🐝 Hive Advisory Report #30

Activity

1. hivecommons-hive

   added

   hive/advisoryPinned advisory report from Hive agentsPinned advisory report from Hive agents

   on Aug 3, 2026
2. hivecommons-hive commented on Aug 3, 2026

   

   hivecommons-hiveBot

   on Aug 3, 2026 – with hivecommons-hive

   Last edited by hivecommons-hive

   Author

   More actions

   🐝 Advisory Digest — 2026-11-13 16:01 EST

   Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

   Advice

   Hive picked this list on 2026-11-07 and keeps it until 2026-11-14, so it does not jump around between reports. The numbers, items and links under each one are worked out fresh for every report. If Hive's mode changes from BUSY, it picks a new list sooner.

   Counts quoted: governor actionable queue 16 PRs / 2 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 18 open PRs / 21 open issues (every open or held item across repo cards; the queue-health advice counts these).

   • Reduce the blocked PR queue — 10 of 18 open PRs (55%) are Blocked. 10 of 10 have merge conflicts — rebase or close the oldest.
     • First:
       • spektacular#79 — merge conflict; verdict blocked: has merge conflicts with main — needs a rebase
       • spektacular#98 — merge conflict; verdict blocked: has merge conflicts with main — needs a rebase
       • spektacular#101 — merge conflict; verdict blocked: has merge conflicts with main — needs a rebase
       • spektacular#103 — merge conflict; verdict blocked: has merge conflicts with main — needs a rebase
       • spektacular#65 — merge conflict; verdict blocked: has merge conflicts with main — needs a rebase
     • Full list: Blocked PRs (CSV), Blocked PRs in spektacular (CSV)
     • Numbers behind this: overview_open_prs=18, blocked=10, blocked_pct=55, failing_ci=0, merge_conflict=10, verdict_blocked=10, stale_blocked=10, oldest_blocked_days=47, top_repo=spektacular (10, 100%), top_author=Danathar (5, 50%)
   • Clear the human gate on PRs — 9 of 18 open PRs (50%) are waiting on a person; the hive cannot move them on its own.
     • Why they wait:
       • 5 that only a person can merge (all in spektacular).
       • 2 handed to a person by the hive's review to decide (all in spektacular).
       • 1 held with no recorded reason (all in spektacular).
       • 1 flagged by the sentinel, to inspect before anything merges (all in spektacular).
     • How to help: merge the reviewed PRs by hand in spektacular; read the hive's review and decide in spektacular; release or explain the unexplained holds.
     • First:
       • spektacular#100 — REVIEW — Hive will not merge this PR
       • spektacular#107 — REVIEW — Held, and the hold's source is unknown — review it
       • spektacular#5 — INSPECT — Flagged by the sentinel — inspect it before it merges
       • spektacular#65 — REVIEW — Hive's review needs a human decision
       • spektacular#105 — REVIEW — Hive will not merge this PR
     • Full list: Your-turn PRs (CSV)
     • Numbers behind this: overview_open_prs=18, needs_human=9, your_turn=9, to_close=0, verbs=1 INSPECT, 8 REVIEW
   • Rebalance toward merge-side agents — The hive is busy; prioritize review, hold draining, and merge-side lanes before increasing new issue intake.
     • Numbers behind this: mode=BUSY, open_holds=7, governor_prs=16, governor_issues=2

   Bands named above (same rules as the Overview chart):

   • Blocked (PRs): blocked sweep verdict, merge conflicts, or failing CI

   Findings: 10

   💡 Showing top 10 findings (by severity). 173 more exist. Set governor.advisory.show_all: true to see all.

   Severity	Count
   🟠 high	10

   🟠 HIGH (10)

   • [missing-fixture] Jira discovery lacks paginated search fixtures for Cloud and Data Center internal/publish/jira/jira.go quality

     Static review of PR ✨ publish: Jira target (Epic + Stories, Cloud and Data Center) #117 at a151ea7: search requests maxResults=100 once on both Cloud POST search/jql and Data Center GET search and decodes only issues. jiratest.search ignores the requested limit and returns every match with isLast=true, so current idempotence tests cannot expose discovery truncation. Add Cloud nextPageToken and Data Center startAt/total aware fixtures with more than 100 marked issues. Omit Hint URLs (fresh project or incomplete publication record), place RFC or children on later pages, assert Find returns every ID and republish creates no duplicate issues. Include complete Hint URLs as a control, because hints can mask truncated search. Risk is duplicate remote issue mutations during reconciliation without complete hints. This is a static missing fixture and apparent single-page limitation, not an executed defect; local go test is prohibited by Hive policy.

   • [missing-fixture] Publish discovery lacks a paginated search fixture for more than 100 matching items internal/publish/github/github.go quality

     Static review at main cea47f3: Find requests /search/issues?per_page=100 once and decodes only Items. fakeGitHub returns every matching issue in one response and ignores pagination, so TestTarget_FindThenRepublishIsIdempotent cannot expose missing existing children beyond page one. Add a paginated httptest handler with an RFC and more than 100 marked children, total_count and Link headers, and assert Find discovers every ID and a subsequent Publish creates no duplicates. Include the RFC appearing only on a later page. The current single-page implementation appears liable to recreate missing items; this is a static test gap, not an executed reproduction. Local go test is blocked by Hive guard.

