[hivecommons-hive]

Refs #11854 (partial: 38 of ~578 remaining allow-listed keys exposed in this slice; remaining sections tracked on the issue)

This slice exposes the scalar keys from the small hive.yaml sections. New controls sit in Settings → Features and use the existing Features GET/PUT (/api/config/governor/features, owner-only). Keys that already had a handler and control elsewhere now show their YAML hint. Every control shows its YAML key as a monospace hint and has help text. Absent keys are left untouched, and invalid values return 400 before anything changes.

Data directories (new section, "Requires restart")

• data.metrics_dir, data.logs_dir, data.agents_dir, data.claude_sessions_dir, data.copilot_sessions_dir, data.bob_sessions_dir: text inputs; each must be a non-empty, clean absolute path
• data.session_retention_days: number input. Empty means the default (7), 0 turns pruning off, and negative values are rejected.

Standalone deployment (new section; read on each upgrade check, so live)

• deployment.podman_mode: select (not set / rootless / rootful)
• deployment.upgrade_request_dir: text input, either empty or a clean absolute path
• deployment.upgrade_helper: read-only. It names an executable the dashboard runs, so it can only be changed in hive.yaml.

Review evidence (new section)

• evidence.enabled: toggle (default on)
• evidence.signing_key_file: read-only path. The key is never read.

GitLab and Gitea forges (new section, "Requires restart")

• gitlab.gitlab_url, gitea.gitea_url: either empty or an http(s) URL
• gitlab.token_env, gitea.token_env: env-var NAME only, validated as a POSIX name, never a token value

Token mint limits (new section)

• mint.max_ttl_seconds: number input from 0 (default 900) to 3600 (hard cap); "Requires restart"
• mint.key_path: read-only path. Before this PR the dashboard deliberately left it out, and the key is never read.

Design-first planning (new section)

• planning.design_approved_label: text input
• planning.max_concurrent_designs, planning.max_design_revisions: number inputs; 0 means the default
• planning.plan_from_label: the existing toggle now shows its YAML hint

Supersession and compliance windows (new section)

• supersession_sweep.grace_period: Go duration
• compliance.posture_checks.window_days (0–90), compliance.posture_checks.history_days (0 or 30–1095): the same bounds ComplianceConfig.Validate enforces

Swarm banner (new section, "Requires restart" because the swarm store caches its default theme)

• swarm.event_name, swarm.call_to_arms, swarm.leaderboard_title: sanitized text, at most 200 characters

Tool approval inbox (new section, "Requires restart")

• tool_approval.inbox_path: either empty or a clean absolute path

Existing controls that now show YAML hints (handlers unchanged)

• escalation.threshold (Health → Escalation Breaker)
• intent.enforce, intent.alignment_model (Security; help marks added)
• sentinel.max_actions, sentinel.trusted_authors_block (Security)
• auto_merge.max_merges, auto_merge.trusted_authors.require_role (Features → Auto-Merge)
• auto_merge.min_head_age: new text input in Auto-Merge, saved through the existing /api/config/auto-merge handler
• publication.owner (Features → Audit publication)

Skipped in this slice

• classification.review_bots.max_attempts_per_thread, classification.review_bots.resolve_after_fix: EffectiveReviewBots ignores these hive.yaml values whenever the logins come from hive-project.yaml. Making them writable would show settings that have no effect until the override semantics are decided, so they need a follow-up.
• List and map keys in these sections (planning.*_labels[], sentinel.repos[], auto_merge.*[], swarm.themes.<key>.*, tool_approval.rules[], intent.*_patterns[], …).

Allowlist: 578 → 540 entries.

New handler logic is in api_governor_features_platform.go and follows the featuresOpsBody pattern. ops_settings_parity_test.go round-trips every writable key through PUT/GET. It also covers rejection with no partial mutation, checks that the read-only paths are never written, and checks that every key renders a YAML hint and a bound control. Also adds a changelog fragment and Settings search entries.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 requested_by=@clubanderson

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#12048	🐛 dashboard: fixed-size endpoint markers on the lifecycle timeline	same files	src/pkg/dashboard/static/index.html
#12051	🐛 fix(automerge): gate contributor-lane unattended merge on vetted identity	same files	src/pkg/config/config.go src/pkg/dashboard/static/index.html

[hivecommons-hive]

hive/awaiting-ci: pushed 2f9fa96 — routes the mint/sessionprune constants through pkg/config (import ratchets) and lowers the padding baseline to 164 (style ratchet). CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 2f9fa96

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: pushed ratchet fix (inline style → mt-4 utility class, TestStyleRatchet baseline 1507). CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 1ae200d97

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback