housekeeping: label/census audit 2026-09-17 — 17 label fixes applied, taxonomy decisions open

[Xore]

Scope and method

Read-only audit of all open issues (bodies + every comment, paginated), the 30-label catalogue, historical label usage across 1,573 issues and 1,633 PRs, and label-producing automation (alarm watchers, Dependabot, elastic-release-watch). No source, tests, assignments, closures or deployments. This issue is the consolidated publication; per-issue comments were intentionally avoided to reduce noise.

Census

41 open issues reviewed in full (bodies and all comments), including #1947 and #1805, which are large multi-thousand-character benchmark threads. Zero open issues excluded from review. Concurrency re-check immediately before mutations: no body changed; two new comments (#3205/#3201 shadcn acceptance checkpoint) reviewed before any edit.

Label fixes applied (verified read-back after each)

issue	before	after	why
#3199	(none)	enhancement, ml, llm	only wholly unlabeled open issue; body-only colibri/benchmark do not assign labels
#1523	documentation, windows-sandbox, blocked, parked	+ epic	body self-describes as consolidated post-release tracker
#3179	enhancement, security	+ decision	body is an explicit fork-vs-accept operator decision
#3212	enhancement, security	+ analysis	body requests security,analysis,enhancement
#3213	enhancement, security	+ analysis	body requests security,analysis,enhancement
#3214	security, decision	+ honeypot, enhancement	body requests all four
#3215	enhancement, security	+ analysis	body requests security,analysis,enhancement
#1804	enhancement, ml, llm, ghidra, analysis	+ research	model-evaluation findings/report thread
#1805	enhancement, llm, ghidra, analysis	+ epic	multi-part tracker: transcript rule, Tier A/B, claim pool, ghidra-slot matrix, promotion record
#1947	enhancement, ml, llm, ghidra, analysis	+ epic	the model-matrix rebuild epic, spanned by #1805/#1804/#2279/#2969/#2986 and round 7
#1993	bug, ops, epic, parked	+ blocked	latest correction names concrete external blockers (#2136, #2972); parked alone understated the dependency gate
#2136	bug, ops	+ decision	latest comment asks operator for one recollection line; otherwise stays honestly open
#2279	enhancement, ml, llm	+ ghidra	gpt-oss re-run under the harmony shape for the ghidra/revdeck slot matrix
#2969	ops, llm	+ enhancement	requalification work item, not an incident
#2986	enhancement, ml	+ llm, research	Tier-2 accuracy wiring and calibration on the disposition corpus
#3023	bug, ops, ml, llm, in-progress	+ regression	body reports recurrence of #2582; regression label exists for exactly this
#3172	enhancement, llm	+ research	colibri evaluation record with measured adopt-conditional outcome

Description fix: dashboard was "Go dashboard, its routes, templates and CSS" — now "Dashboard product area — routes, templates, styling and frontend UX" (open work is the Next.js/shadcn migration). Name and color unchanged.

All additions were additive; no label removed. Full before/after values with rollback data are recorded locally in the run's changes.json.

Deliberately preserved state labels

• AFTER RELEASE 0.1.0 #1523 keeps both blocked and parked — explicit deferred gate plus waiting state, not a conflict.
• ops(llm): #2582 has recurred — hp-llm-worker unhealthy for ~11h, and the #1947 phase-2 sweep is running contended, not cold #3023 keeps in-progress despite the "remaining parked" comment; removing an active label needs a validated state transition, not a comment read. The regression addition is separate from that question.
• llm: evaluate colibri as a serving engine for big/MoE models on the fleet #3172 does not get parked: the early hardware blocker was explicitly withdrawn and a measurement was completed and recorded.
• round7-9 (gated): training above 14B on this card — 27B dense QLoRA at the VRAM edge with Unsloth offload, or a recorded rejection #3088/windows-sandbox: the restored win11-analysis golden image predates #956 — 'Samples' share, no 'Inbox', so every clone fails the #100 content check #3018/Epic: honeypot-canarytokens #1993 keep parked (named gates intact).
• Alarm labels (ci-queue-stall, disk-usage-alarm, backup-staleness-alarm family) are created on demand by their watchers and self-heal; zero open usage does not make them obsolete. compose-drift-alarm's description is narrow relative to the watcher's current scope (retired stacks, health streaks, resource drift) but matches the script's own gh label create text, so it is left as-is.

