[hivecommons-hive]

Adds intent.shadow (default false). While intent.enforce is off, both merge lanes sharing intent.Verdict.BlocksMerge — writeMergeEligible (merge-eligible.json) and the App self-merge sweep (automerge.IntentGate) — evaluate BlocksMerge(true) and record shadow.intent.would_have_blocked (+ reason, tier, alignment confidence) on the PR head evidence bundle and audit log, never withholding the PR. enforce: true is unchanged; shadow is ignored then.

• Config: IntentConfig.Shadow; dashboard Security tab toggle + intentShadow on the governor security API (openapi updated).
• Mirrors the shape of ✨ review: add review.shadow to record would_have_held for the review gate #12158 (review.shadow); helpers live in a new cmd/hive/intent_shadow.go to avoid conflicts.
• Shared helpers Verdict.BlockReason / Verdict.ShadowConfidence in pkg/intent.
• Tests: shadow on -> eligible/merged + record in both lanes; enforce on -> still blocked, no record.
• Docs: src/docs/intent-verification.md; changelog fragment.

Closes #12105
Refs #12068 (parent tracker; other children remain open)

— hive: agent=scanner backend=copilot model=claude-fable-5.1 requested_by=@clubanderson

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kellyaa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#12158	✨ review: add review.shadow to record would_have_held for the review gate	same files	src/cmd/hive/merge_eligibility.go src/pkg/config/config.go src/pkg/dashboard/static/index.html
#12170	🐛 Settings modal: sticky-section gap, height, and section navigation	same files	src/pkg/dashboard/static/index.html

[hivecommons-hive]

CI triage: test (rest 2/5) is red here for a PR-local reason (green on v6 at 20:53Z). pkg/dashboard/webstatic TestStyleRatchet fails on all retries:

• operator static/index.html has 1507 style= attributes, above the baseline of 1506 — the new intent.shadow settings markup adds one inline style=; move it onto an existing class/token so the count returns to ≤1506. Do not raise the baseline.
• hub static pages is reported below its baselines (945/426/448 vs 946/427/450) — that means this branch's style_ratchet_test.go baselines predate a cleanup already on v6; rebasing onto current v6 picks up the lowered baselines.

Job: https://github.com/hivecommons/hive/actions/runs/38799200092/job/116643940945

---

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: pushed a ratchet fix — test (rest 2/5) failed on TestStyleRatchet because this PR's Settings markup added an inline style= attribute to src/pkg/dashboard/static/index.html (operator page 1507 > baseline 1506). Replaced it with the existing tokenized classes; the "hub static pages below baseline" lines in the same log are a stale-merge-base artifact already fixed on v5 (#12173). CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 584495bf1

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: rebased onto v5 (resolved api_governor_security.go conflict with the sandbox-job fields); CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 77b44cb2a

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback