[uk-ai-resilience] Untracked go/useless-assignment-to-field alert #679 in logs_orchestrator_stdin.go (Tier C) #61821

Summary

CodeQL alert #679 (go/useless-assignment-to-field, severity: warning) in pkg/cli/logs_orchestrator_stdin.go has no matching open UK-AI-resilience tracking issue, breaking the classification → control-verification loop for this run's recent-changes scope (7-day lookback since 2026-09-11T15:31:19Z).

Finding: An assignment to a Message field is useless since its value is never read afterward. This suggests either dead code or a logging/error-reporting path that silently drops information it was intended to convey — reducing detectability of failures in the log-orchestration pipeline.

Tier & risk-scoring

• Tier: C — Restricted Pending Review
• Exposure amplification: Low
• Patchability: High (isolated single-file fix)
• Detectability: Low — the assignment is silently discarded with no test coverage catching it, and no existing tracking issue surfaced it despite 58 open security issues in the backlog
• Operational fragility: Medium — obscures log/error content on whichever code path this feeds, weakening incident-response visibility
• Ownership confidence: Low — file sits in pkg/cli (no CODEOWNERS coverage; see companion gap tracked in [uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637)

Remediation action

• Inspect pkg/cli/logs_orchestrator_stdin.go around the flagged assignment to determine whether the Message field should be read/used, removed, or the assignment relocated.
• Add a regression test asserting the Message value is correctly propagated (or add a _ = ... / removal if genuinely dead code).
• Dismiss alert better logging of safe outputs #679 with rationale once fixed, or as a confirmed false positive with justification.

SLA urgency

High — untracked alerts in actively-changed CLI observability code reduce confidence in the classification step of the operational governance loop, and this one specifically weakens log/error visibility.

Related

• Full governance report: see linked discussion for this run (UK AI Open Code Risk & Resilience Governance — Recent-Changes Review, 2026-09-18).
• Companion ownership gap: [uk-ai-resilience] Missing .github/CODEOWNERS for security-sensitive compiler/CLI paths (Tier B) #61637 (missing CODEOWNERS for compiler/CLI paths).

Generated by UK AI Operational Resilience · copilot · auto · 63.6 AIC · ⌖ 8.79 AIC · ⊞ 7.9K · ◷