Repository navigation
🌱 chore: top up v6 from v5 (2026-11-13) - #18122
Open
hivecommons-hive[bot] wants to merge 214 commits into
Open
hivecommons-hive[bot] wants to merge 214 commits into
hivecommons-hive[bot] wants to merge 214 commits into
Conversation
Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.221.0 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>
release: v5.221.0 Signed-off-by: hivecommons-hive[bot] <hivecommons-hive@hive.kubestellar.io>
Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
…ry error (#17756) * 🐛 fix: name ENOEXEC instead of dumping binary stderr in model discovery error Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> * 🐛 fix: import unicode/utf8 and keep ANSI-coloured stderr out of the ENOEXEC check cli_models.go used utf8.ValidString without importing unicode/utf8, so the dashboard package failed to build. isBinaryStderr also treated ESC (0x1b) as a binary control byte, so coloured stderr would have been mislabelled as an ENOEXEC dump; ESC is now allowed alongside the whitespace controls, with a regression test. Hive-Fix-Attempt: 1/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> --------- Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
#17741) * ✨ crux: Substrate as the 4th sandbox runtime (opt-in, preflight-gated) Add Agent Substrate (CNCF Sandbox) as sandbox.runtime: substrate behind the existing sandbox.Launcher seam, mirroring the OpenShell runtime (ADR-0026 phase 2). - crux/sandbox/substrate*.go: SubstrateLauncher (ActorTemplate + Actor per kick, atenet-egress policy derived from the proxy host set + allow_hosts, workspace push/run/pull through an in-actor bridge over the atenet-router mTLS CONNECT tunnel, snapshot_on_idle suspends instead of deleting), real gRPC client constructed lazily, Control API preflight registered into crux/config. - crux/sandbox/substrateapi: trimmed, wire-compatible proto subset of ate.control.v1 generated in-repo (no go.ate.dev/substrate import: it requires Go 1.27 and is very large). Zero new Go modules. - crux/sandbox/substratebridge: the HTTP bridge served inside the actor. - crux/config/agent_config_substrate.go: sandbox.substrate.* leaves with per-agent merge; pkg/config gate warnings (digest-pinned image). - Settings parity allowlist entries for the new leaves (#17699). Fixes #17697 Part of #17695 Signed-off-by: Andrew Anderson <andy@clubanderson.com> * changelog: fragment for #17741 Generated by changelog-fragment-guard from the PR title (#5675). Edit the wording freely, or replace this file with the no-changelog label if the change is not user-visible. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: clubanderson <407614+clubanderson@users.noreply.github.com> * 🌱 changelog: make the substrate fragment an entry bullet Signed-off-by: Andrew Anderson <andy@clubanderson.com> * 🌱 changelog: drop the auto-generated duplicate fragment Signed-off-by: Andrew Anderson <andy@clubanderson.com> * 🌱 substrateapi: drop a never-true nil comparison flagged by staticcheck Signed-off-by: Andrew Anderson <andy@clubanderson.com> --------- Signed-off-by: Andrew Anderson <andy@clubanderson.com> Signed-off-by: clubanderson <407614+clubanderson@users.noreply.github.com> Co-authored-by: clubanderson <407614+clubanderson@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…y notes (#17745) * 📖 docs: ADR-0026 phase 2 — Agent Substrate runtime operator and deploy notes Amend ADR-0026 with the Substrate implementation notes (contract mapping, deviations from the reference model, cluster prerequisites and which hive clusters qualify, when to choose it over OpenShell); add the operator section to sandbox-isolation.md, the integrations table row, deploy/README pointer and a new deploy/substrate.md with install and verification steps. Part of #17695 Signed-off-by: Andrew Anderson <andy@clubanderson.com> * changelog: fragment for #17745 Generated by changelog-fragment-guard from the PR title (#5675). Edit the wording freely, or replace this file with the no-changelog label if the change is not user-visible. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: clubanderson <407614+clubanderson@users.noreply.github.com> * 🌱 changelog: make the substrate docs fragment an entry bullet Signed-off-by: Andrew Anderson <andy@clubanderson.com> * 🌱 changelog: drop the auto-generated duplicate fragment Signed-off-by: Andrew Anderson <andy@clubanderson.com> * 📖 docs: fix the ADR-0002 link in the Substrate section Signed-off-by: Andrew Anderson <andy@clubanderson.com> --------- Signed-off-by: Andrew Anderson <andy@clubanderson.com> Signed-off-by: clubanderson <407614+clubanderson@users.noreply.github.com> Co-authored-by: clubanderson <407614+clubanderson@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.221.1 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>
release: v5.221.1 Signed-off-by: hivecommons-hive[bot] <hivecommons-hive@hive.kubestellar.io>
…17743) Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
…sDir (#17765) stageEngineOptions dereferenced cfg.Data.WorkflowsDir as an argument before any nil check. Because stageEngine is a package-level sync.Once, the panic only fired when a nil-config caller was first in the process, making it order-dependent. Build the workflow store only when cfg != nil. Closes #17736 Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
* Fix GFI curation for archived repositories Hive-Run: #17734 Hive-Plan: archived-repository GFI recovery Hive-Spec: good-first-issue#archived-repositories Signed-off-by: Karibhou <Karibhou@users.noreply.github.com> * fix: correct changelog fragment category Signed-off-by: Karibhou <Karibhou@users.noreply.github.com> --------- Signed-off-by: Karibhou <Karibhou@users.noreply.github.com> Co-authored-by: Karibhou <Karibhou@users.noreply.github.com> Co-authored-by: hivecommons-hive[bot] <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.222.0 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>
release: v5.222.0 Signed-off-by: hivecommons-hive[bot] <hivecommons-hive@hive.kubestellar.io>
…let spokes trigger refresh (#17773) * 🐛 marketplace: resume CNCF catalogue seeding across hub restarts and let spokes trigger refresh Root cause of the one-entry catalogue on hive.hivecommons.dev: GitHub tarballs lead with a pax_global_header entry, which Go's tar reader surfaces as a header. ExtractTarGz counted it as a second top-level name, returned dest instead of the wrapped "<owner>-<repo>-<sha>/" directory, and ingest.ReadTree then saw every path with the wrapper prefix — no GitHub Actions workflow matched. Only tektoncd/pipeline got through, via the content-based Tekton sniff. Skip pax headers when extracting. Seeding is now resumable: at startup the hub ingests every corpus repo that is due (no record, record older than 24h or in an older format, error older than 1h) instead of only when the catalogue is empty, so a restart mid-seed continues and a flapping hub does not re-crawl fresh repos. Records carry a format version; bumping it (format 2 for the tarball fix) re-ingests everything on the next boot. The last run summary is persisted so status.lastRefresh survives restarts; status gains pendingRepos/lastRefreshErrors and ?verbose=1 (spoke or admin) lists the failing repos with their errors. POST /api/marketplace/refresh accepts the same credentials as publish (hub admin session or spoke heartbeat bearer + X-Hive-ID); spokes are rate-limited (one full run/hour, 10 ?repo= runs/min → 429 + Retry-After), admins are not. The spoke proxy passes 429/409 through with the hub's message. The crawl sleeps on 403/429 Retry-After (secondary limits) and logs progress every 25 repos. Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com> * 🐛 marketplace: update refresh tooltip in static-src and regenerate index.html Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com> --------- Signed-off-by: Andrew Anderson <andy@clubanderson.com>
…17744) * fix: bound consecutive stale-snapshot drops in the status builder Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> * 📖 docs: update staleDropStarvationThreshold comment for bounded publish The constant's doc comment still described the pre-PR contract (drop logged at Warn). It now marks the point where the build is published anyway to bound staleness. Hive-Fix-Attempt: 1/6 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: ci-maintainer <280983584+hivecommons-hive[bot]@users.noreply.github.com> * 📖 docs: resync api-reference citations after server.go route shift Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> --------- Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Signed-off-by: ci-maintainer <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…17754) Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
…ss, feature gates) (#17766) * ✨ crux: Substrate preflight prover (operator, CRDs, gVisor RuntimeClass, feature gates) Extends the sandbox.runtime: substrate preflight with the cluster facts behind a failing kick: operator CRDs and workloads, ready WorkerPools and their sandbox classes, gVisor (SandboxConfig or runsc RuntimeClass) and KVM availability, node kernels, the certificates.k8s.io APIs behind the PodCertificateRequest and ClusterTrustBundle feature gates, and an mTLS CONNECT probe of atenet-router. Skipped outside a cluster; one warning when RBAC is missing, with a manifest that grants it. Fixes #17698 Signed-off-by: Andrew Anderson <andy@clubanderson.com> * fix(crux/sandbox): egress policy atespace + in-place workspace clear found by #17697 kick The first real kick through Substrate v1.0.0 (kind, gVisor) surfaced two defects in the launcher path: CreateActorEgressPolicy was rejected with 'egress_policy.metadata.atespace: Required value', and the bridge's PUT /workspace failed with EBUSY because os.RemoveAll targeted the durableDir mount point itself. Set the atespace on the singleton policy and clear the workspace directory's contents in place. Signed-off-by: Andrew Anderson <andy@clubanderson.com> * test(crux/sandbox): run the kube/router preflight halves only in a Pod wired for Substrate CI runs in Pods, so /var/run/secrets/kubernetes.io/serviceaccount/token exists there and the kube/router halves of the prover ran during the Control-API-only tests (crux/sandbox and crux/agent). The prover now requires both the Kubernetes token and hive's projected Substrate token (opts.token_file, /var/run/secrets/ate/token by default) before probing the cluster; the Kubernetes token path is a package variable the sandbox test package pins to a nonexistent file, with a helper that flips both markers on for the tests covering the in-cluster branches. Signed-off-by: Andrew Anderson <andy@clubanderson.com> --------- Signed-off-by: Andrew Anderson <andy@clubanderson.com>
…mits (#17780) Prototype on LKE (#17643) hit four gateway rejections before a kick ran: sandbox names over MAX_ROUTABLE_NAME_LEN (19), the reserved 'workspace' volume name, default-denied pod labels/annotations, and the missing Agent Sandbox prerequisite. Names are now hk-<slug>-<base36 unix> (fnv tag when the slug does not fit), the claim mounts as hive-workspace, and the deploy doc records the operator settings the measurements depended on (allowed_pod_labels, workspaceStorageClass, sandboxUid, auth modes) plus the landlock-in-LSM preflight lesson and the measured numbers. Refs #17643, #17642 Signed-off-by: Andrew Anderson <andy@clubanderson.com>
Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.222.1 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>
release: v5.222.1 Signed-off-by: hivecommons-hive[bot] <hivecommons-hive@hive.kubestellar.io>
#17793) The marketplace fetcher extracted each default-branch tarball to disk via complexity.ExtractTarGz under a 256 MiB whole-tree cap, so large monorepos (kubernetes/kubernetes, kserve/kserve, meshery/meshery, shipwright-io/build, spidernet-io/spiderpool) failed with "archive exceeds size cap" and never reached the catalogue. ingest.ReadTarball now streams the archive and keeps only the paths ReadTree would select (shared selectTreeFile), 1 MiB per file and 32 MiB in total, discarding everything else without buffering; the complexity cap is untouched for its own callers. GET /api/marketplace/status now includes failing:[{repo,error,checkedAt}] without ?verbose=1 (repo names and fetch errors carry no secrets), so an operator with a plain PAT can see why repos fail. Four corpus entries that GitHub now redirects are updated to their current names. Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com>
* 🐛 fix: redact proxy userinfo in upstreamproxy URL errors parseProxyURL formatted the raw proxy URL into its rejection errors, and configureUpstreamProxy logs that error, so a malformed URL carrying the proxy's Basic credential put the password in the hive JSON log on every boot. logscrub's basic-auth category covers Authorization headers only, not URL userinfo, so nothing downstream masked it. Use url.Redacted() on the parsed form, strip the userinfo segment when url.Parse itself fails, and drop the *url.Error wrapper whose message repeats the full URL. Fixes #17730 Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com> * chore: re-key merge request after transient lint-pending refusal Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> --------- Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com> Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Records now carry cost.basis (tokens_x_pricing | unknown), cost.usd_est, token share, launches and price_table_date, attributed from the spoke's launch-cost collector: the swarm's PR ref for reviewer records, the governor's issue ref of an issue the PR closed for author records (both ref spellings). Vendored benchmarks schema refreshed; converter and dashboard lookup tests; docs cost section. Fixes #17790 Refs #17694 Signed-off-by: Andrew Anderson <andy@clubanderson.com>
Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v5.223.0 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>
…ent workflow (#17798) Curated marketplace tier gets a source of truth in the binary: pkg/hub/marketplace/curated/*.yaml is embedded, strictly decoded, checked for the curated invariants (provenance curated, a version, nothing left inferred), compiled through bundle.Export and published at tier curated on hub startup and at the start of every refresh run when that name@version is absent. Bad files are logged and skipped, never fatal; edits without a version bump are refused as conflicts, so a new version is a new file. Seeded keys are reported in lastRefresh.curated. The first curated model is cncf-techdocs-assessment@curated-2026.11.1: Nate W.'s AI-assisted TechDocs assessment process (spec at nate-double-u/cncf-techdocs@882be6f, intake template @ad91530), scoped to cncf/techdocs. Issues travel requested → accepted → draft-open (→ escalated) → closed/declined; deliverable PRs travel drafting → in-review → stakeholder-review → awaiting-merge → merged with checks-failing and discarded branches. Every gate (/accept, /decline, /verify, /ready, /confirm, /approve, /discard, /abort) is released by a human role; the drafter and verifier agents stop at gates. Checks are the repo's format/link/spell-check workflows plus the manual provenance block. The rules evaluator is exercised over hand-written Facts for each step. cncf/techdocs is not a landscape project, so the corpus package gains an operator-added extra.json merged into Repos(); the ingested-unreviewed version now sits next to the curated one. Docs: marketplace section of docs/design/workflow-models.md (curated seeding, where a model goes, how versions work) and docs/workflows/techdocs-assessment.md for the TechDocs team. Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com>
release: v5.223.0 Signed-off-by: hivecommons-hive[bot] <hivecommons-hive@hive.kubestellar.io>
…unclassified selfreports (#17757) * 🐛 fix: classify repeated agent-lifecycle log lines instead of filing unclassified selfreports Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> * test: expect agent_lifecycle_repeated class for non-held kick failures TestPostRestartKickHoldLogsWithoutFleetReport asserted the generic unclassified class; 'failed to send kick' is now classified as agent_lifecycle_repeated. Held kicks still produce no observation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> --------- Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ims from non-admin bundles (#17764) * 🐛 fix(marketplace): refuse and downgrade model-provenance curated claims from non-admin bundles The hub checked only the envelope Tier when deciding whether a publisher may assert curated/built-in; the model's own spec.meta.provenance is hash-covered and stored verbatim. Spoke import preferred the model's provenance over the envelope tier, so a registered spoke could publish a bundle every importer badged as curated. The hub now refuses such bundles from non-admins (it cannot rewrite the hash-covered model) and importers honour a vouched model provenance only when the envelope asserts the same tier. Fixes #17763 Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com> * fix(marketplace): express importedProvenance as an if so the mutation gate sees its coverage Go's cover tool does not instrument the case expressions of a tagless switch, only the case bodies, so gremlins reported the three conditionals on the switch as NOT COVERED even though TestImportedProvenance exercises every branch. Fold the switch into a single if with identical semantics; if conditions sit inside the preceding coverage block and are attributed correctly. No behaviour change: empty provenance still takes the envelope tier, and a curated/built-in claim the envelope does not assert still falls back to it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com> --------- Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
hivecommons-hive
Bot
added
stage/070-fixing
Contributor
Author
d53c70e
ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blockedHive flagged this PR (author @hivecommons-hive[bot], head
Hive did not add the |
hivecommons-hive
Bot
added
stage/070-fixing
Contributor
Mutation testingHead ⏱️ The 900s mutation budget ran out, so 12 package(s) were not fully mutated and the results below do not cover them:
❌ gremlins did not produce a report for 2 package(s), so no verdict can be derived from this run (see the job log):
9 mutant(s) in changed files are not reached by any test (NOT COVERED). A maintainer may apply the
Verdict: |
- Resync api-reference citations (334 drifted line refs after the merge).
- dashboard: the merged-in v5 navbar summary button left v6's base
`.agent-navbar-upnext::after { content: attr(data-agent-summary) }` rule;
scope it to the v6 "+N" overflow count ([data-agent-more]) and stub v6's
fitAgentNavbarTiles/ensureAgentNavbarFitObserver in the v5-authored test.
- dashboard: declare v5's hold-shift guard globals in the v6-only your-turn
fake browser, and stub v5's webhookGovStatHtml in the v6-only standby
tile test.
- dashboard: list GET /api/config/github/webhooks (v5) as a settings_read
exclusion; it probes App hook permissions live on every read.
- hub: classify v6's HeartbeatResponse.UpgradeChannelTag in v5's
self-service credential fence (fenced, rides with UpgradeTo).
- github: v5's 404 close-on-merge claim reused issue 12, which v6's test
lists as an open PR; give it its own open issue (14).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
kubestellar-prow
Bot
added
dco-signoff: no
Contributor
Author
|
Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor. hive/awaiting-ci: DEFER. Baseline triage says MERGE_BASE, but merging origin/v5 (8 commits ahead) conflicts in src/pkg/config/config.go, src/pkg/dashboard/static-src/js/config-state.js, CHANGELOG.md and generated src/docs/api-reference/*.md; too large to resolve without a build. DCO also fails because the 214-commit v5-to-v6 range includes commits without sign-off, which cannot be repaired by pushing here. A maintainer needs to re-run the top-up from current v5. 🐝 Hive Agent: — hive: agent=scanner backend=claude model=claude-sonnet-5-5 claude=2.1.322 Review findings from Routing, not a code verdict. I did not read all 183 files of this forward-merge and I am not claiming the conflict resolutions are correct. What I verified from the PR metadata at
Reminder from the body: merge with a merge commit, not squash. Review findings from HUMAN DECISION NEEDED — carried over from the earlier head: the new credential-injection path at src/crux/proxy/github_proxy_policy.go:183 (security) and the failing native-queue-policy check (correctness). The delta does not touch either, so I can't clear them. Docs-currency delta re-review at b8706e7 (compared with e79354b):
Review findings from Correctness delta re-review at b8706e7 (delta from e79354b).
I found no new correctness issues in the delta. The PR was not built or tested locally, so I did not run tests. Review findings from Routing, not a defect finding. This is a 183-file forward-merge whose body says only a maintainer with admin rights can land it (merge commit, not squash; DCO override). It also touches image supply-chain files ( What I read:
Open question for a human: is the |
github-actions
Bot
added
dco-signoff: yes
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
Contributor
Author
There was a problem hiding this comment.
Style review of #18122: no in-scope blockers. I read the PR body, issue #18041 and the diff (not the full tree), and found no conflict markers. The merge keeps v6's layout, as the body documents.
Advisory only (out-of-scope): sendKick in the crux/agent diff is a one-line wrapper over SendKickWithSource. It could be dropped later. I did not check build or test results.
— hive: agent=adjudicator-4 backend=claude model=claude-sonnet-5-5 claude=2.1.322
Signed-off-by: scanner <280983584+hivecommons-hive[bot]@users.noreply.github.com>
kubestellar-prow
Bot
added
dco-signoff: no
github-actions
Bot
added
dco-signoff: yes
Contributor
Author
There was a problem hiding this comment.
HUMAN DECISION NEEDED — Confirm the reference-repo write-credential injection path in the proxy (carried in from v5 #18015) is acceptable on v6.
Security delta re-review at b8706e7 (changes since e79354b):
- [security] src/crux/proxy/github_proxy_policy.go:183 credential injection path: still present. The delta does not touch this file.
rewriteGitHubAuthstill sends reference repos torewriteReferenceRepoAuth, which attaches the repo's own write credential on opt-in writes (lines 181-190). This is v5 code from #18015, merged forward unchanged. It is credential-handling code, so a person should own the decision. - [correctness] native-queue-policy: still failing. Two
native-queue-policychecks are failing on the PR. I did not find a cause, and it is outside the security perspective. - Delta (code scanning settings): no new security finding. I read
api_config_code_scanning.go,tools_code_scanning_ops.goandaudit.go.- Both
GETandPUT /api/config/code-scanningcallrequireOwnerRole(api_config_code_scanning.go,handleCodeScanningConfigGetandhandleCodeScanningConfigPut). PUTcaps the body withMaxBytesReader, rejects unknown fields and trailing JSON, and refuses${and control characters in list entries.- It runs
config.ValidateCodeScanningSettingsbefore saving, and rolls back ifsaveConfigfails. - It writes one audit entry per changed key, and
config_code_scanningis registered as a sensitive audit action. - The admin-MCP write op has a preview, a state fingerprint checked again at confirm, and a "Widening" disclosure when the sweep is turned on for a repo.
- The sweep opens issues only, per the op's own description.
- Both
I did not review the test files, JS or openapi.json line by line.
— hive: agent=adjudicator-2 backend=claude model=claude-sonnet-5-5 claude=2.1.322
hivecommons-hive
Bot
force-pushed
the
topup-v6-2026-11-13
branch
from
November 13, 2026 20:44
b8706e7 to
70aaeb7
Compare
hivecommons-hive
Bot
added
dco
Contributor
Author
There was a problem hiding this comment.
Decision needed: @clubanderson should a human spot-check the trust-surface conflict resolutions in this v5→v6 forward-merge (crux/proxy, Dockerfiles) before it lands, since it is 9.8k lines and unreviewed line-by-line?
I did not review this forward-merge line by line. It changes 9,876 lines across about 190 files, which is more than I can verify properly in one kick, and I would rather say that than guess.
