Add UK AI operational resilience Advisory bundle

[Copilot]

Introduces an installable Advisory operations bundle that adapts the UK AI operational resilience workflow for centralized, organization-wide execution.

Changes

• Central orchestration

  • Discovers and ranks relevant repositories.
  • Applies staged, review, and live rollout controls.
  • Dispatches bounded repository-scoped assessments.

• Operational resilience advisory

  • Preserves recent-change analysis, control verification, AI-aware risk scoring, and remediation prioritization.
  • Consolidates findings into one deduplicated advisory issue.
  • Treats inaccessible evidence as incomplete rather than inferred.

• Safety boundaries

  • Marks outputs as advisory, non-binding, and incomplete by design.
  • Requires human review for proposed risk tiers and actions.
  • Excludes secrets, exploit details, personal data, and confidential incident evidence.

• Package integration

  • Adds the focused package manifest and operator documentation.
  • Extends configuration, lifecycle, inventory, contract, and canary coverage.

[pelikhan]

@copilot review this workflow for UK threat spec adherance.

[Copilot]

@copilot review this workflow for UK threat spec adherance.

Claude Opus 5 found substantive adherence gaps: AI functionality was incorrectly used as a scope gate, repository visibility and dependency evidence were missing, dormancy could be treated as safe, and private-code recommendations did not enforce the GOV.UK threat-model triad or periodic reapproval. Commits 942e834 and 49a51dd address these by making AI a threat accelerator, enforcing open-by-default and the minimum control standard, collecting visibility/alert-age/automation evidence, and requiring attacker + publication-added risk + realistic path to harm before any closure recommendation. Focused tests and compatible-manifest compilation pass.

[pelikhan]

@copilot add an agentic workflow that runs on a schedule (weekly) and ensures that the fleet is still aligned with the original specification.

[Copilot]

@copilot add an agentic workflow that runs on a schedule (weekly) and ensures that the fleet is still aligned with the original specification.

Implemented in 4e0cd2c. Advisory / Package Maintainer now runs weekly, reconciles the installed package against the original stable requirement IDs and current GOV.UK specification, and maintains a packaged implementation ledger through a bounded draft PR or one deduplicated fleet-gap issue. It fails incomplete on inaccessible authority/package inputs and never inspects target repositories or edits operation workflows. Targeted tests and compatible-manifest compilation pass; the full unit suite remains 52/53 only because local gh-aw v0.87.2 is older than the required v0.87.6.

[pelikhan]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved in merge commit 4e0bd58. The branch now includes current main; the single lockfile-inventory conflict preserves both Advisory and dashboard entries.