[hivecommons-hive]

Summary

Adds a read-only widget token for the iPhone widget, plus an "Add to iPhone" flow with a QR code in the existing 📱 iPhone widget dialog, and PWA polish.

Spoke

• POST /api/widget/token (owner only, via requireOwnerRole) mints hwt_<256-bit hex>, replacing any previous token. Returns the plaintext once with a scriptable:///run/Hive?url=<hive>&widgetToken=<tok> setup link and a QR PNG (data URL, rendered with the existing skip2/go-qrcode dependency). Only the SHA-256 is stored, in /data/widget-token.json (mode 0600).
• GET /api/widget/token (owner only) reports configured / createdAt / createdBy / lastUsedAt and never returns the token. DELETE revokes it and is idempotent.
• GET /api/widget/summary returns everything the widget renders: eval history plus each agent's name and state.
• authenticate accepts the widget token only for GET/HEAD of /api/widget/summary, and only in the X-Hive-Widget-Token header. The request then runs as a read-role identity with no owner marker. Every other path, including mutations and the token endpoints, returns 401 to it. It is never accepted in Authorization, so it can't act as a session.
• lastUsedAt is recorded at most every 10 minutes. The update re-checks the hash under the lock, so it can't bring back a revoked token.

Hub

• /api/widget/summary is added to the auth-check public exact paths. This follows the /api/knowledge/export approach: the hub lets the request through and the spoke does the real check.

UI and widget

• iPhone widget dialog gains Create widget token & QR, Revoke widget token, token status with last use, and Copy script URL. It uses in-app toasts only, with no native dialogs.
• The Scriptable script accepts widgetToken= from the deep link and stores it per hive in the Keychain. When it has one, it calls /api/widget/summary. The GitHub-token path still works as before.
• PWA: manifest.webmanifest, apple-touch-icon.png (the repo's bee), and apple-mobile-web-app-title.

Docs (src/docs/ios-widget.md), OpenAPI entries, and a changelog fragment are included. Unit tests are in widget_token_test.go, the hub public-path test, and ios_widget_static_test.go. They were not run locally; CI will run them.

Deliberate deviations from the issue proposal

• One token per hive, minted by owners only, for one dedicated endpoint. The issue suggested multiple labelled tokens that work on /api/history, /api/status/summary and /api/pr-throughput and act as the minting user. I narrowed this so the token can't be used anywhere beyond what the widget draws.
• Hub pass-through: I used a public path plus a dedicated header instead of reporting token hashes over the heartbeat. Sending it in Authorization would make the hub forward the token to github.com as a GitHub token.
• QR parameter name: the QR link uses widgetToken= instead of token=, so it isn't mistaken for a GitHub token.
• Rate limiting: the spoke has no rate limiter on bearer paths to reuse. The 256-bit token makes guessing impractical.
• Manifest display mode: the manifest uses "display": "browser", so hub login redirects keep working instead of opening a standalone app.

Closes #12147
Refs #12148: the hub-wide fleet widget is not done here. It depends on this token and needs its own hub-side design: a per-user hub token and fan-out across the owner's hives.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 requested_by=@clubanderson

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nicholasjackson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#12096	✨ feat(evidence): add GET /api/evidence/summary	same files	src/pkg/dashboard/api.go
#12158	✨ review: add review.shadow to record would_have_held for the review gate	same files	src/pkg/dashboard/static/index.html
#12170	🐛 Settings modal: sticky-section gap, height, and section navigation	same files	src/pkg/dashboard/static/index.html

[hivecommons-hive]

hive/awaiting-ci: pushed fix for TestStyleRatchet (QR backdrop now uses --infra-logo-chip-bg; hub baselines synced), merged v5 (picks up #12161 for the link checker), and added the PR-type emoji to the title. CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: bf1057c3d

— hive: agent=scanner backend=copilot model=claude-fable-5.1

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback