🐛 ci: repair v5 baseline (openapi, hermetic promotion test, collapsed-summary assert, style ratchet)

[clubanderson]

Repairs the remaining v5 baseline failures after this morning's red merges (the regexp lookahead panic from #10593 was fixed separately in #10617; this PR is rebased on top of it).

1. 🐛 feedback: attribute dashboard feedback issues to the submitter #10593 registered GET /api/feedback/status without documenting it → TestOpenAPISpecCoversEveryRegisteredRoute. Added the entry to dashboard/openapi.json.
2. 🐛 release: make stable chase candidate by 24 hours #10587 TestStableNextPromotionAtUnknownWhenNothingQueued hit live GHCR/GitHub → stubbed ghcrTagGeneration and stablePromotionFetchRuns so the test is hermetic.
3. ✨ dashboard: add collapsed project repo pills #10616 rewrote the collapsed-summary condition to cover repos-section → updated TestAgentsCollapsedSummaryRendersPerAgentTiles's expected string.
4. 🌱 dashboard: make hive-vs-human a throughput tile #10622 added raw padding:1px 16px 1px 6px → TestStyleRatchet (230 > 229). Tokenized to --sp-*; lowered the font-size baseline 667 → 666 as the ratchet demands.

Refs #10639 (v5 branch protection only requires gate, so these landed red).

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#10632	✨ dashboard: Agents sidebar link + up-next agent tiles in top navbar	same files	src/pkg/dashboard/agent_collapsed_tiles_test.go src/pkg/dashboard/static/index.html
#10602	✨ feat: label-driven repos skip un-park notice and keep needs-human	same files	changelog.d/fixed-10612.md dashboard/openapi.json src/changelog.d/fixed-v5-baseline-openapi-and-promotion-test.md src/pkg/dashboard/agent_collapsed_tiles_test.go src/pkg/hub/heartbeat_upgrade_policy_test.go
#10638	🐛 dashboard: Overview open-issue/PR totals explain their gap to the forge counts	same files	src/pkg/dashboard/static/index.html
#10619	✨ dashboard: move project actions to toolbar	same files	src/pkg/dashboard/static/index.html
#10589	🐛 fix: route reporter-trust waits through poller relay	same files	dashboard/openapi.json src/pkg/dashboard/agent_collapsed_tiles_test.go src/pkg/dashboard/static/index.html src/pkg/dashboard/webstatic/style_ratchet_test.go
#10618	✨ Improve collapsed Advisory and ACMM headers	same files	dashboard/openapi.json src/pkg/dashboard/agent_collapsed_tiles_test.go src/pkg/dashboard/static/index.html src/pkg/dashboard/webstatic/style_ratchet_test.go
#10611	🐛 dashboard: remove unlabelled collapsed sparklines	CONFLICT	src/pkg/dashboard/agent_collapsed_tiles_test.go src/pkg/dashboard/webstatic/style_ratchet_test.go
#10606	✨ dashboard: upgrade bee animation in the top navbar; sidebar pill no longer clips	same files	src/pkg/dashboard/static/index.html
#10613	✨ dashboard: Review Queue collapsed row shows a priority-split history sparkline	same files	src/pkg/dashboard/static/index.html
#10614	✨ dashboard: Audit Log collapsed row shows entry rate, last entry, today's count and sensitive-action chip	same files	src/pkg/dashboard/static/index.html
#10594	🧪 test: restore pkg/github coverage floor after reporter-trust wait	same files	changelog.d/fixed-10612.md dashboard/openapi.json src/changelog.d/fixed-v5-baseline-openapi-and-promotion-test.md src/pkg/dashboard/agent_collapsed_tiles_test.go src/pkg/hub/heartbeat_upgrade_policy_test.go
#10640	🐛 dashboard: surface alerts section at top of page	same files	src/pkg/dashboard/static/index.html
#10604	🐛 hub dashboard: NPS section header matches sibling section styling	same files	dashboard/openapi.json src/pkg/dashboard/agent_collapsed_tiles_test.go src/pkg/dashboard/static/index.html src/pkg/dashboard/webstatic/style_ratchet_test.go src/pkg/hub/heartbeat_upgrade_policy_test.go
#10633	✨ dashboard: expose Wavefront (Crustify) work source in settings	same files	src/pkg/dashboard/static/index.html

[hivecommons-hive]

Conclusion: the three fixes look correct to me and this is the PR that should land to restore the v5 baseline. One body claim is inaccurate (low impact), and #10617 conflicts on the same lines.

Read: src/pkg/dashboard/feedback.go:80, src/pkg/hub/feedback.go:378, src/pkg/hub/heartbeat_upgrade_policy_test.go:210-219, and the dashboard/openapi.json entry. The ghcrTagGeneration / stablePromotionFetchRuns hooks are the existing package vars, so stubbing them makes TestStableNextPromotionAtUnknownWhenNothingQueued hermetic as described.

Body vs. code (low): the body says the new regexp was "verified same acceptance set". It is not quite: the original's {0,38} bounded single characters (39-char cap); the replacement (?:-?[A-Za-z0-9]){0,38} bounds 2-char iterations, so e.g. a-a-a-…-a at 77 characters now matches (checked with Go's regexp; a 40-char aaaa… is still rejected). Consequence is just an over-long @mention in a feedback issue — the character class stays tight, so nothing injectable — but the claim should be corrected or the cap enforced outside the regexp as #10617 does (len(strings.TrimSuffix(login, "[bot]")) > 39).

Conflict, not duplicate: #10617 rewrites the same two declarations with a different pattern plus an explicit length check and tests. It also carries ~830 unrelated lines for #10615, so I've recommended there that this PR merge first and #10617 rebase down to the length cap + tests. If a maintainer agrees, nothing further is needed here.

relative links and anchors resolve fails identically on v5; #10608 addresses it, as the body notes.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: pushed cdc8627 — refreshes the 259 src/docs/api-reference.md line citations that #10593's new api.go route shifted (the relative links and anchors resolve job runs check-api-reference-citations.sh). With #10616's test follow-up already on this branch, this PR now carries every v5-baseline fix (RE2 regexp panic in pkg/dashboard + pkg/hub, /api/feedback/status OpenAPI entry, collapsed-summary assertion, citation drift). CI pending — sweep will merge when green. #10608 becomes redundant once this lands.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Conclusion: the four repairs do what the body says and look correct to me. Two small things to fix before merge, both verified:

1. Stale changelog fragment. changelog.d/fixed-10612.md reads "feedback: drop unsupported regexp lookahead that panicked at init (#10612)" — but this PR contains no regexp change (the body itself says that landed in #10617). This is the guard's title-generated autofix from before the rebase. changelog.d/ is the directory the fragment guard reads (changelog-fragment-guard.yml:51,156), so this is the text that will ship in the changelog. Suggest rewriting it to describe what's actually here (openapi entry, hermetic promotion test, collapsed-summary assert, style tokenization) — or move the content of src/changelog.d/fixed-v5-baseline-openapi-and-promotion-test.md into it, since that one already says the right thing.

   • Open question for a maintainer: is src/changelog.d/ still read by anything? It has 91 entries on v5 while the guard only watches changelog.d/**; if it's legacy, the new fragment there is dead.

2. gofmt — src/pkg/dashboard/webstatic/style_ratchet_test.go:31 changed rawFontSizes: 667, → rawFontSizes: 666, and lost the column alignment; gofmt -l flags the file. Not CI-blocking (no gofmt gate in v2-ci.yml/v2-tests.yml that I could find), just a one-space fix.

What I checked:

• heartbeat_upgrade_policy_test.go:213-219 — ghcrTagGeneration (channel_targeting.go:204) and stablePromotionFetchRuns (stable_promotion.go:145) are both package-level var … = func on v5, so the stub/restore pattern compiles and is hermetic. Correct approach; note #10589 removes the lookup from stableNextPromotionAt instead, so the two conflict and a maintainer should pick one.
• agent_collapsed_tiles_test.go:35 — the expected string matches what #10616 put in visualSectionSummary.
• index.html:1413 — padding:1px 16px 1px 6px → var(--sp-1) var(--sp-6) var(--sp-1) var(--sp-3) removes the raw-padding hit; rawPadding baseline stays 229.
• dashboard/openapi.json — /api/feedback/status GET entry added; field names match #10593's status payload as described in the body.

I have not changed anything on this PR.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback