[daily regulatory] Regulatory Report - February 18, 2026

[github-actions[bot]]

Regulatory analysis of 15 daily reports generated on February 18, 2026 (covering activity from Feb 17–18). The overall system health is excellent: safe outputs achieved a 96.97% success rate, security posture remains perfect with 100% secret redaction coverage and zero secrets in job outputs, and the firewall correctly blocked all malformed requests without false positives. No critical cross-report discrepancies requiring immediate action were found.

Two areas warrant attention: (1) a gap between total workflow source files (213) and compiled lock files (152) — a 61-workflow delta that should be explained; (2) the discussion answer rate remains at 0% across all 100 sampled discussions, suggesting a process gap in community engagement. Additionally, the Sergo report identified code quality issues (4 error types missing Unwrap(), 25+ non-wrapping fmt.Errorf() calls) that impact Go error inspection.

📋 Full Regulatory Report

📊 Reports Reviewed

#	Report	Discussion	Created (UTC)	Status
1	Daily Secrets Analysis	#16635	20:09	✅ Valid
2	Daily Performance Summary	#16634	19:48	✅ Valid
3	Auto-Triage Report (Evening)	#16623	18:32	✅ Valid
4	Daily Team Evolution Insights	#16596	16:19	✅ Valid
5	Copilot PR Merged Report	#16591	15:30	✅ Valid
6	Repository Quality Improvement Report	#16570	13:42	✅ Valid
7	Agentic Workflow Audit Report	#16532	05:56	✅ Valid
8	Safe Output Health Report	#16513	04:33	✅ Valid
9	Daily Firewall Report	#16495	01:09	✅ Valid
10	Auto-Triage Report (Morning)	#16492	00:55	✅ Valid
11	Copilot Agent Session Insights	#16482	00:29	⚠️ Low success rate (by design)
12	Daily Compiler Code Quality Report	#16476	00:25	✅ Valid
13	Developer Documentation Consolidation	#16471	00:03	✅ Valid
14	Sergo Hybrid Symbol & Error Analysis	#16458	22:22 (Feb 17)	⚠️ Findings require action
15	Copilot Agent PR Analysis	#16438	20:43 (Feb 17)	✅ Valid

---

🔍 Data Consistency Analysis

Cross-Report Metrics Comparison

Issue Counts

Metric	Performance Summary	Notes	Status
open_issues	33	From 1,000-issue sample (90 days)	✅ Single source
closed_issues	967	From 1,000-issue sample (90 days)	✅ Single source
total_issues (sample)	1,000	90-day window cap	✅ Documented

Only the Performance Summary reports issue counts directly. No cross-report comparison is possible for issues today.

PR Counts

Metric	Performance Summary	Copilot PR Merged	Copilot Agent Analysis	Scope	Status
merged_prs (today)	—	37	—	Feb 18 only	✅
merged_prs (agent, 24h)	—	—	33	Feb 17 agent PRs	✅ Different scope
merged_prs (90-day)	67	—	—	90-day sample cap	✅ Different scope

Scope note: These are all intentionally different time windows. No discrepancy.

Workflow Counts ⚠️

Metric	Source	Value	Scope
Total workflow sources	Quality Improvement Report	213	All .md workflow files
Compiled lock files	Secrets Analysis	152	.lock.yml files only
Delta (uncompiled)	Derived	61	Workflows without lock files

Potential concern: 61 workflow source files (29%) have no compiled .lock.yml. This may be expected (templates, drafts, non-agentic workflows) but warrants verification.

Security Metrics

Metric	Secrets Analysis	Status
Workflows with redaction	152/152 (100%)	✅
Workflows with permissions	152/152 (100%)	✅
Secrets in job outputs	0	✅
Workflows without sanitization	6/152	⚠️ Needs review

Safe Output Health

Metric	Safe Output Report	Audit Report	Status
Runs analyzed	38	23	✅ Different scopes (all runs vs. auditable runs)
Safe output success rate	96.97%	—	✅ Healthy
Failures	1 (post-processing)	3 (workflow failures)	✅ Consistent

Firewall Health

Metric	Firewall Report	Audit Report	Status
Total requests (Feb 17-18)	445	1,102	⚠️ Different scope
Block rate	51.91%	65%	ℹ️ Different periods

Scope note: Firewall Report covers 8 firewall-enabled runs; Audit Report covers all 23 runs including non-firewall workflows. Not a discrepancy.

