐛 Fix links @evaline-ju 2026-08-12
#2271 build(deps): Bump the major group across 1 directory with... @app/dependabot 2026-08-13

Open PRs (24)

Needs Review (19)

# Title Author Days Notes
#2388 🌱 Split agents.py router into modules under 1000 l... @esnible 0
#2385 build(deps): Bump hadolint/hadolint-action from 3.... @app/dependabot 2
#2384 build(deps): Bump the minor-and-patch group across... @app/dependabot 2
#2371 chore: Remove migrated github-pr-review skill @rubambiza 4
#2348 docs: Link health report (auto-updated) @clawgenti 12
#2336 chore(deps): Update mcp requirement from <2,>=1.0.... @app/dependabot 16 stale (16d)
#2335 fix(backend): fall back to legacy agent card endpoint @w3lld1 16 stale (16d)
#2327 docs: add SVG diagram style guide @Alan-Cha 18 stale (18d)
... +11 more

Draft PRs (5)

  • #2368 — fix: use Istio gateway for E2E tests instead of direct service port-forwards
  • #2207 — docs: Rosso vision brief + landing page (DRAFT, for review)
  • #2180 — Docs: local (Kind, gate-only) skill-attestation demo harness
  • #2176 — Docs: add docs-temp source and website sync trigger
  • #2084 — feat(openshell): switch to upstream in-process Kubernetes driver

CI Health

  • 19/30 (63%) passed
  • Failing: "Cleanup Stale HyperShift Clusters" — 1 failure(s)
  • Failing: "RC Release Validation" — 1 failure(s)

New Issues (15)

# Title Created
#2389 check-release-pins doesn't render subcharts — can't catch... 2026-08-17
#2387 Weekly Report 2026-08-17 2026-08-17
#2382 🐛 Broken link in rossoctl/ui-v2/AUTHENTICATION.md: ht... 2026-08-14
#2381 🐛 Broken link in rossoctl/ui-v2/AUTHENTICATION.md: ht... 2026-08-14
#2380 🐛 Broken link in PERSONAS_AND_ROLES.md: http://rossoc... 2026-08-14
#2379 🐛 Broken link in docs/users-guides/PERSONAS_AND_ROLES... 2026-08-14
#2378 🐛 Broken link in docs/users-guides/PERSONAS_AND_ROLES... 2026-08-14
#2377 🐛 Broken link in docs/README.md: https://github.com/r... 2026-08-14
#2376 🐛 Broken link in docs/gateway.md: https://github.com/... 2026-08-14
#2375 🐛 Broken link in docs/demos/demo-slack-research-agent... 2026-08-14
#2374 🐛 Broken link in CLAUDE-ORG.md: https://github.com/ro... 2026-08-14
#2373 🐛 Broken link in CLAUDE-ORG.md: http://rossoctl.io/ 2026-08-14
#2367 E2E tests bypass Istio gateway - should test production r... 2026-08-11
#2363 Audit non-default branches for reintroduced kagenti/ work... 2026-08-11
#2362 Istio ambient mode certificates expired without automatic... 2026-08-11

automation

Merged PRs (5)

Top contributors: @rubambiza (3), @clawgenti (2)

# Title Author Merged
#56 feat: Add standing-order breadcrumb to link-health fixer PRs @rubambiza 2026-08-17
#51 ci: Repoint reusable-workflow refs to rossoctl/.github @rubambiza 2026-08-11
#50 refactor: Decompose program-lib.sh into portable modules ... @rubambiza 2026-08-12
#48 docs: Link health report (auto-updated) @clawgenti 2026-08-11
#46 docs: Automation health dashboard (auto-updated) @clawgenti 2026-08-11

Open PRs (4)

Needs Review (3)

# Title Author Days Notes
#59 feat: Add weekly-report.sh scoped to core repos @rubambiza 0
#54 docs: Link health report (auto-updated) @clawgenti 5
#53 docs: Automation health dashboard (auto-updated) @clawgenti 6

Draft PRs (1)

  • #41 — Feat: Add a link back to the skill when opening a link issue (breadcrumb)

CI Health

  • 30/30 (100%) passed

New Issues (2)

# Title Created
#58 Add context-service to core-repos.txt 2026-08-17
#57 feat: Scope weekly report to core repos 2026-08-17

workload-harness

Merged PRs (5)

Top contributors: @vz-ibm (2), @clawgenti (1), @rubambiza (1), @yoavkatz (1)

# Title Author Merged
#61 docs: Fix broken internal link to #963 @clawgenti 2026-08-11
#60 ci: Migrate reusable-workflow refs to rossoctl/.github @rubambiza 2026-08-11
#54 feat(authbridge): add sparc plugin integration to the pip... @vz-ibm 2026-08-11
#53 fix(deploy-benchmark): add --subset flag for tau2 domain ... @vz-ibm 2026-08-11
#48 Refactor Keycloak direct-access-grants into shared helper... @yoavkatz 2026-08-12

Open PRs (1)

Needs Review (1)

# Title Author Days Notes
#64 feat(analyze): add --save-analysis flag to save co... @yoavkatz 4 SECURITY

CI Health

  • 14/30 (47%) passed
  • Failing: ".github/workflows/pr-verifier.yml" — 3 failure(s)
  • Failing: ".github/workflows/project.yml" — 2 failure(s)

New Issues (1)

# Title Created
#62 🐛 Broken link in exgentic_a2a_runner/README.md: https... 2026-08-12

agent-skills

Merged PRs (2)

Top contributors: @rubambiza (2)

# Title Author Merged
#31 ci: Migrate reusable-workflow refs to rossoctl/.github @rubambiza 2026-08-11
#30 chore: Rename marketplace to rossoctl-agent-skills @rubambiza 2026-08-11

Open PRs (1)

Needs Review (1)

# Title Author Days Notes
#32 feat: Add --repos flag to scope weekly report @rubambiza 0

CI Health

  • 22/30 (73%) passed
  • Failing: ".github/workflows/pr-verifier.yml" — 4 failure(s)
  • Failing: ".github/workflows/project.yml" — 2 failure(s)
  • Failing: ".github/workflows/self-assign.yml" — 2 failure(s)

operator

Merged PRs (2)

Top contributors: @cwiklik (1), @Alan-Cha (1)

# Title Author Merged
#506 Fix: stop rendering duplicate rossoctl-authbridge SCC (ro... @cwiklik 2026-08-11
#505 fix: clarify SPIRE warning message to avoid confusion @Alan-Cha 2026-08-11

Open PRs (5)

Ready to Merge (1)

# Title Author Notes
#490 Fix: regenerate token-broker go.sum for renamed co... @Ibrahim2595 SECURITY, stale (28d)

Needs Review (3)

# Title Author Days Notes
#509 build(deps): bump the minor-and-patch group across... @app/dependabot 0 SECURITY
#503 build(deps): bump the minor-and-patch group across... @app/dependabot 14
#495 build(deps): bump the major group across 1 directo... @app/dependabot 21 stale (21d)

Draft PRs (1)

  • #478 — feat(operator): fetch JWT-SVID via go-spiffe SDK, remove spiffe-helper sidecar

CI Health

  • 30/30 (100%) passed

New Issues (2)

# Title Created
#508 release.yml doesn't pin injected AuthBridge images (they ... 2026-08-17
#507 [dep-bump] Stale routine bump: major group in operator 2026-08-13

examples

Merged PRs (1)

Top contributors: @evaline-ju (1)

# Title Author Merged
#789 🐛 Update link @evaline-ju 2026-08-11

Open PRs (36)

Needs Review (36)

# Title Author Days Notes
#804 chore(deps): Bump the minor-and-patch group across... @app/dependabot 3 SECURITY
#803 chore(deps): Bump the minor-and-patch group across... @app/dependabot 3 SECURITY
#802 chore(deps): Bump the minor-and-patch group across... @app/dependabot 3 SECURITY
#801 chore(deps): Bump the minor-and-patch group across... @app/dependabot 3 SECURITY
#800 chore(deps): Bump the minor-and-patch group across... @app/dependabot 3 SECURITY
#799 chore(deps): Bump the minor-and-patch group across... @app/dependabot 3 SECURITY
#798 chore(deps): Bump the minor-and-patch group across... @app/dependabot 3 SECURITY
#797 chore(deps): Bump the minor-and-patch group across... @app/dependabot 3 SECURITY
... +28 more

CI Health

  • 22/30 (73%) passed
  • Failing: "Build-Publish" — 1 failure(s)

New Issues (1)

# Title Created
#788 [dep-bump] Stale routine bump: Update a2a-sdk[http-server... 2026-08-11

.github

Open PRs (1)

Ready to Merge (1)

# Title Author Notes
#116 Update Platform Tools title and description @Ronen-Levy

CI Health

  • 22/30 (73%) passed

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Rossoctl Issue Prioritization
    Status
    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions