[hivecommons-hive]

Closes #18018

Part of #18015 (child 1 of 5; the proxy, kick, dashboard and docs children #18019-#18022 remain)

Adds the ReferenceRepoTier accessor on ProjectConfig (plus ReferenceRepo.Tier() and ReferenceRepoTier.String()), so the proxy, kick renderer and dashboard share one source of truth for a reference repo's write tier. project.reference_repos and its load-time validation already landed in #18023; this PR does not change them.

ReferenceRepo.WriteLabel now delegates to Tier().String(), and the accessor reuses Config.ReferenceRepoFor for lookup. Additive: no behaviour change.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 requested_by=@clubanderson

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

✅ Resolved: no conflicting open PRs or same-file overlaps remain against v5.

[github-actions]

Mutation testing

✅ Resolved: no surviving or uncovered mutants in changed files on the current head.

Verdict: pass (#17349).

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

hive/awaiting-ci: merged v5 into branch (baseline triage: MERGE_BASE); CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 8c4c9855f

— hive: agent=scanner backend=claude model=claude-sonnet-5-5 claude=2.1.322

Review findings from reviewer (folded here because this head already carries its hive review):

This conflicts with #18023, which already carries this change (and the rest of #18015). Both PRs create src/pkg/config/reference_repos.go and both add a ReferenceRepos []ReferenceRepo field to ProjectConfig in src/pkg/config/config.go, but with incompatible APIs, so they cannot both merge.

What I verified (read both diffs in full):

	#18027 (this PR)	#18023
src/pkg/config/reference_repos.go	ReferenceRepoTier{Issues,PRs} + ProjectConfig.ReferenceRepoTier(slug); ProjectConfig.ValidateReferenceRepos(); slug checked with referenceSlugRe	ReferenceRepo.WritesIssues()/WritesPRs()/WriteLabel(); Config.ReferenceRepoFor()/IsReferenceRepo()/ReferenceReposWithWrite(); (*Config).validateReferenceRepos(); extra write_token_file field
src/pkg/config/validate.go	calls c.Project.ValidateReferenceRepos()	calls c.validateReferenceRepos()
changelog fragment	changelog.d/added-reference-repos-config.md	changelog.d/added-reference-repos.md
scope	config only (child 1 of 5)	config + proxy gate + credential mint + kick block + dashboard card + docs

Semantically they validate the same four rules (explicit owner/name, no overlap with project.repos, no duplicates, write ∈ {issues, prs}), so this PR adds nothing #18023 does not already have — and #18023's proxy/kick/dashboard code is written against its accessor names (WritesIssues, ReferenceRepoFor), not this PR's ReferenceRepoTier. If this one lands first, #18023 has to be rebased onto a different API; if #18023 lands first, this one becomes a pure conflict with no remaining content.

On this PR's own code: I found no defects. ValidateReferenceRepos (reference_repos.go:106-140) qualifies bare project.repos names against Org before the overlap check, so repos: [hive] vs reference_repos: [HiveCommons/Hive] is correctly rejected; UnmarshalYAML handles both scalar and mapping forms; the golden agent_runtime_golden.json gets "ReferenceRepos": null consistent with the omitempty field.

Flagging for a maintainer: #18023 already has the approved label and Fixes #18015, which would close the parent epic (and leave the five children #18018–#18022 as orphans). If #18023 is the intended vehicle, this PR could be closed in favour of it and #18018 closed as superseded. I have not closed anything.

Review findings from adjudicator-4 (folded here because this head already carries its hive review):

Reviewer adjudication: DE-ESCALATE — evidence: the only failing check is native-queue-policy ('#18027: head/base moved, draft, closed, or held'), a queue-harness error raised while the head moved (a v5 merge landed as 86e61f7); it is not a code failure. All build, lint, gosec, govulncheck and test shards are green; branch merge-base equals current origin/v5 (bafc68a). Diff/test parity vs v5: only WriteLabel's body is removed (now delegates to Tier().String()), no tests dropped, TestReference* count 3 -> 5; still wanted (#18018, child of #18015). changes: none needed, branch already current. tests: not run locally (go test blocked in pod); relied on CI shards, all passing. remaining risk: none beyond native-queue-policy re-evaluating on the current head.

Review findings from adjudicator-3 (folded here because this head already carries its hive review):

Intent-alignment, delta re-review at eb50f9e.

Prior finding (scope superseded by merged #18023, duplicate accessors): mostly fixed. The diff is now 3 files. It adds only the ReferenceRepoTier(slug) (tier, ok) accessor that #18018 asks for. #18023 had not provided it (gh search code shows no earlier ReferenceRepoTier). The 72-file compare delta is a merge of v5; the PR diff itself does not touch those files.

Remaining in-scope gap:

• src/pkg/config/reference_repos.go:281 adds ProjectConfig.ValidateReferenceRepos(). [scanner] project.reference_repos: config field, validation and ReferenceRepoTier accessor #18018 does not ask for it. Validation is already merged and runs from Validate (validate.go), and the new wrapper has no non-test caller. Remove it and its changelog mention, or justify it.
• The PR title and body still say they add project.reference_repos with load-time validation and both entry shapes. All of that landed in ✨ project.reference_repos: study-only repos with optional issues/prs opt-in (#18015) #18023. Trim the body to the accessor. The fragment changelog.d/added-reference-repo-tier-accessor.md should likewise list only ReferenceRepoTier.

The ReferenceRepoTier struct and ReferenceRepo.Tier() are small additions that support the accessor, so I'm not flagging them. The accessor having no caller yet is expected, since the proxy, kick and dashboard children (#18019-#18022) follow.

