🌱 sync: forward-merge v5 into v6 (top-up) by hivecommons-hive[bot] · Pull Request #12835 · hivecommons/hive

hivecommons-hive · 2026-10-18T01:10:15Z

This is the v5 -> v6 top-up that the v6 Top-up workflow could not auto-push because the forward-merge conflicts (failing run: https://github.com/hivecommons/hive/actions/runs/39084575571). It merges all 39 commits in origin/v6..origin/v5 as one --no-ff merge commit, so v5's history is not squashed. The previous top-up was #11983.

Conflicts and how each was resolved (union of both sides; v5 wins where both changed the same thing)

src/cmd/hive/main.go: the agent.ProjectContext literal keeps v6's TaskMCPURL, TaskMCPLaunchToken and ExperimentEnv plus v5's AppBotLogin/AppBotUserID. Kept v6's experimentAgentEnv, taskMCPURLForAgents, resolveSpokeDashboardURL and taskMCPLaunchTokenForAgents and v5's appBotUserIDResolver.
src/pkg/agent/manager.go: ProjectContext keeps v6's TaskMCPURL/TaskMCPLaunchToken fields and v5's AppBotLogin/AppBotUserID fields.
src/pkg/config/config.go: Config keeps v6's Nous and v5's SelfExperiments. v6 split the rest of this file into per-area files, so v6's layout is kept. v5's only other change there (StageAdoptionConfig.StrictAttribution + StrictAttributionEnabled(), from 🐛 fix adoption fixer commit attribution #12770) is moved to src/pkg/config/governor_config.go, where v6 now keeps StageAdoptionConfig.
src/pkg/dashboard/contribute_ws.go: the task payload keeps v5's Forge/Host and v6's StandbyLane/StandbyTier.
src/pkg/github/client.go: Client keeps v6's issueOwnerSteps cache and v5's appBotUserMu/appBotUserID cache.
src/docs/api-reference.md: v6's rows are kept (/api/logs/*, /api/diag/*, hub, contribute and static routes). Two rows take v5's text: /api/evidence/summary, where v6's row was a stale description of code both branches have (write_activity, ci_recovery, /data/hive-metrics), and /api/hub/evidence, which v6 had not changed. Then src/scripts/check-api-reference-citations.sh --fix re-pointed the drifted line citations (37 rewritten, 0 unresolved).
src/docs/labels-and-control-signals.md: v5's updated review.human_decision_label wording with v6's review_config.go citation, since v6 moved that config out of config.go.
src/docs/scale-envelope.md: v6's RankActionableIssues citation, shifted to the merged client.go lines (4062-4072).

ADR numbering

v6 had two ADR-0024s: v5's Provider credential lifecycle and v6's Spek continuous convergence (v6 had already renumbered the spek ADR from v5's 0020 because v6's 0020 is the external work-source ADR). Following the #10828/#10840 precedent, v5's numbering is kept and the v6-only spek ADR becomes ADR-0025. The file, the src/docs/adr/README.md index, src/docs/spektacular.md and the changed-spek-recheck-in-place-v6.md changelog.d fragment are updated to match.

Checks

No changelog.d fragments collided, and none is added: this is a pure forward-merge and carries v5's fragments.
No new duplicate Go declarations compared with v6 (static scan, test files included).
Nothing was built or tested locally. CI, including the per-package coverage gate, decides.
The DCO check is expected to fail on forward-merges that carry others' commits. This is known and non-blocking, per the 🌱 v4 → v5 top-up blocked: pkg/agent manager.go and tmux fake have diverged structurally #7199 precedent.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

ADR numbering (decision B on #12816)

The v6-only Spek ADR is moved to the reserved 0100 block (src/docs/adr/0100-spek-continuous-convergence.md) and src/docs/adr/README.md records that numbers below 0100 are allocated on v5 first, so later v5 ADRs cannot collide with it again.

