[uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B) #59491

Summary

Four new/recurring go/bad-redirect-check CodeQL alerts in actively-changed CLI/workflow-compiler files have no matching open tracking issue, breaking the classification → control-verification loop for this run's recent-changes scope (7-day lookback since 2026-09-01):

• Alert #674 — pkg/cli/add_package_manifest_imports.go
• Alert [Custom Engine Test] Test Issue Created by Custom Engine #669 — pkg/workflow/graders_config.go
• Alert Codex fails to report failure if unauthorised #668 — pkg/workflow/graders_config.go
• Alert [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667 — pkg/cli/add_package_manifest_includes.go

This is the same alert class flagged as a recurring false positive in #57472 (path-traversal/redirect guards), and the same class previously tracked individually for add_package_manifest.go in #54037.

Tier & risk-scoring

• Tier: B — Open With Conditions
• Exposure amplification: Low–Medium
• Patchability: High
• Detectability: Medium (alert exists in code scanning, but untracked in issue backlog)
• Operational fragility: Medium
• Ownership confidence: Medium

Remediation action

• Triage alerts #674, [Custom Engine Test] Test Issue Created by Custom Engine #669, Codex fails to report failure if unauthorised #668, [Custom Engine Test] Test Pull Request - Custom Engine Safe Output #667 individually: confirm whether each is a genuine incomplete-redirect-check bug or a false positive consistent with the pattern in [uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472.
• If false positive, land a shared helper/annotation (e.g. a validated isSafeRelativePath utility checked for // and /\ prefixes) across pkg/cli and pkg/workflow to eliminate the recurring finding class, then dismiss the alerts with that rationale.
• If genuine, patch the redirect/path checks in add_package_manifest_imports.go, add_package_manifest_includes.go, and graders_config.go to also reject // and /\ prefixed inputs.
• Open explicit tracking issues (or link to this issue) for each alert so future dismissal-hygiene audits can verify closure state.

SLA urgency

High — untracked alerts in actively-changed files reduce confidence in the classification step of the operational governance loop; low individual exploit likelihood keeps this at High rather than Critical.

Related

• False-positive pattern: [uk-ai-resilience] UK AI Governance: recurring go/bad-redirect-check false positive across path-traversal guards (Tier B) #57472
• Prior single-file precedent: [uk-ai-resilience] UK AI Governance: unreviewed CodeQL go/bad-redirect-check alert in add_package_manifest.go (Tier B) #54037
• Full governance report: see linked discussion for this run.

Generated by UK AI Operational Resilience · copilot · auto · 55.1 AIC · ⌖ 12.6 AIC · ⊞ 8.1K · ◷