Taxonomy decisions left open (operator)

1. Dependabot references labels that do not exist: github-actions, go, containers (and frontend, which exists but has an empty description and zero usage). Dependabot will fail to apply the missing ones on every PR. Options: create them (with descriptions/colors) or prune them from .github/dependabot.yml. Zero current open usage does not imply obsolete — go/containers had heavy historical usage. Not acted on: label creation on this evidence alone is a recurring-need judgment, and editing dependabot.yml is a repo change outside housekeeping scope.
2. frontend vs dashboard: kept distinct. frontend is currently a Dependabot-scoped automation name, not a duplicate of the dashboard topic. If Dependabot labels are pruned instead of created, frontend can be retired then.
3. analysis vs research: confirmed distinct and both in active correct use (analysis = payload-analysis pipeline topics, research = findings/reports). No merge.
4. State-label family: blocked, decision, parked, HALTED, in-progress all have distinct live semantics; no consolidation proposed.
5. #3135 keeps decision despite reading more like a documented procedure: the decision-label mismatch is real but removal is a judgment call, not an unambiguous fix.
6. Alias mapping (round-7/shadcn): child bodies use round7-N / #shadcn-N aliases without numeric links. Epic: round 7 — Unsloth training and dynamic requant, served via Ollama, scored on a fresh three-slot benchmark #3079 and Epic: COMPLETE dashboard rewrite — shadcn component/layout/style fidelity on every page #3201 already enumerate their children explicitly, so no corrective comments were posted — the mapping exists on the epics. If the aliases bother anyone, the fix belongs in the child bodies by their own campaigns.

Relationship links checked (no action needed)

• research: Interlock ransomware campaign exploiting CVE-2026-20131/20079/20316 Cisco Secure Firewall Management Center -- APIARY sensor coverage #3180 ↔ Preserve bounded binary HTTP evidence and capture completeness alongside existing serialization classification #3212/Separate HTTP status, credential extraction and simulated authentication outcomes in web telemetry #3213/Decide whether FMC-specific inert persona coverage adds value beyond existing ASA and HTTP decoys #3214/Define an offline FMC management-audit ingestion contract for actual state-change detections #3215: already cross-linked in the findings comment.
• Epic: COMPLETE dashboard rewrite — shadcn component/layout/style fidelity on every page #3201 links all ten shadcn children; every child says "Part of Epic: COMPLETE dashboard rewrite — shadcn component/layout/style fidelity on every page #3201".
• Epic: round 7 — Unsloth training and dynamic requant, served via Ollama, scored on a fresh three-slot benchmark #3079 maps round7-1..9 to round7-1: Unsloth training toolchain on the homeserver — pinned container, Ada-only GPU, merge → GGUF → imatrix → Ollama export path, smoke test #3080–round7-9 (gated): training above 14B on this card — 27B dense QLoRA at the VRAM edge with Unsloth offload, or a recorded rejection #3088; ml: wire Tier 2 (accuracy) into ml-worker/benchmarks — BETH sanity rail + calibration on the #1968/#2395 disposition corpus #2986 already linked from Epic: alerting trust — ml-worker scoring semantics, self-describing alerts, and the labelled-corpus gap #1974; AFTER RELEASE 0.1.0 #1523/Evaluate domain-specialised models for the Ghidra, Rev·Deck and IOC-extraction jobs against #159's corpus #1804/local-llm: evaluate the other 6 REx86-paper fine-tuned models against #159's corpus and benchmark them against each other #847 chain already noted in comments.
• PR docs(benchmarks): #1805-c ghidra-slot matrix — cold-protocol re-measure, and promote gemma-4-26B-A4B #2641 (open, draft) carries Benchmark fidelity: run real Ghidra over the #159 corpus so models are scored on production-shaped input #1805's promotion decision; its body lacks Closes #1805 — already noted on Benchmark fidelity: run real Ghidra over the #159 corpus so models are scored on production-shaped input #1805 by a prior review; flagging again so the merge does not strand the issue.

Dependency state checks performed

#2972 closed (fixed, drift corrected, #3028 filed for the detector gap) — #1993's blocker list remains accurate. #2925 closed with KEEP-threshold decision — #1974's dependency claim stands. #3106/#3154 closed/merged with remainder correctly spun into #3163. #3129/#3165 closed/merged (llm-worker allowlist). #3030/#3041 closed. #2582 closed; its recurrence is what #3023 tracks. PR #2641 still open/draft.

Not done (out of scope)

No label deletions/renames, no mass relabeling of closed items, no closures, no assignment changes, no repo file edits, no model/provider changes, no CI polling.