   • [missing-fixture] Publish relation warnings lack a retry fixture that verifies sub-issue and dependency repair internal/publish/github/github.go quality

     Static review at main cea47f3: TestTarget_RelationFailuresAreWarnings asserts warnings only on the first run. Publish calls link only for newly created children and blockedBy only when an endpoint was created in the current run, despite promising that --update repairs relation failures. Extend fakeGitHub with fail-once switches for both endpoints: publish successfully created issues with failed relations, clear failures, call Find then Publish again and assert the missing sub-issue and blocked-by edges are established without creating duplicate issues. Also inject a later child-create failure after an earlier child persists and verify retry. Current guards appear to skip relation repair for reused issues; no runtime defect reproduced because Hive blocks local go test. Priority high because downstream scheduling depends on these relations.

   • [missing-fixture] PR fix(autocommit): release the commit lock when its holder dies #101 commit lock lacks a deterministic unlinked-inode handoff fixture internal/autocommit/lock.go quality

     Static review of PR fix(autocommit): release the commit lock when its holder dies #101 at 9f65973: AcquireLock accepts a locked descriptor only when isLockFile confirms os.SameFile with the current pathname. Unix release unlinks while holding flock, so a waiter can hold the old inode while a newcomer owns a replacement inode. The eight-goroutine serialization test uses sleeps and does not force this schedule; no test directly calls isLockFile or deliberately holds a descriptor across unlink/replacement. Add a Unix fixture using channels or a narrowly scoped test seam: open the waiter descriptor before release, unlink/release the old holder, acquire a replacement holder, then allow the stale waiter to lock its old inode. Assert the stale waiter cannot enter until the replacement releases, and that it reopens the pathname. Include a focused helper test for same inode versus removed/replaced pathname. The regression fixture should fail when the identity guard is bypassed. Protects serialization of Git mutations. This is a missing deterministic regression fixture, not a reproduced locking defect. Runtime go test blocked by Hive guard; no measured coverage claimed.

   • [bug] spektacular#118: Linear label lookup silently omits configured labels beyond the first page #118 scanner

     At head 0cf22c8, teamQuery requests team labels and workspace issueLabels with first=$first (default 250), but neither connection requests pageInfo or after. Target.team appends only those first pages. pickLabels interprets every omitted configured label as nonexistent and files new issues without it. A workspace or team with more than 250 labels can therefore publish children without an existing label required by the worker queue. Unlike Find pagination, metadata lookup remains truncated. This also affects a configured parent label, although Linear parent/marker exclusion supplies a separate umbrella safeguard.

   • [bug] spektacular#109: GitHub label lookup can omit the RFC exclusion label after the first 100 labels #109 scanner

     Target.labels performs one GET /repos/{slug}/labels?per_page=100 and never follows pagination. pickLabels treats every label absent from this first page as nonexistent. On repositories whose configured parent_label is on a later page, publish omits the RFC exclusion label even though it exists; the umbrella can enter the worker queue. Configured child pickup labels on later pages are also silently omitted with a misleading missing-label warning. This is independent of marker-search pagination and existing-item label reconciliation.

   • [bug] spektacular#117: Jira marker search silently drops issues beyond its first page #117 scanner

     At head c1d257f, search requests maxResults=100 once in both Cloud POST search/jql and Data Center GET search. Its response struct contains only Issues; it ignores continuation/total information. An Epic plus 100 children exceeds that page. Find treats omitted children or the omitted Epic as absent; re-publish with --update can create duplicate tracker items, violating idempotency.

   • [bug] spektacular#109: GitHub marker lookup truncates publications after the first 100 issues #109 scanner

     Target.Find issues exactly one /search/issues?per_page=100 request and decodes only Items, without following pagination or checking total_count/incomplete_results. One RFC plus 100 children already needs 101 hits. A rerun can miss a child and recreate it under --update, or miss the RFC and create a second umbrella. This violates the no-duplicates contract; source inspection only, no live tracker writes.

   • [bug] spektacular#109: GitHub re-publish never repairs failed sub-issue or dependency links #109 scanner

     Merged PR ✨ publish: RFC + child issues output model and GitHub target #115 documents that --update repairs best-effort relation failures. Target.Publish calls link only in the child-create branch and blockedBy only when the child or blocker appears in res.Created. Once issues exist, a rerun makes zero relation requests, leaving children unparented or missing scheduling dependencies indefinitely. An extracted-function Go harness executed the current Publish body: initial attempts were 2 sub-issue and 1 dependency; retry with existing issues and missing relations attempted 0 and 0. The harness mocks supporting types and transport; this is not a full integration run.

   • [test-gap] spektacular#109: Linear Project parents and live Hive acceptance remain incomplete #109 scanner

     Current main cmd/publish.go now imports GitHub, Jira and Linear adapters; earlier diagnosis that both tracker adapters were undelivered is superseded. Current docs/publish-hive-handshake.md explicitly says parent_as: project is not yet supported and section 6 still owes live Hive pickup/direct-fix/PR-linkage and reporter-trust runs plus consumer cross-links. Issue 📝 RFC: Spek emits RFC + child issues into a work source (GitHub / Jira / Linear) for Hive pickup #109 therefore is partially fulfilled, not ready for closure. Optional RFC output modes and relay path also remain deferred in merged ✨ publish: RFC + child issues output model and GitHub target #115; their disposition needs documenting. Verification label relay denied the request at advisory mode.

   ---

   Analyzed at hivecommons/spektacular@8f6fd66f2f47 (branch main) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked ⚠️ were computed at an older commit and have NOT been re-verified here.

   Updated 25 times · last 2026-11-13T21:01:13Z