From d19386a73de1167ea2d594f8baf09717ef6b7a53 Mon Sep 17 00:00:00 2001 From: sec-check Date: Wed, 16 Sep 2026 10:23:03 -0400 Subject: [PATCH] [scanner] fix: repo AGENTS.md now outranks hive's own prompt conventions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hive agents opened PRs that died on other repos' gates — wrong base branch on repos using a promotion model, [lane]-prefixed titles on repos enforcing Conventional Commits — because the repo's AGENTS.md arrived in the kick as undifferentiated prose while hive's conflicting instructions carried imperatives and self-check steps. Nothing said which wins, so agents followed hive. Three changes: - agentsmd.InjectionText now opens the injected block with an explicit precedence statement: for repository-local conventions (PR base branch, title format, commit style, review workflow) the repo's own rules override any conflicting hive instruction in the same prompt. - Both base-branch wordings in buildTaskPromptBodyForAccess defer to the branch the repository's AGENTS.md/CONTRIBUTING names as the PR target; the default-branch resolution becomes the fallback for repos that state no rule. The 'do not use the branch you find' clause is kept, and an explicitly task-named branch (release lines) is not overridden. - Every policy template with a hardcoded '[] fix:' PR title gains a deference note: hive's house style applies only when the target repo has no title convention; the [lane] prefix is load-bearing for ISSUE routing (classify), never for PR titles. src/policies/ copies kept in sync with the embedded defaults, as the policies tests require. Fixes hivecommons/hive#7159 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check --- src/pkg/agentsmd/agentsmd.go | 19 ++++++++++++++++-- src/pkg/agentsmd/agentsmd_test.go | 6 ++++++ .../contribute_task_base_branch_test.go | 5 ++++- src/pkg/dashboard/contribute_ws.go | 20 ++++++++++++++----- src/pkg/policies/defaults/architect-full.md | 2 ++ .../policies/defaults/architect-holdgated.md | 2 ++ .../policies/defaults/ci-maintainer-full.md | 2 ++ .../defaults/ci-maintainer-holdgated.md | 2 ++ src/pkg/policies/defaults/guide-full.md | 2 ++ src/pkg/policies/defaults/guide-holdgated.md | 2 ++ src/pkg/policies/defaults/outreach-full.md | 2 ++ src/pkg/policies/defaults/quality-full.md | 2 ++ .../policies/defaults/quality-holdgated.md | 1 + .../policies/defaults/scanner-automerge.md | 2 ++ src/pkg/policies/defaults/scanner-full.md | 1 + .../policies/defaults/scanner-holdgated.md | 1 + src/pkg/policies/defaults/sec-check-full.md | 2 ++ .../policies/defaults/sec-check-holdgated.md | 2 ++ src/pkg/policies/defaults/strategist-full.md | 2 ++ .../policies/defaults/strategist-holdgated.md | 2 ++ src/policies/architect-full.md | 2 ++ src/policies/architect-holdgated.md | 2 ++ src/policies/ci-maintainer-full.md | 2 ++ src/policies/ci-maintainer-holdgated.md | 2 ++ src/policies/guide-full.md | 2 ++ src/policies/guide-holdgated.md | 2 ++ src/policies/outreach-full.md | 2 ++ src/policies/quality-full.md | 2 ++ src/policies/quality-holdgated.md | 1 + src/policies/scanner-automerge.md | 2 ++ src/policies/scanner-full.md | 1 + src/policies/scanner-holdgated.md | 1 + src/policies/sec-check-full.md | 2 ++ src/policies/sec-check-holdgated.md | 2 ++ src/policies/strategist-full.md | 2 ++ src/policies/strategist-holdgated.md | 2 ++ 36 files changed, 100 insertions(+), 8 deletions(-) diff --git a/src/pkg/agentsmd/agentsmd.go b/src/pkg/agentsmd/agentsmd.go index 15cd79b106..6cdbcbc809 100644 --- a/src/pkg/agentsmd/agentsmd.go +++ b/src/pkg/agentsmd/agentsmd.go @@ -16,8 +16,8 @@ // // --- // skills: -// - go-testing -// - pr-etiquette +// - go-testing +// - pr-etiquette // --- // // 2. Inline skill sections: any section whose heading is "## Skill: " @@ -80,6 +80,19 @@ const ( // mirroring the "# Relevant Knowledge" convention used by the Primer. injectionHeader = "# Repository Agent Instructions (AGENTS.md)" + // injectionPrecedence states which rules win when the repository's own + // instructions and hive's built-in prompt disagree. Without it the repo's + // AGENTS.md arrived as undifferentiated prose while hive's conflicting + // instructions carried imperatives and self-check steps, so agents followed + // hive and failed the repo's own gates — wrong PR base branch, rejected PR + // title format (hivecommons/hive#7159). The repository knows its own + // conventions; hive's wording on those subjects is a default, not a rule. + injectionPrecedence = "These are the repository's own rules. For repository-local conventions " + + "— PR base branch, PR title format, commit style, review workflow — they OVERRIDE any " + + "conflicting instruction elsewhere in this prompt, including hive's own defaults and " + + "self-check steps. When they conflict, follow AGENTS.md and treat the hive wording as " + + "the fallback for repositories that state no rule." + // injectionSkillsHeader titles the resolved-skills subsection. injectionSkillsHeader = "## Requested Skills" ) @@ -345,6 +358,8 @@ func (c *AgentsConfig) InjectionText(requestedSkills []string) string { var b strings.Builder b.WriteString(injectionHeader) b.WriteString("\n\n") + b.WriteString(injectionPrecedence) + b.WriteString("\n\n") if body := strings.TrimSpace(c.Body); body != "" { b.WriteString(body) b.WriteString("\n") diff --git a/src/pkg/agentsmd/agentsmd_test.go b/src/pkg/agentsmd/agentsmd_test.go index 209114fe90..1272ea03fd 100644 --- a/src/pkg/agentsmd/agentsmd_test.go +++ b/src/pkg/agentsmd/agentsmd_test.go @@ -240,6 +240,12 @@ func TestInjectionText(t *testing.T) { if !strings.Contains(out, injectionSkillsHeader) { t.Errorf("missing skills subheader: %q", out) } + // #7159: the injected block must say the repo's rules outrank hive's own + // conflicting prompt text; without it agents followed hive's imperatives + // into the repo's failing gates (wrong PR base, rejected title format). + if !strings.Contains(out, injectionPrecedence) { + t.Errorf("missing precedence statement: %q", out) + } // Explicit empty slice -> body only, no skills section. bodyOnly := cfg.InjectionText([]string{}) diff --git a/src/pkg/dashboard/contribute_task_base_branch_test.go b/src/pkg/dashboard/contribute_task_base_branch_test.go index 139d93005a..a49f755022 100644 --- a/src/pkg/dashboard/contribute_task_base_branch_test.go +++ b/src/pkg/dashboard/contribute_task_base_branch_test.go @@ -295,8 +295,11 @@ func TestBuildTaskPrompt_FallbackWordingCarriesTheFullProcedure(t *testing.T) { for _, want := range []string{ "defaultBranchRef", "git fetch upstream", - "git checkout -b upstream/", + "git checkout -b upstream/", "confirm the PR's base", + // #7159: the repository's own contributor rules outrank hive's + // default-branch guess; the fallback wording must say so. + "AGENTS.md or CONTRIBUTING", } { if !strings.Contains(prompt, want) { t.Errorf("fallback wording is missing %q; got: %q", want, prompt) diff --git a/src/pkg/dashboard/contribute_ws.go b/src/pkg/dashboard/contribute_ws.go index 7c693b57e7..8bf9c7ec4c 100644 --- a/src/pkg/dashboard/contribute_ws.go +++ b/src/pkg/dashboard/contribute_ws.go @@ -5762,18 +5762,28 @@ func buildTaskPromptBodyForAccess(repoFull, issueRef, title, sourceHint, baseBra // trustworthy substitute — the upstream repository's own default // branch, read from the clone rather than from whatever the last task // left behind — and keep the "do not use the branch you find" clause, - // which is the load-bearing half in both wordings. + // which is the load-bearing half in both wordings. The default branch + // is still only hive's guess about the repo's conventions: a repo on a + // promotion model (default = released line, PRs land on an integration + // branch) states its real target in AGENTS.md/CONTRIBUTING, and that + // statement outranks the guess (hivecommons/hive#7159). "Do not assume the branch the checkout is currently on is the right base: it may "+ - "be left over from a previous task. Resolve %s's own default branch "+ - "('gh repo view %s --json defaultBranchRef'), run 'git fetch upstream', and "+ + "be left over from a previous task. If the repository's own contributor rules "+ + "(AGENTS.md or CONTRIBUTING) name the branch PRs must target, use that branch — "+ + "the repository's rule outranks the default below. Otherwise resolve %s's own "+ + "default branch ('gh repo view %s --json defaultBranchRef'). Then run "+ + "'git fetch upstream', and "+ "start your work branch from it with "+ - "'git checkout -b upstream/'. Open the PR "+ + "'git checkout -b upstream/'. Open the PR "+ "against the same branch, and confirm the PR's base is that branch before "+ "you report done. ", repoFull, repoFull) if b := strings.TrimSpace(baseBranch); b != "" { baseHint = fmt.Sprintf( - "Base this work on the '%s' branch of %s. The checkout may be left on a "+ + "Base this work on the '%s' branch of %s. If this task did not itself name "+ + "that branch and the repository's own contributor rules (AGENTS.md or "+ + "CONTRIBUTING) require PRs to target a different branch, the repository's "+ + "rule wins — substitute its branch throughout. The checkout may be left on a "+ "DIFFERENT branch by a previous task, so do not use whatever branch you "+ "find there: run 'git fetch upstream' and start your work branch from the "+ "base with 'git checkout -b upstream/%s'. Open the PR against "+ diff --git a/src/pkg/policies/defaults/architect-full.md b/src/pkg/policies/defaults/architect-full.md index 4d53b1e576..b6c6a0afb0 100644 --- a/src/pkg/policies/defaults/architect-full.md +++ b/src/pkg/policies/defaults/architect-full.md @@ -71,6 +71,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "architecture" ``` +The `[architect]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[architect]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Architect can PR: package reorganization, interface extraction, dependency inversion, dead code removal. Architect must NEVER: merge any PR, make feature additions or behavior changes. diff --git a/src/pkg/policies/defaults/architect-holdgated.md b/src/pkg/policies/defaults/architect-holdgated.md index 1a2ed6384d..8db7285a8b 100644 --- a/src/pkg/policies/defaults/architect-holdgated.md +++ b/src/pkg/policies/defaults/architect-holdgated.md @@ -70,6 +70,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "architecture,hold" ``` +The `[architect]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[architect]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Architect can PR: package reorganization, interface extraction, dependency inversion, dead code removal. Architect must NEVER: merge any PR, remove `hold` label, make feature additions or behavior changes. diff --git a/src/pkg/policies/defaults/ci-maintainer-full.md b/src/pkg/policies/defaults/ci-maintainer-full.md index 65258314a3..5be7c319c7 100644 --- a/src/pkg/policies/defaults/ci-maintainer-full.md +++ b/src/pkg/policies/defaults/ci-maintainer-full.md @@ -72,6 +72,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "ci" ``` +The `[ci-maintainer]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[ci-maintainer]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + CI Maintainer can PR: `.github/workflows/*.yml` changes, dependency pinning, runner config, coverage gates. CI Maintainer must NEVER: merge any PR, modify production source code. diff --git a/src/pkg/policies/defaults/ci-maintainer-holdgated.md b/src/pkg/policies/defaults/ci-maintainer-holdgated.md index 94aa7a8bcb..0fcb0d9478 100644 --- a/src/pkg/policies/defaults/ci-maintainer-holdgated.md +++ b/src/pkg/policies/defaults/ci-maintainer-holdgated.md @@ -84,6 +84,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "ci,hold" ``` +The `[ci-maintainer]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[ci-maintainer]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + CI Maintainer can PR: dependency pinning, runner config, coverage gates, and composite actions under `.github/actions/`. CI Maintainer can NOT PR `.github/workflows/*.yml` in this mode: its diff --git a/src/pkg/policies/defaults/guide-full.md b/src/pkg/policies/defaults/guide-full.md index 57dfed36d4..297a480585 100644 --- a/src/pkg/policies/defaults/guide-full.md +++ b/src/pkg/policies/defaults/guide-full.md @@ -64,6 +64,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "documentation" ``` +The `[guide]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[guide]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Guide can PR: README updates, CONTRIBUTING improvements, architecture docs, getting-started guides, API docs. Guide must NEVER: merge any PR, create PRs that touch source code. diff --git a/src/pkg/policies/defaults/guide-holdgated.md b/src/pkg/policies/defaults/guide-holdgated.md index 3c06ac2d2d..4160297547 100644 --- a/src/pkg/policies/defaults/guide-holdgated.md +++ b/src/pkg/policies/defaults/guide-holdgated.md @@ -65,6 +65,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "documentation,hold" ``` +The `[guide]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[guide]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Guide can PR: README updates, CONTRIBUTING improvements, architecture docs, getting-started guides, API docs. Guide must NEVER: merge any PR, remove `hold` label, create PRs that touch source code. diff --git a/src/pkg/policies/defaults/outreach-full.md b/src/pkg/policies/defaults/outreach-full.md index de972307c0..18110565cd 100644 --- a/src/pkg/policies/defaults/outreach-full.md +++ b/src/pkg/policies/defaults/outreach-full.md @@ -78,6 +78,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "community,outreach,hold" ``` +The `[outreach]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[outreach]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Outreach can PR: ADOPTERS.md, blog post drafts, case studies, partnership docs, contributor guides, event proposals. Outreach must NEVER: remove a hold label, merge any PR, make regulatory/compliance claims, invent roadmap commitments, contact external parties directly, or open PRs on external repos without explicit instruction. diff --git a/src/pkg/policies/defaults/quality-full.md b/src/pkg/policies/defaults/quality-full.md index f057d6df8b..791d42a801 100644 --- a/src/pkg/policies/defaults/quality-full.md +++ b/src/pkg/policies/defaults/quality-full.md @@ -86,6 +86,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "quality,testing" ``` +The `[quality]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[quality]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Quality can PR: new unit tests, test fixtures/helpers, CI workflow improvements, coverage reporting config. Quality must NEVER: merge any PR, create PRs for production code or non-testing changes. diff --git a/src/pkg/policies/defaults/quality-holdgated.md b/src/pkg/policies/defaults/quality-holdgated.md index 8ac61dbb16..6a43079dee 100644 --- a/src/pkg/policies/defaults/quality-holdgated.md +++ b/src/pkg/policies/defaults/quality-holdgated.md @@ -103,6 +103,7 @@ Closes # (ask: does merging this PR leave anything for issue # ``` +The `[scanner]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[scanner]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. ## Writing Beads diff --git a/src/pkg/policies/defaults/scanner-holdgated.md b/src/pkg/policies/defaults/scanner-holdgated.md index 5c1ba46294..c1280b0d59 100644 --- a/src/pkg/policies/defaults/scanner-holdgated.md +++ b/src/pkg/policies/defaults/scanner-holdgated.md @@ -81,6 +81,7 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "hold" ``` +The `[scanner]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[scanner]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. ## Writing Beads diff --git a/src/pkg/policies/defaults/sec-check-full.md b/src/pkg/policies/defaults/sec-check-full.md index 3d9ef4c7dd..567df7a716 100644 --- a/src/pkg/policies/defaults/sec-check-full.md +++ b/src/pkg/policies/defaults/sec-check-full.md @@ -70,6 +70,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "security" ``` +The `[sec-check]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[sec-check]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Sec-Check can PR: dependency version bumps for CVEs, removing hardcoded secrets, RBAC config fixes, unsafe pattern removal. Sec-Check must NEVER: merge any PR, expose secret values in PR descriptions. diff --git a/src/pkg/policies/defaults/sec-check-holdgated.md b/src/pkg/policies/defaults/sec-check-holdgated.md index 5c3a88f90c..55cc0937d5 100644 --- a/src/pkg/policies/defaults/sec-check-holdgated.md +++ b/src/pkg/policies/defaults/sec-check-holdgated.md @@ -78,6 +78,8 @@ hive-open-pr --repo "/" \ --label "security,hold" ``` +The `[sec-check]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[sec-check]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Sec-Check can PR: dependency version bumps for CVEs, removing hardcoded secrets, RBAC config fixes, unsafe pattern removal. Sec-Check can NOT PR a fix that lives in `.github/workflows/*.yml`: an ISSUES_AND_PRS token is minted at the `contributor` tier, which does not carry the Workflows diff --git a/src/pkg/policies/defaults/strategist-full.md b/src/pkg/policies/defaults/strategist-full.md index f3240c52e5..0e4144bab2 100644 --- a/src/pkg/policies/defaults/strategist-full.md +++ b/src/pkg/policies/defaults/strategist-full.md @@ -71,6 +71,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "roadmap" ``` +The `[strategist]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[strategist]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Strategist can PR: ROADMAP.md, milestone planning docs, contribution strategy docs. Strategist must NEVER: merge any PR, implement features or write source code. diff --git a/src/pkg/policies/defaults/strategist-holdgated.md b/src/pkg/policies/defaults/strategist-holdgated.md index 752547e787..219ee13c75 100644 --- a/src/pkg/policies/defaults/strategist-holdgated.md +++ b/src/pkg/policies/defaults/strategist-holdgated.md @@ -70,6 +70,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "roadmap,hold" ``` +The `[strategist]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[strategist]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Strategist can PR: ROADMAP.md, milestone planning docs, contribution strategy docs. Strategist must NEVER: merge any PR, remove `hold` label, implement features or write source code. diff --git a/src/policies/architect-full.md b/src/policies/architect-full.md index 4d53b1e576..b6c6a0afb0 100644 --- a/src/policies/architect-full.md +++ b/src/policies/architect-full.md @@ -71,6 +71,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "architecture" ``` +The `[architect]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[architect]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Architect can PR: package reorganization, interface extraction, dependency inversion, dead code removal. Architect must NEVER: merge any PR, make feature additions or behavior changes. diff --git a/src/policies/architect-holdgated.md b/src/policies/architect-holdgated.md index 1a2ed6384d..8db7285a8b 100644 --- a/src/policies/architect-holdgated.md +++ b/src/policies/architect-holdgated.md @@ -70,6 +70,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "architecture,hold" ``` +The `[architect]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[architect]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Architect can PR: package reorganization, interface extraction, dependency inversion, dead code removal. Architect must NEVER: merge any PR, remove `hold` label, make feature additions or behavior changes. diff --git a/src/policies/ci-maintainer-full.md b/src/policies/ci-maintainer-full.md index 65258314a3..5be7c319c7 100644 --- a/src/policies/ci-maintainer-full.md +++ b/src/policies/ci-maintainer-full.md @@ -72,6 +72,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "ci" ``` +The `[ci-maintainer]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[ci-maintainer]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + CI Maintainer can PR: `.github/workflows/*.yml` changes, dependency pinning, runner config, coverage gates. CI Maintainer must NEVER: merge any PR, modify production source code. diff --git a/src/policies/ci-maintainer-holdgated.md b/src/policies/ci-maintainer-holdgated.md index 94aa7a8bcb..0fcb0d9478 100644 --- a/src/policies/ci-maintainer-holdgated.md +++ b/src/policies/ci-maintainer-holdgated.md @@ -84,6 +84,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "ci,hold" ``` +The `[ci-maintainer]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[ci-maintainer]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + CI Maintainer can PR: dependency pinning, runner config, coverage gates, and composite actions under `.github/actions/`. CI Maintainer can NOT PR `.github/workflows/*.yml` in this mode: its diff --git a/src/policies/guide-full.md b/src/policies/guide-full.md index 57dfed36d4..297a480585 100644 --- a/src/policies/guide-full.md +++ b/src/policies/guide-full.md @@ -64,6 +64,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "documentation" ``` +The `[guide]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[guide]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Guide can PR: README updates, CONTRIBUTING improvements, architecture docs, getting-started guides, API docs. Guide must NEVER: merge any PR, create PRs that touch source code. diff --git a/src/policies/guide-holdgated.md b/src/policies/guide-holdgated.md index 3c06ac2d2d..4160297547 100644 --- a/src/policies/guide-holdgated.md +++ b/src/policies/guide-holdgated.md @@ -65,6 +65,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "documentation,hold" ``` +The `[guide]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[guide]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Guide can PR: README updates, CONTRIBUTING improvements, architecture docs, getting-started guides, API docs. Guide must NEVER: merge any PR, remove `hold` label, create PRs that touch source code. diff --git a/src/policies/outreach-full.md b/src/policies/outreach-full.md index de972307c0..18110565cd 100644 --- a/src/policies/outreach-full.md +++ b/src/policies/outreach-full.md @@ -78,6 +78,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "community,outreach,hold" ``` +The `[outreach]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[outreach]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Outreach can PR: ADOPTERS.md, blog post drafts, case studies, partnership docs, contributor guides, event proposals. Outreach must NEVER: remove a hold label, merge any PR, make regulatory/compliance claims, invent roadmap commitments, contact external parties directly, or open PRs on external repos without explicit instruction. diff --git a/src/policies/quality-full.md b/src/policies/quality-full.md index f057d6df8b..791d42a801 100644 --- a/src/policies/quality-full.md +++ b/src/policies/quality-full.md @@ -86,6 +86,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "quality,testing" ``` +The `[quality]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[quality]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Quality can PR: new unit tests, test fixtures/helpers, CI workflow improvements, coverage reporting config. Quality must NEVER: merge any PR, create PRs for production code or non-testing changes. diff --git a/src/policies/quality-holdgated.md b/src/policies/quality-holdgated.md index 8ac61dbb16..6a43079dee 100644 --- a/src/policies/quality-holdgated.md +++ b/src/policies/quality-holdgated.md @@ -103,6 +103,7 @@ Closes # (ask: does merging this PR leave anything for issue # ``` +The `[scanner]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[scanner]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. ## Writing Beads diff --git a/src/policies/scanner-holdgated.md b/src/policies/scanner-holdgated.md index 5c1ba46294..c1280b0d59 100644 --- a/src/policies/scanner-holdgated.md +++ b/src/policies/scanner-holdgated.md @@ -81,6 +81,7 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "hold" ``` +The `[scanner]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[scanner]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. ## Writing Beads diff --git a/src/policies/sec-check-full.md b/src/policies/sec-check-full.md index 3d9ef4c7dd..567df7a716 100644 --- a/src/policies/sec-check-full.md +++ b/src/policies/sec-check-full.md @@ -70,6 +70,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "security" ``` +The `[sec-check]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[sec-check]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Sec-Check can PR: dependency version bumps for CVEs, removing hardcoded secrets, RBAC config fixes, unsafe pattern removal. Sec-Check must NEVER: merge any PR, expose secret values in PR descriptions. diff --git a/src/policies/sec-check-holdgated.md b/src/policies/sec-check-holdgated.md index 5c3a88f90c..55cc0937d5 100644 --- a/src/policies/sec-check-holdgated.md +++ b/src/policies/sec-check-holdgated.md @@ -78,6 +78,8 @@ hive-open-pr --repo "/" \ --label "security,hold" ``` +The `[sec-check]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[sec-check]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Sec-Check can PR: dependency version bumps for CVEs, removing hardcoded secrets, RBAC config fixes, unsafe pattern removal. Sec-Check can NOT PR a fix that lives in `.github/workflows/*.yml`: an ISSUES_AND_PRS token is minted at the `contributor` tier, which does not carry the Workflows diff --git a/src/policies/strategist-full.md b/src/policies/strategist-full.md index f3240c52e5..0e4144bab2 100644 --- a/src/policies/strategist-full.md +++ b/src/policies/strategist-full.md @@ -71,6 +71,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "roadmap" ``` +The `[strategist]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[strategist]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Strategist can PR: ROADMAP.md, milestone planning docs, contribution strategy docs. Strategist must NEVER: merge any PR, implement features or write source code. diff --git a/src/policies/strategist-holdgated.md b/src/policies/strategist-holdgated.md index 752547e787..219ee13c75 100644 --- a/src/policies/strategist-holdgated.md +++ b/src/policies/strategist-holdgated.md @@ -70,6 +70,8 @@ hive-open-pr --repo "$HIVE_REPO" \ --label "roadmap,hold" ``` +The `[strategist]` PR title above is hive's house style, used when the target repository states no convention of its own. If the repository enforces a PR title format (a Conventional Commits gate, or a rule in its AGENTS.md/CONTRIBUTING), follow the repository's format and drop the `[strategist]` prefix — the prefix is load-bearing only for ISSUE titles (lane routing), never for PR titles. + Strategist can PR: ROADMAP.md, milestone planning docs, contribution strategy docs. Strategist must NEVER: merge any PR, remove `hold` label, implement features or write source code.