[Retro] Sprint W10–W11 Retro Action Items — 2026-03-15

[github-actions]

Tracking issue for sprint retrospective action items identified in the W10–W11 retrospective discussion generated by run #23108113984.

Sprint: 2026-03-01 → 2026-03-15

---

🚨 Immediate / Critical (P0 — must resolve within hours)

• subcog#153 — Revoke exposed AWS Access Key in src/security/mod.rs (28h+ unresolved)
  • Revoke at AWS IAM console
  • Remove key from src/security/mod.rs, commit fix
  • Purge from git history: git filter-repo --path src/security/mod.rs
  • Rotate all dependent services
  • Close subcog#153 once resolved

🔴 High Priority (P1 — Day 1 of next sprint)

• atlatl + daedalus — Pin sigstore/cosign-installer to SHA faadad0cce49287aee09b3a48701e75088a2c6ad (v4.0.0) in Security Audit workflows (batch fix both repos)
• atlatl — Fix Clippy 1.94 strict lint violations on main
• atlatl-spec — Pin @redocly/cli back to 2.20.0 in package.json; redeploy Pages
• rlm-rs — Pin github/gh-aw to SHA 88319be75ab1adc60640307a10e5cf04b3deff1e (0.51.5) in Daily QA workflow
• github-project-manager — Pin github/gh-aw to SHA 88319be75ab1adc60640307a10e5cf04b3deff1e (0.51.5) in agentics-maintenance.yml

🟠 Medium Priority (P2 — Week 1)

• subcog#152 — Review and merge mgildea's feat(http): /healthz endpoint PR (CI passing, external contributor, requires 2 approvals)
• .github — Re-enable dependabot-rollout and dependabot-sweep workflows with PR review guardrails
• .github — Add Projects: Read/Write (user-level) to zircote-org-monitor GitHub App installation permissions

🟡 Low Priority (P3 — Week 2)

• lro-bench — Run E1–E6 benchmark experiments end-to-end (blocking atlatl bugs now fixed)
• atlatl-spec — Triage and prioritize features [Alert] Multi-Repo CI Alert — Cargo Audit Spread + Stale Failures (2026-03-08) #155, [org-monitor] Daily Report — 2026-03-08 #156, [Housekeeping] Stale Items Report — 2026-03-08 #157 (user-to-curated memory linking)
• sdlc-quality — Investigate CI failure from chore: update dependabot configuration commit (failing 14 days)
• vscode-git-adr — Fix actions/upload-artifact v6→v7 breaking change (CI failing 13 days)

📊 Sprint Metrics Summary

Metric	Value
Issues closed	~333 total / ~123 human
Issues opened	~361
Issue close rate	0.92× (backlog growing)
PRs merged	~315 total / ~103 human+AI
Repos with activity	8 / 22
Org CI health	81% (13/16 passing)
Active CI failures	4 repos
Security incidents	1 (critical, unresolved)

---

Generated by smart-retro workflow — https://github.com/zircote/.github/actions/runs/23108113984

Generated by Smart Retrospective · ◷