What I can say from the file list and the PR body:
- It touches trust-sensitive paths:
src/crux/proxy/github_proxy.go,github_proxy_mitm.go,github_proxy_policy.goandreference_repos.go, plussrc/Dockerfile,src/Dockerfile.contributorandsrc/deploy/ci-runners/Dockerfile. Per policy I route this to a person rather than call it clean. - The body says 27 conflicts were hand-resolved so that v6's moved and split code keeps its layout:
project_config.go, theonDeliveredhook incmd/hive,SendKickWithSourceincrux/agent, and the dashboard review section. Those resolutions are where a bug would be, and they are the part a forward-merge's own CI is least likely to catch. - The body also says nothing was built or tested locally and CI is the verdict. I agree with that approach, but CI passing does not cover the proxy-policy resolutions.
Suggested focus for the human, in order:
- The
crux/proxyconflict resolutions. Check that no v6 destination or reference-repo guard was dropped in favour of v5's shape. - The Dockerfile digest and version bumps, to confirm they match v5.
crux/agent/manager*.go, to confirm v5's canary-refusal retry viasendKickdid not bypass v6's deferred-mention queue.
I have not approved or closed anything.
— hive: agent=reviewer-2 backend=claude model=claude-sonnet-5-5 claude=2.1.322
hivecommons-hive
Bot
added
stage/070-fixing
Contributor
Author
🛑 Fix loop escalated — human attention neededThis PR has failed CI on 3 distinct fix attempts (new commits, still red). The hive has stopped dispatching further automated fixes for it. Failing checks: DCO, native-queue-policy Raw failure evidence (from check-run annotations): Remove the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Forward-merge
v5intov6now that #18024 (owner-facing GitHub webhook setup) has landed on v5. This brings v6 up to v5 at3b1eaeda6(v5.244.1): 57 v5 commits since the last top-up (#18030, v5.237.2).How
This is a real merge commit. Its parents are
origin/v6(fbee051fe) andorigin/v5(3b1eaeda6). #18030 was squash-merged, so git's own merge base is older and a plaingit merge origin/v5brought back about 80 conflicts that were already resolved. So the tree was merged against v5.237.2 (4d8744035), the v5 commit #18030 carried, withgit merge-tree --merge-base. The commit has DCO sign-off.Conflict resolutions (27 files)
The procedure says to prefer v5 for
src/. v6 has split and moved code that v5 still keeps in one place (for exampleconfig.gobecameproject_config.go, and the kick-dispatch block moved). Taking v5's side whole would have added that code back a second time. So each conflict keeps v6's layout and puts the v5 change into it:project.reference_reposfield (✨ project.reference_repos: read-only (optionally issues/prs) repos an agent may study without them being authorized #18015) goes into v6'sproject_config.go.validateReferenceReposruns after v6's repo-policy checks.perspsrcimport is added next to v6's nous/persona imports. The 🐛 [v5] governor: agents out of provider quota keep being kicked and sent review work (no hold or probe for non-gateway backends) #18112 quota-probe stamp moves into v6's relocatedonDelivered.SendKickWithSourceand deferred-mention queue stay.sendKick(name, msg, trigger)is added for v5's canary-refusal retry.ReviewerAutoscaleand named PUT body, and adds v5's linked-perspectives fields and helpers.FrontendStatusgetsReferenceRepos.contribute_wskeeps both fields. The navbar summary button (🐛 [v5] dashboard: the narrow top-bar "3 agents ▾" pill caps its count at 3 and does nothing when clicked #18110) is combined with v6's tile fitting insections.js,sections-collapse.cssandstatic/index.html.WebhookVerificationuses v5'sWebhookSecret(), so the secret file from ✨ Owner-facing GitHub webhook setup: Settings section, generated secret, create-hook, owner guide #18024 counts. The reopen test uses v5's pinned clock.env-vars.mdtakes v5'sGITHUB_WEBHOOK_SECRETrow.Nothing was built or tested locally; CI decides.
gofmt -lis clean on the changed Go files.Merge notes (maintainers)
DCOand prowdcofail on forward-merges because the merge brings in other authors' commits. That is expected here and doesn't block this PR.tui90,github89), fix it in this PR with tests. Don't lower the floor.Closes #18041
🤖 Generated with Claude Code
— hive: agent=scanner backend=claude model=claude-sonnet-5-5 claude=2.1.322 requested_by=@clubanderson