Closes #12816

* ✨ feat(dashboard): add evidence maintainability trend panel Render monthly complexity and tool warnings with first-observed ACMM policy markers. Keep reporting independent of merge eligibility. Hive-Run: #12369 Hive-Plan: RFC-12062 panel 7 maintainability trend Hive-Spec: RFC-12062#B.7 Co-authored-by: clubanderson <407614+clubanderson@users.noreply.github.com> Signed-off-by: mendezr <mendezr@users.noreply.github.com> * 🐛 Include claim-vs-verdict helper in maintainability UI harness Signed-off-by: mendezr <mendezr@users.noreply.github.com> * 🐛 fix: explain maintainability and isolate its renderer harness Signed-off-by: mendezr <mendezr@users.noreply.github.com> * 🐛 fix(dashboard): honor custom from/to window in maintainability panel evMaintainabilityRows derived its month bounds from dto.hours alone, so a past custom range rendered the most recent months instead. Use dto.from / dto.to (exclusive) when the server returns them and cover it in the node harness. Hive-Fix-Attempt: 1/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> * 📝 evidence: size maintainability panel from EV_SVG_W, document panel 7 and acmm_changes - evMaintainabilitySvg draws at EV_SVG_W (320) like every other .ev-svg so one viewBox unit stays one CSS px; the node fixture stubs 320 to match. - evidenceACMMChanges bounds levels by acmmadvisor.MaxLevel instead of a literal 6. - review-evidence.md: add the Maintainability trend (panel 7) bullet, list acmm_changes in the summary fields, and state that the panel is deliberately ungraded. - api-reference.md: /api/evidence/summary row documents acmm_changes and its all-bundles (no latest-per-PR, author_kind or window) semantics. Hive-Fix-Attempt: 2/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> * 🐛 fix(dashboard): give report-only explainers a Not graded badge The maintainability explainer returned grade `none`, which evGradeLine rendered as "Rated: Not enough data — report-only; not graded", contradicting review-evidence.md ("shows no grade") and implying more data would yield a grade. Add an `ungraded` grade key rendered as a plain "Not graded" badge (no "Rated:" prefix), drop the grade-referencing limits sentence from the panel's "What ours shows", and correct both doc sentences plus the Evidence FAQ panel enumeration to match. Document ACMMChanges' all-bundles and omitempty semantics on the struct field like its siblings. Fixes review findings on #12415. Hive-Fix-Attempt: 3/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> * test(dashboard): track the v5 evidence helper renames in the maintainability harness #12610 replaced evWriteCountersSvg with evWriteActivitySvg and added the CI gate / convergence helpers that renderEvidenceSummary now calls; the node harness must extract those (and the two grading constants) to run. Signed-off-by: scanner <scanner@hive.kubestellar.io> * refactor(evidence): declare maintainability lane presentation on metrics Signed-off-by: mendezr <mendezr@users.noreply.github.com> --------- Signed-off-by: mendezr <mendezr@users.noreply.github.com> Signed-off-by: Raúl Méndez <18744521+mendezr@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: mendezr <mendezr@users.noreply.github.com> Co-authored-by: clubanderson <407614+clubanderson@users.noreply.github.com> Co-authored-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…12674) * 🐛 fix(evidence): read historical work balance from issue series Use backfilled issue events for weeks before collector coverage, keeping collector-covered weeks authoritative and audit fallback scoped per repository. Preserve partial-window counts and observed zero weeks, and disclose backfill provenance in the dashboard. Share the issue-series storage helpers unchanged with PR #12527 so the reader can ship independently on v5. Hive-Run: #12670 Hive-Plan: historical-work-balance Hive-Spec: issue-12670#acceptance Co-authored-by: Andy Anderson <407614+clubanderson@users.noreply.github.com> Signed-off-by: Karibhou <157208370+Karibhou@users.noreply.github.com> * 📝 docs(evidence): disclose issue series semantics in work balance docs Document issue_series_weeks and the series file path in the /api/evidence/summary row, restate when missing.issues_human_opens_unobserved clears, note that series events carry no issue number so the audited agent override cannot apply to series weeks, and flag that the series writer is pending #12527. Hive-Fix-Attempt: 1/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> * ♻️ refactor(evidence): own issue-series layout and loader in pkg/evidence Rebase onto v5 now that #12527 landed, dropping the duplicated issue-series files and re-applying the api-reference row on top of v5's. Export IssueSeriesDirName, IssueActionOpened/Closed, IssueWeekKey, IssueWeek.Covers and LoadIssueSeries so the dashboard, the review-bundle walker skip and the backfill writer share one definition of the on-disk layout, the per-event coverage gate and the action strings. Add doc comments to the exported issue-series functions. Hive-Run: #12670 Hive-Fix-Attempt: 2/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> * test(evidence): cover shared issue-series loader and validation Exercise observed empty weeks, malformed snapshot isolation, invalid event rejection, UTC ISO-week boundaries and half-open coverage windows in pkg/evidence after the loader moved there. Hive-Run: #12670 Signed-off-by: Karibhou <157208370+Karibhou@users.noreply.github.com> * 📖 docs(evidence): document the available issue backfill writer Refresh the operator guidance now that #12527 is merged. Explain how to backfill a whole collector boundary week. Preserve the concurrent loader-coverage repair. Hive-Run: #12670 Hive-Plan: historical-work-balance Hive-Spec: issue-12670#acceptance Signed-off-by: Karibhou <157208370+Karibhou@users.noreply.github.com> --------- Signed-off-by: Karibhou <157208370+Karibhou@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Andy Anderson <407614+clubanderson@users.noreply.github.com> Co-authored-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Signed-off-by: Andy Anderson <andy@clubanderson.com>