Consistency Score

• Overall Consistency: ✅ No true cross-report discrepancies detected
• Metrics with same scope: All match within tolerance
• Scope differences: All documented and expected
• Notable gap: 213 source files vs 152 compiled (requires investigation)

---

⚠️ Issues and Anomalies

Critical Issues

None detected.

Warnings

1. Workflow Source/Compiled Count Gap

• Metric: total_workflows (Quality Report: 213) vs compiled lock files (Secrets: 152)
• Delta: 61 workflow source files without .lock.yml companions
• Impact: Could indicate stale workflows, templates, or workflows that intentionally bypass compilation
• Severity: Medium
• Recommended Action: Run gh aw compile --check to identify which 61 files lack lock files and confirm each is intentional

2. Discussion Answer Rate: 0%

• Metric: 0/100 discussions answered (Performance Summary, 90-day window)
• Impact: Community questions go unanswered; reduces discoverability of solutions
• Severity: Medium
• Recommended Action: Establish a lightweight triage rotation for marking answered discussions

3. Copilot Session Success Rate: 4% (by design)

• Metric: 2/50 sessions completed successfully (Session Insights, Feb 17)
• Context: 66% are in "action required" state awaiting intentional human approval, not failures
• Impact: Metric is misleading without context; true failure rate is 18%
• Severity: Low — design pattern, not a defect
• Recommended Action: Create a separate "awaiting-approval" category to avoid conflating it with failures

4. Sergo Code Quality Findings

• Source: #16458 — Sergo Hybrid Analysis
• Findings: 4 custom error types missing Unwrap() methods; 25+ non-wrapping fmt.Errorf() calls
• Impact: Breaks Go 1.13+ error inspection with errors.Is() / errors.As()
• Severity: Medium-High (code correctness issue)
• Recommended Action: File issues for each affected error type and fmt.Errorf call site

5. 6 Workflows Without Input Sanitization

• Source: Secrets Analysis — 146/152 workflows with sanitization
• Impact: Potential injection vector if any of the 6 process untrusted user input
• Severity: Medium
• Recommended Action: Audit the 6 workflows to confirm they handle only non-user-supplied event data

Data Quality Notes

• Performance Summary is capped at 100 PRs and 1,000 issues — actual totals may be higher
• Copilot Agent Analysis covers Feb 17 only; Feb 18 data will appear in tomorrow's report
• Firewall Report covers only firewall-enabled workflows (8 of 23 audited runs)

---

📈 Trend Analysis

Week-over-Week Comparisons

Copilot Agent PR Success Rate

Date	PRs	Merged	Success Rate
2026-02-17	48	33	73.3% 📈
2026-02-16	52	36	69.2% 📉
2026-02-15	26	20	76.9% —

Success rate is recovering (+4.1% from Feb 16) but still below the Feb 15 peak.

Safe Output Health

Date	Success Rate	Notes
2026-02-18	96.97%	1 post-processing failure
2026-02-17	~100%	(Prior regulatory report: all valid)

Secrets Profile

Stable from Feb 17 to Feb 18: same 24 secret types, 152 workflows, no new secrets introduced.

---

📝 Per-Report Highlights

View Per-Report Analysis

Daily Secrets Analysis [#16635]

Quality: ✅ Valid | Period: Static analysis of all 152 compiled workflows

Metric	Value	Status
Workflows analyzed	152	✅
Redaction coverage	100%	✅
Secrets in outputs	0	✅
Unique secret types	24	✅
Workflows without sanitization	6	⚠️ Needs review

Daily Performance Summary [#16634]

Quality: ✅ Valid | Period: Last 90 days (Nov 20, 2025 – Feb 18, 2026), capped at 100 PRs / 1,000 issues

Metric	Value	Status
merged_prs	67/100	✅
open_prs	10/100	✅
open_issues	33/1,000	✅
closed_issues	967/1,000	✅
Discussion answer rate	0%	⚠️
Avg PR merge time	1.0 hours	✅
Avg issue close time	11.3 hours	✅

Agentic Workflow Audit [#16532]

Quality: ✅ Valid | Period: Feb 17–18, 2026 (24 hours)

Metric	Value	Status
Runs analyzed	23	✅
Success rate	85.7%	✅
Total cost	$3.95	✅
Total tokens	~30M	✅
Failures	3	⚠️
Missing data instances	1	⚠️

Failures: Contribution Check (invalid PR reference), Chroma Issue Indexer (timeout + pypi blocked), Smoke Copilot SDK (test failure).