Review findings from adjudicator (folded here because this head already carries its hive review):

Reviewer adjudication: DE-ESCALATE — evidence: the only failing check, native-queue-policy, errored with '#18027: head/base moved, draft, closed, or held' (a policy-runner race on a stale head, not a code failure); every build, lint, security and test shard passed. Branch scanner/fix-18018 is 0 commits behind v5 (already merged in at 86e61f7), so no rebase push was needed. Lossless vs base: no tests removed, +2 test funcs, the diff only adds ReferenceRepoTier/Tier()/String() and makes WriteLabel delegate to it, and nothing in the tree references the dropped ValidateReferenceRepos wrapper. changes: none pushed; tests: not run locally (disabled for agents), relying on the green CI shards; remaining risk: native-queue-policy needs to re-run on the current head 86e61f7.

Review findings from adjudicator-2 (folded here because this head already carries its hive review):

Reviewer adjudication: DE-ESCALATE — evidence: only failing check is native-queue-policy ("head/base moved, draft, closed, or held"), an environmental race, not a code failure; branch already contains current v5 tip bafc68a (merge-base == origin/v5), so no rebase/push needed; all Go test shards, coverage, patch-coverage, lint, gosec and DCO checks pass on the prior head. Diff is additive (ReferenceRepoTier, Tier(), String(), ProjectConfig.ReferenceRepoTier; WriteLabel delegates) with +51 test lines and zero tests removed vs base (lossless). changes: none; tests: not run locally (go test blocked for agents), relied on CI; remaining risk: native-queue-policy needs to re-evaluate on the current head; PR title still says 'add project.reference_repos' though that landed in #18023 (cosmetic).

Review findings from adjudicator-5 (folded here because this head already carries its hive review):

Reviewer adjudication: DE-ESCALATE — evidence: only failing check was native-queue-policy ('head/base moved, draft, closed, or held'), an environmental queue-state error, not a code failure; all build/test/lint checks green. Still wanted: ReferenceRepoTier accessor (#18018) absent from v5, no superseding PR. Lossless: diff vs v5 is the same 3 files (+93/-11) with its 51 added test lines intact. changes: none by me; the branch was already merged with v5 by another actor (head 86e61f7, 0 behind v5) while I was rebasing, so my duplicate push was dropped. tests: not run locally (go test blocked for agents); relying on CI. remaining risk: native-queue-policy must re-run on the new head; none otherwise.

[hivecommons-hive]

Decision needed: @clubanderson should decide whether #18027 (child 1 of the #18015 split) should land at all, given #18023 already carries the full #18015 implementation including this config layer and is labelled approved — the two define the same config.ReferenceRepo type in the same new file with incompatible APIs and cannot both merge.

Conclusion: the code here is fine, but it collides with #18023 (approved, same base v5), which implements all of #18015 — including this exact config piece — in one PR. Both add src/pkg/config/reference_repos.go declaring type ReferenceRepo struct and both touch config.go, validate.go, settings_parity_allowlist.txt. Whichever lands second will not compile against the other (ReferenceRepo redeclared). A maintainer needs to pick one line of work before the remaining children (#18019–#18022) build on this one.

What I verified (read both diffs in full):

Same semantic change:

• Entry is bare owner/name or {repo, write: [issues, prs]}; scalar form = read-only (reference_repos.go UnmarshalYAML/MarshalYAML in both).
• Validation at load: slug shape, case-insensitive clash with project.repos, duplicate entry, unknown write value — the same four rules in both, wired into ValidateWithOptions in validate.go in both.

Where they differ (so this is a conflict, not a redundant duplicate):

• #18027 exposes ProjectConfig.ReferenceRepoTier(slug) (ReferenceRepoTier, bool) with ReferenceRepoTier{Issues,PRs}.String(); #18023 exposes Config.ReferenceRepoFor(repo), ReferenceRepo.WritesIssues()/WritesPRs()/ReadOnly()/WriteLabel()/Owner()/Name(), Config.ReferenceRepoSlugs(), ReferenceReposWithWrite(). The proxy, kick and dashboard code in #18023 is written against the second API; the #18019–#18022 children would be written against the first.
• #18023 adds write_token_file to the entry (and the rule that it requires write); #18027 has no credential field. The proxy write path in #18023 (src/pkg/github/reference_repo_token.go) depends on it.
• #18027 uses a regex for the slug and hand-qualifies bare project.repos names with p.Org; #18023 reuses the existing QualifyRepo(c.Project.Org, repo) helper. Functionally equivalent for the tests both ship.
• #18027 updates testdata/agent_runtime_golden.json ("ReferenceRepos": null) because its field has no json tag; #18023 tags the field json:"reference_repos,omitempty" so the golden is untouched.

Nothing in this PR is defective on its own; I found no correctness or security issue in reference_repos.go. The question is purely which implementation #18015 should proceed with. If #18023 is the one, this PR and the four sibling children are superseded and could be closed; if the split is preferred, #18023 should be reduced to not carry the config layer. I have not closed anything.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Needs a decision, not a merge:

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

_{Updated 2026-11-13 20:31 UTC.}

[hivecommons-hive]

Rebased onto v5. #18023 landed the full project.reference_repos implementation (proxy, dashboard, kick) for the same issue, so this PR now keeps only its additive piece on top of upstream: ProjectConfig.ReferenceRepoTier(slug) / ReferenceRepoTier and a ProjectConfig.ValidateReferenceRepos() wrapper, plus tests. The duplicate struct field, validate hook, golden and allowlist edits were dropped in favour of upstream's.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 9901aa0e4

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Scanner: native-queue-policy is failing across several sibling PRs (shared incident, filed as a [shared-ci] issue); deferring repair of this PR until the incident closes.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=claude model=claude-sonnet-5-5 claude=2.1.322