…ues (#12757) The recover branch of the self-report relay closed the first open issue whose body carried the requested fingerprint marker. That marker is on every hive-filed fleet issue and the fingerprints are deterministic and fleet-wide, so the request's class alone did not bound what a spoke could close. Require the hive-observation label on the matched issue; otherwise answer not_observation without commenting or closing. Fixes #12754 Signed-off-by: sec-check <sec-check@hive.kubestellar.io> Co-authored-by: sec-check <sec-check@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* 🐛 Preserve needs-human label state Signed-off-by: Andy Anderson <andy@clubanderson.com> * 🐛 Remove unused containsLabelFold helper Drop the dead helper that golangci-lint flags after reparkDecisionRefusal switched to containsDecisionParkLabel, and narrow the changelog fragment to the flows the diff actually touches. Hive-Fix-Attempt: 1/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> --------- Signed-off-by: Andy Anderson <andy@clubanderson.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…tions (#12776) Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

#12774) Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io>

* fix(adoption): link fixer commits to app bot Signed-off-by: Andy Anderson <andy@clubanderson.com> * fix(adoption): key App noreply email by bot user id GitHub links <id>+<login>@users.noreply.github.com by the bot USER id, not the App id used for JWT auth, so the agent git identity never produced a linked commit: commitByApp stayed false, MarkHivePushedHead never fired and strict attribution never armed. Resolve the bot user id via GET /users/<slug>[bot] (cached on the client) and pass it lazily to agent launches; fix fixtures that hard-coded the App-id form. Reference governor.labels.stage.adoption.strict_attribution in the Settings UI so the hive.yaml parity test passes, and reword comments/docs that described the stage store as an independent evidence source. Hive-Fix-Attempt: 1/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> --------- Signed-off-by: Andy Anderson <andy@clubanderson.com> Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Signed-off-by: Andy Anderson <andy@clubanderson.com>

Reject recovery before any GitHub mutation unless the matched observation has one unambiguous hive id evidence field matching the authenticated requesting hive. Preserve detector-defined fingerprints. Hive-Run: #12772 Hive-Plan: observation-recovery-hive-binding Hive-Spec: #12772#matched-observation-ownership Signed-off-by: mendezr <mendezr@users.noreply.github.com> Co-authored-by: mendezr <mendezr@users.noreply.github.com>

Signed-off-by: Andy Anderson <andy@clubanderson.com>

…y stop (#12786) Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io>

Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.183.0 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>

release: v5.183.0

Signed-off-by: Andy Anderson <andy@clubanderson.com>

Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.183.1 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>

release: v5.183.1

…butor-lane vouching (#12798) The trusted-author lane logged untrusted-author-role for the App's own PRs even though the contributor lane vouches for them. Record the contributor lane's app-authored hand-off reason instead; no behaviour change. Closes #12795 Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>

* ✨ feat(evidence): per-axis criteria table in the hub drill-down Signed-off-by: scanner <scanner@hive.kubestellar.io> * test(evidence): match the omitted time_to_merge key, not the criterion name Signed-off-by: scanner <scanner@hive.kubestellar.io> --------- Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io>

…l-down (#12771) * feat(evidence): per-hive author-kind revert re-pool in the hub drill-down Trims #12771 to the by_author_kind half per maintainer decision; the per-axis criteria table landed in #12758. Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> * docs(api-reference): drop stale 'not emitted yet' clause for by_author_kind Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> --------- Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>

Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.184.0 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>

release: v5.184.0

* ✨ feat(hivectl): persist repository selection and canonical Hive identity Add optional consent and preset review state to profiles, origin-based onboarding helpers, and aligned shell-safe repository scopes with persisted commit generations. Preserve legacy same-origin contributor identities and keep local selection out of profile exports. Hive-Run: #12804 Hive-Plan: repository selection state and canonical identity (#12804) Hive-Spec: contributor-repository-selection-RFC-12570#sections-2-and-6 Signed-off-by: mendezr <mendezr@users.noreply.github.com> * ✨ feat(hivectl): edit contributor repository selections Add CLI selection edits, public membership snapshots, and a Hives overlay exclusion toggle using shared profile operations and the existing commit/signal path. Preserve personal exclusions, distinguish explicit empty consent from legacy scope, and reload after Hive addition/removal. Hive-Run: #12807 Hive-Plan: RFC-12570 section 5 — edit a running contribution selection Hive-Spec: contributor-repository-selection-RFC-12570#section-5 Signed-off-by: mendezr <mendezr@users.noreply.github.com> * 🐛 fix(tui): align overlay containment test with repository binding Signed-off-by: mendezr <mendezr@users.noreply.github.com> --------- Signed-off-by: mendezr <mendezr@users.noreply.github.com> Co-authored-by: mendezr <mendezr@users.noreply.github.com>

…s a hive defect (#12814) * 🐛 fix(fleetreport): require recurrence before reporting agent stall as a hive defect Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> * fix(fleetreport): restore SetFleetReportStatePathForTest godoc placement Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> --------- Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>

… acknowledged contributor scope (#12810) * feat(contribute): advertise eligible repos and filter candidates by acknowledged contributor scope Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> * fix(contribute): document GET /api/contribute/repositories in openapi.json Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> * feat(contribute): stamp forge/host on task_assign so relay scope checks are deterministic Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> --------- Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* 📖 docs: document supported stage adoption settings Document in-place adoption and both 15-minute waits using the v5 configuration defaults. Clarify the superseding PR fallback. Hive-Run: #12777 Hive-Plan: adoption-example-currency Hive-Spec: issue-12777#supported-adoption-settings Signed-off-by: Karibhou <157208370+Karibhou@users.noreply.github.com> * 📖 docs: refresh actionable issue ranking citation Point the scale envelope citation at the current RankActionableIssues declaration and complete sorting body, including AgeMinutes. Hive-Run: #12777 Hive-Plan: adoption-example-currency Hive-Spec: issue-12777#supported-adoption-settings Signed-off-by: Karibhou <157208370+Karibhou@users.noreply.github.com> * 📖 docs: document strict_attribution adoption setting Document the setting requested by the review swarm on #12780. Hive-Run: #12777 Hive-Plan: adoption-example-currency Hive-Spec: issue-12777#supported-adoption-settings Co-authored-by: guide <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Karibhou <157208370+Karibhou@users.noreply.github.com> --------- Signed-off-by: Karibhou <157208370+Karibhou@users.noreply.github.com> Co-authored-by: guide <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Per the maintainer decision on #12816 (option B): numbers below 0100 are allocated on v5 first; v6-only ADRs live at 0100+ so forward-merges no longer collide. Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>

… changelog fragment Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Forward-merges the v5 commits that landed after #12835's merge base (#12830, #12829, #12834, #12832, #12837, #12840, #12780). Conflicts: config.go keeps v6's split layout and v5's new ReviewConfig.SelfAuthoredDecisionPolicy moves to review_config.go; review-swarm.md keeps both paragraphs; running-at-level-6.md keeps v5's new "Adopted PR with unsigned commits" row and v6's richer "Issue parked" row (/hive done); api-reference.md keeps v6's rows (v5's change was citation-only) and check-api-reference-citations.sh --fix re-pointed 208 drifted citations. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

hivecommons-hive · 2026-10-18T01:44:47Z

330f0ec

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 330f0ec41728) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
- .github/workflows/dco-post-merge.yml
remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
- src/pkg/hivectl/preset_test.go

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

…ner policy v5's #12832 grew src/policies/scanner-automerge.md to 33554 bytes on v6 (v6 already sat at 32764), so TestShippedTemplatesFitUnderCap no longer had 2x headroom under the 64 KiB cap. Raise DefaultMaxPromptBytes to 96 KiB, keep the reject-whole semantics, and update the three docs that quote the default. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

…ionEnabled StrictAttributionEnabled arrived from v5 (#12770) uncovered in pkg/config, which sits at the 90% floor on v6. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

clubanderson · 2026-10-18T02:02:52Z

Reviewed the forward-merge (merge-tree of the two parents vs abeb061d4 differs only in the eight conflict files plus the ADR renumber — every Go resolution is the union of both sides, no v6-only field/feature lost, no v5 change dropped; .github/workflows/dco-post-merge.yml is byte-identical to v5's, the only change being #12765's waiver SHA).

Pushed four commits on top:

692823739 finish the Spek ADR move to 0100 — spektacular.md and the changed-spek-recheck-in-place-v6.md fragment still said ADR 0025.
be7c4500c top up the 7 v5 commits that landed after this PR's merge base (✨ feature: Add cadence templates for quickly setting cadence for all agents #12830, 🐛 Derive role labels from author kind so non-owning lanes cannot flip them #12829, ✨ Let the reviewer resolve non-risk design questions on Hive-authored PRs #12834, 🐛 Re-home adopted PRs whose commits cannot be DCO-signed in place #12832, ✨ Show hold state in the dashboard pipeline Open segment #12837, 🐛 Nudge and adopt conflicting contributor PRs from offline contributors #12840, 📖 docs: document supported stage adoption settings #12780), --no-ff. Conflicts: config.go keeps v6's split layout and ReviewConfig.SelfAuthoredDecisionPolicy goes to review_config.go; review-swarm.md keeps both paragraphs; running-at-level-6.md takes v5's new "Adopted PR with unsigned commits" row and v6's richer "Issue parked" row; api-reference.md keeps v6's rows (v5's change was citation-only) and --fix re-pointed 208 citations.
5d4f4fe00 promptsrc.DefaultMaxPromptBytes 64 → 96 KiB: 🐛 Re-home adopted PRs whose commits cannot be DCO-signed in place #12832 grew scanner-automerge.md to 33554 B on v6 (v6 was already at 32764), which broke TestShippedTemplatesFitUnderCap's 2× headroom. Docs + changelog fragment updated.
73e8b50a3 test for StageAdoptionConfig defaults (StrictAttributionEnabled was uncovered; pkg/config sits at the 90% floor).

Local: go build, go vet, go test -short ./... (remaining failures are macOS/env-only: tmux socket path, safe.bareRepository, spektacular deadline, advisory timezone — all fail identically on origin/v6), docs + api-reference citations clean, dashboard npm test 88/88, touched-package coverage all above floor.

hivecommons-hive · 2026-10-18T02:08:24Z

73e8b50

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 73e8b50a3fc6) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

sensitive_path — changes 3 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
- .github/workflows/dco-post-merge.yml
- src/pkg/policies/defaults/scanner-automerge.md
- src/policies/scanner-automerge.md
remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
- src/pkg/hivectl/preset_test.go

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

clubanderson · 2026-10-18T02:34:45Z

/lgtm

clubanderson · 2026-10-18T02:34:46Z

/approve

kubestellar-prow · 2026-10-18T02:34:51Z

LGTM label has been added.

Details

Git tree hash: 09c0ea605930e0c45d5a1857dd99d4e43c1de485

kubestellar-prow · 2026-10-18T02:34:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [clubanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-actions · 2026-10-18T02:40:02Z

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

mendezr and others added 30 commits October 17, 2026 14:41

fix(adoption): require trusted hive head attribution (#12762)

3d3da6a

Signed-off-by: Andy Anderson <andy@clubanderson.com>

🐛 fix issue lane provenance labels (#12761)

016b899

Signed-off-by: Andy Anderson <andy@clubanderson.com>

🐛 keep agent issue author-kind labels (#12773)

5a43cac

Signed-off-by: Andy Anderson <andy@clubanderson.com>

✨ nous: map Hive-self experiments and snapshots to scheduler registra…

d6d28ed

…tions (#12776) Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

✨ nous: durable fast-fail latch and local revert executor (#12775)

a1f163a

Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

🐛 dashboard: keep Hive-self experiments out of Experiment Lab listings (

85074cc

#12774) Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io>

🐛 make agent lane issue labels canonical (#12778)

1883c89

Signed-off-by: Andy Anderson <andy@clubanderson.com>

🐛 canonicalize legacy origin lane labels (#12782)

c17af37

Signed-off-by: Andy Anderson <andy@clubanderson.com>

📖 refresh scale envelope citation (#12785)

a976659

Signed-off-by: Andy Anderson <andy@clubanderson.com>

fix(hivectl): bound evidence backfill issue scan with since= and earl…

d506f6b

…y stop (#12786) Signed-off-by: scanner <scanner@hive.kubestellar.io> Co-authored-by: scanner <scanner@hive.kubestellar.io>

🔖 release: v5.183.0

dc105e5

Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.183.0 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>

Merge pull request #12788 from hivecommons/release-gate/v5.183.0

09f90ff

release: v5.183.0

fix: let trusted human approval clear review hold (#12794)

d62f0ba

Signed-off-by: Andy Anderson <andy@clubanderson.com>

fix: stop app-authored role label flapping (#12793)

d29eea9

Signed-off-by: Andy Anderson <andy@clubanderson.com>

🔖 release: v5.183.1

ea66288

Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.183.1 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>

Merge pull request #12801 from hivecommons/release-gate/v5.183.1

8febcc4

release: v5.183.1

🔖 release: v5.184.0

06fbcbb

Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.184.0 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>

Merge pull request #12812 from hivecommons/release-gate/v5.184.0

cc1f701

release: v5.184.0

hivecommons-hive Bot added the stage/050-review-pending Review swarm requested; awaiting a verdict for the current head label Oct 18, 2026

Karibhou and others added 2 commits October 17, 2026 21:29

kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Oct 18, 2026

hivecommons-hive Bot mentioned this pull request Oct 18, 2026

[scanner] docs(adr): two ADRs numbered 0024 on v6 (Spek continuous convergence vs provider credential lifecycle) #12816

Closed

clubanderson added 2 commits October 17, 2026 21:35

docs(adr): finish the Spek ADR move to 0100 in spektacular.md and the…

6928237

… changelog fragment Signed-off-by: Andrew Anderson <andy@clubanderson.com>

clubanderson added 2 commits October 17, 2026 21:57

test(config): cover StageAdoptionConfig defaults incl. StrictAttribut…

73e8b50

…ionEnabled StrictAttributionEnabled arrived from v5 (#12770) uncovered in pkg/config, which sits at the 90% floor on v6. Signed-off-by: Andrew Anderson <andy@clubanderson.com>

kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Oct 18, 2026

hivecommons-hive Bot removed the dco-signoff: yes Indicates the PR's author has signed the DCO. label Oct 18, 2026

kubestellar-prow Bot assigned clubanderson Oct 18, 2026

kubestellar-prow Bot added the lgtm Indicates that a PR is ready to be merged. label Oct 18, 2026

kubestellar-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 18, 2026

clubanderson merged commit 09eb3c2 into v6 Oct 18, 2026
77 of 79 checks passed

kubestellar-prow Bot deleted the scanner/sync-v5-to-v6 branch October 18, 2026 02:39

hivecommons-hive Bot mentioned this pull request Oct 18, 2026

🌱 sync: top up v5 into v6 (31 commits since f0307339f) #12903

Merged

Navigation Menu

Repository navigation

🌱 sync: forward-merge v5 into v6 (top-up) - #12835

🌱 sync: forward-merge v5 into v6 (top-up)#12835
clubanderson merged 54 commits into
v6from
scanner/sync-v5-to-v6

hivecommons-hive Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

hivecommons-hive Bot commented Oct 18, 2026

Uh oh!

clubanderson commented Oct 18, 2026

Uh oh!

hivecommons-hive Bot commented Oct 18, 2026

Uh oh!

clubanderson commented Oct 18, 2026

Uh oh!

clubanderson commented Oct 18, 2026

Uh oh!

kubestellar-prow Bot commented Oct 18, 2026

Uh oh!

kubestellar-prow Bot commented Oct 18, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

hivecommons-hive Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Conflicts and how each was resolved (union of both sides; v5 wins where both changed the same thing)

ADR numbering

Checks

ADR numbering (decision B on #12816)

Uh oh!

hivecommons-hive Bot commented Oct 18, 2026

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Uh oh!

clubanderson commented Oct 18, 2026

Uh oh!

hivecommons-hive Bot commented Oct 18, 2026

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Uh oh!

clubanderson commented Oct 18, 2026

Uh oh!

clubanderson commented Oct 18, 2026

Uh oh!

kubestellar-prow Bot commented Oct 18, 2026

Uh oh!

kubestellar-prow Bot commented Oct 18, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 18, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hivecommons-hive Bot commented Oct 18, 2026 •

edited

Loading