Safe Output Health [#16513]

Quality: ✅ Valid | Period: Feb 17–18, 2026 (24 hours)

Metric	Value	Status
Safe output executions	33	✅
Actual success rate	96.97%	✅
Post-processing failures	1	⚠️ Minor
Skipped (conditional)	3	✅ Expected

Daily Firewall Report [#16495]

Quality: ✅ Valid | Period: Feb 17–18, 2026

Metric	Value	Status
firewall_requests_total	445	✅
firewall_requests_allowed	214 (48.09%)	✅
firewall_requests_blocked	231 (51.91%)	✅
firewall_domains_blocked	0	✅ All blocks are malformed requests
Unique allowed domains	5	✅

Copilot Agent Analysis [#16438]

Quality: ✅ Valid | Period: Feb 17, 2026 (24 hours)

Metric	Value	Status
agent_prs_total	48	✅
agent_prs_merged	33	✅
agent_success_rate	73.3%	✅
Closed without merge	12 (25%)	⚠️

Repository Quality Improvement Report [#16570]

Quality: ✅ Valid | Period: Static analysis of 213 workflows

Metric	Value	Status
Total workflows	213	ℹ️
With examples	107 (50%)	⚠️
With acceptance criteria	64 (30%)	❌ Low
With clear objectives	~30 (14%)	❌ Low
With phase/step structure	118 (55%)	✅

---

💡 Recommendations

Process Improvements

1. Investigate uncompiled workflows: Audit the 61 .md workflow files without .lock.yml to confirm each is intentional (template, draft, or non-agentic). Archive or compile as appropriate.
2. Discussion triage rotation: Assign a rotating reviewer to mark answered discussions. A 0% answer rate over 90 days signals a missing process.
3. Copilot session reporting: Add an "awaiting-approval" outcome category to agent session reports to avoid conflating intentional human gates with failures.

Data Quality Actions

1. Fix Sergo error handling findings: Create tracked issues for the 4 error types missing Unwrap() and 25+ non-wrapping fmt.Errorf() calls identified in #16458.
2. Audit 6 workflows without sanitization: Confirm none process untrusted user input (see Secrets Analysis [[daily secrets] Daily Secrets Analysis - February 18, 2026 #16635]).
3. Fix Contribution Check PR reference: Update the Contribution Check workflow to use a valid PR number in openclaw/openclaw (current PRs are ~#19783–19793, not Validate numeric context variables in activation to prevent injection attacks #16515).

Workflow Suggestions

1. Persist daily metrics snapshots: The Performance Summary currently has no historical baseline — storing snapshots would enable week-over-week trend detection.
2. Decouple safe output from post-processing monitoring: Track "safe output job health" and "post-processing step health" separately (as recommended in #16513).
3. Improve workflow prompt quality: Only 30% of workflows have acceptance criteria and 14% have clear objectives. Target 60%+ acceptance criteria coverage over the next 30 days.

---

📊 Regulatory Metrics

Metric	Value
Reports Reviewed	15
Reports Passed (Valid)	13
Reports with Warnings	2
Reports Failed	0
Critical Discrepancies	0
Medium Warnings	5
Overall Health Score	87%

---

Report generated automatically by the Daily Regulatory workflow
Data sources: Daily report discussions from github/gh-aw
Metric definitions: scratchpad/metrics-glossary.md

References:

• §22155753851

AI generated by Daily Regulatory Report Generator

• expires on Feb 21, 2026, 8:13 PM UTC

[github-actions[bot]]

This report has been superseded by a newer daily regulatory report.