🐛 bug: hive's built-in prompts outrank a repository's own AGENTS.md, so repo rules lose every conflict

[Danathar]

Summary

Hive agents work on repositories other than hive's own, and those repositories
state their local rules in AGENTS.md — the cross-tool convention hive already
reads and injects into a kick. When hive's own prompt and the repository's
AGENTS.md disagree, nothing tells the agent which one wins, and hive's
wording is consistently the more forceful of the two. The agent follows hive.

On projectbluefin/bluefin, whose AGENTS.md says "All pull requests target
testing. Never open a content PR against main", hive agents opened PRs
against main and failed the repo's base-branch gate. On
projectbluefin/common and projectbluefin/review, hive titled PRs
[scanner] fix: … and failed those repos' conventional-commit title gates.
Four bot PRs in one night, all dead on arrival. None of them a model error —
the agents did precisely what hive instructed.

Blast radius: every repository hive serves that is not hivecommons/hive.
Nothing here is agent behavior; it is prompt and precedence text.

What the agent actually sees

agentsmd.InjectionText (src/pkg/agentsmd/agentsmd.go:330) renders the
repository's AGENTS.md under a bare header and nothing else:

# Repository Agent Instructions (AGENTS.md)

<the repo's body>

There is no statement that these instructions outrank hive's own. They arrive
as undifferentiated prose.

Hive's instructions on the same subject arrive with a verification step
attached. buildTaskPromptBodyForAccess
(src/pkg/dashboard/contribute_ws.go:5767):

Resolve <repo>'s own default branch (gh repo view <repo> --json defaultBranchRef) … Open the PR against the same branch, and confirm the PR's base is that branch before you report done.

and src/pkg/policies/defaults/scanner-holdgated.md:69:

Create a worktree cut from the branch the PR will target — the repository default unless the work names another

Given a doc that says one thing and an imperative with a self-check that says
another, a model follows the imperative. Consistently.

Two instances of the same bug

Base branch. Hive asserts the PR target is the repository default. That is
a guess about a repo's conventions — right for most repos, wrong for any repo
using a promotion model, where the default branch is the released line and
PRs land on an integration branch.

This is the third iteration of the same assumption, and the prior two were both
filed as bugs:

• 🐛 bug: PR base is hardcoded to 'main' and the repository default branch is never consulted #4928 — base hardcoded to main, repository default never consulted
• 🐛 bug: contributor task prompts name the hive's own source branch as the PR base, not the target repository's default branch #6081 — contributor prompts named the hive's own source branch as the base

Each fix replaced one wrong assertion with a better one. The remaining gap is
that hive asserts at all, rather than deferring to the repository.

PR title format. The shipped policy templates hardcode
--title "[<lane>] …" — 19 of the files under src/pkg/policies/defaults/ do
this, e.g. scanner-holdgated.md:78 and scanner-full.md:71. That is hive's
own house style (this repo has no title gate, so it works here) projected onto
every repo hive touches. Repos enforcing Conventional Commits reject it on the
first character.

AGENTS.md already warns about exactly this class of leak for exactly these
files: "those are embedded into the binary and run against arbitrary repos, so
a hardcoded login there would leak one repo's maintainers into every hive
deployment." A hardcoded title format and a hardcoded base-branch assumption
are the same mistake with a different payload.

The [lane] prefix is load-bearing for issue routing
(src/pkg/classify/classifier.go:253 routes [scanner] … issues back to the
scanner lane). It is not load-bearing for PRs: intent.Classify
(src/pkg/intent/intent.go:144) keys off AgentAuthor, changed file paths and
FeatureSignals keywords, never the title prefix. Removing it from PR titles
only is safe.

Evidence

PR	Gate failed	Why
projectbluefin/bluefin#1275	Check PR base branch	BASE_REF: main, repo requires testing
projectbluefin/bluefin#1276	Check PR base branch	same
projectbluefin/common#1127	validate	title [scanner] fix(bonedigger-report): …
projectbluefin/contribute#597	conventional-title	title [sec-check] fix: …

bluefin's rule, verbatim from its AGENTS.md line 94:

• All pull requests target testing. Never open a content PR against main.

bluefin's gate output:

  BASE_REF: main
  HEAD_REF: scanner/fix-add-gstreamer-plugin-gtk4
ERROR: PRs must target 'testing', not 'main'.

common#1127's gate output:

ERROR: PR title does not follow Conventional Commits.
  Got:      [scanner] fix(bonedigger-report): derive booted image name from live bootc status
  Expected: <type>[optional scope]: <description>

Suggested direction

1. State precedence in the injection. InjectionText should declare that
   repository-supplied instructions win over hive's defaults on any conflict.
   This is the fix; the rest is cleanup.
2. Stop asserting repo facts in the defaults. "Open the PR against the base
   this repository requires; if its AGENTS.md does not name one, use its
   default branch" instead of "confirm the PR's base is defaultBranchRef".
   Likewise let the repo's convention drive the title rather than hardcoding
   [<lane>].
3. hive-open-pr already accepts --base (src/docs/hive-open-pr.md:42).
   No policy template passes it.

Separately: the contributor relay (src/pkg/dashboard/contribute_ws.go) never
calls primeAgentsMd at all — only the scheduler path does — so on that path
the repository's instructions are not outranked, they are never present. Filing
that on its own since it has a different fix and blast radius.