Skip to content

🐝 Hive Advisory Report #23

Open
Open
🐝 Hive Advisory Report#23
Labels
hive/advisoryPinned advisory report from Hive agents

Description

@hivecommons-hive
hivecommons-hive
bot
opened on Aug 5, 2026

This issue collects advisory findings from Hive agents.

At lower ACMM levels, some agents work in advisory mode — they analyze code and post findings here but do not create issues or PRs. At higher levels, designated agents (e.g. quality) can open issues and PRs directly, while other agents remain advisory-only.

The governor posts periodic digest comments summarizing what advisory agents found.

Do not close this issue. It is a living document.

— hive: agent=governor

Activity

  1. hivecommons-hive
    added
    hive/advisoryPinned advisory report from Hive agents
    on Aug 5, 2026

  2. hivecommons-hive commented on Aug 7, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Aug 7, 2026 – with hivecommons-hive
    ContributorAuthor

    🐝 Advisory Digest — 2026-10-28 14:23 EDT

    Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

    Advice

    Frozen for governor mode IDLE until 2026-11-03 (next review in 6 day(s)). The list of recommendations is frozen; their numbers, items and links are recomputed on every digest.

    Counts quoted: governor actionable queue 0 PRs / 0 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 0 open PRs / 0 open issues (every open or held item across repo cards; the queue-health advice counts these).

    • Widen HIVE_REPOS — The governor's actionable backlog is shallow in a low-pressure mode; adding repositories can feed more work to the hive. (signals: mode=IDLE, repo_count=1, governor_queue_total=0)

    Findings: 10

    💡 Showing top 10 findings (by severity). 491 more exist. Set governor.advisory.show_all: true to see all.

    Severity Count
    🟠 high 10

    🟠 HIGH (10)

    • [advisory] /resources/case-studies serves a month-stale mirror: Zhuoyu Technology missing, Infosys organization name and link wrong data/case-studies.json quality

      Production /resources/case-studies mirrors cncf.io from 2026-09-24. Missing: zhuoyu-technology (published 2026-09-29). Wrong: organization 'Infosys Ltd. Client' and link /case-studies/infosys-ltd-client-8/ (upstream renamed to 'Infosys Ltd.', /case-studies/infosys-ltd-8/). Reproduced on c20e9e4 with npm run collect:case-studies: 214 vs 213 entries, 2 added, 1 removed, 0 modified; validate:case-studies and build:production pass. Filed as a finding folded into cncf/endusers#1878.

    • [advisory] PR test: resolve the outbound links the member directory renders #1857 mutation gate red: 12 unasserted collection rules in scripts/lib/data-links.mjs scripts/lib/data-links.mjs quality

      pull_request mutation lane scored scripts/lib/data-links.mjs 87.10 under break 90 (run 40028562910, head 1c42af1): 12 surviving mutants, all PR-local. Unit evidence: npm run test:unit:coverage:check exit 0, 100% source lines/regions at head 12b0e91. End-to-end evidence: ci.yml End-to-end coverage SUCCESS on 1c42af1; the module is build-time only and no browser lane reaches it. Fixed by 5 tests in tests/data-links.test.mjs; npx stryker run --mutate scripts/lib/data-links.mjs now 100.00, 93/93 killed.

    • [coverage-gap] startsWithDoctype() in svg-active-content.mjs loops forever on a truncated prolog without its end===-1 guard scripts/lib/svg-active-content.mjs quality

      Unit evidence: TZ=UTC node tests/tools/coverage-report.mjs on cncf/endusers 8abcb3f reports scripts/lib/svg-active-content.mjs at 100.00% lines and 100.00% regions, so line coverage says nothing here. Mutation evidence (TZ=UTC npx stryker run, same revision, 4211 mutants, 98.99%): 17 mutants survive in this file. A 57-input differential sweep over hasDoctype/stripDoctype/findRemoteReferences/findActiveContent/stripActiveContent distinguishes exactly two of them, both on the 'if (end === -1) return false' guard in startsWithDoctype() (ConditionalExpression and UnaryOperator). Both make the walk non-terminating: index rewinds to closer.length-1 and the whitespace skip carries it back to the same unterminated '<?'. Inputs as ordinary as '\n<?xml version="1.0"' (a file truncated mid-declaration) hang. The other 15 are verified equivalent. E2E evidence: not applicable - this module is a build/validator library, not site code, and the Playwright e2e lane does not execute it; no e2e claim is made.

    • [coverage-reporting] /resources/metrics publishes 0 open reference-architecture submissions and a 26-day-old project count data/metrics.json quality

      Live /resources/metrics shows Open submissions 0 and Median submission age 0 days while cncf/tab carries 13 open area/reference-architecture issues (median 193.1 days); CNCF projects 255 vs 259 upstream. Data last collected 2026-09-28. Reproduced on c20e9e4 with npm run collect:metrics (Collected 2 metrics at 2026-10-24T12:04:13.974Z) and npm run validate:metrics. Fixed via refresh lane in cncf/endusers#1879, filed as issue [quality] /resources/metrics publishes 0 open reference-architecture submissions and a 26-day-old project count #1878. Collector behaviour (emitting zeros instead of failing) deliberately unchanged.

    • [regression-risk] Next metrics refresh drops Subaru's member logo: fix(scripts): refuse oversized member logos at mirror time #1949's mirror-time refusal makes perf: optimize Subaru member logo and enforce size limit #1926's hand-made PNG unreproducible scripts/lib/enduser-collector.mjs quality

      perf: optimize Subaru member logo and enforce size limit #1926 replaced the 2.21 MB upstream Subaru SVG with a hand-made 14 KB PNG (fe60e14655aad3a6-subaru.png). fix(scripts): refuse oversized member logos at mirror time #1949 then made the collector refuse oversized upstream logos at mirror time. Verified locally at fcf1b47: mirrorLandscapeLogo against a 2.2 MB hosted_logos/subaru.svg returns localLogo=null; generate-members.mjs:252 then writes logo:null for Subaru and pruneOwnedLandscapeAssets (generate-members.mjs:343) deletes the PNG. All validators still pass (102 members validated), so the lane goes green and ships the regression silently at the next cron (refresh-metrics.yml, '17 3 * * 2'). The committed filename is unreproducible by design: sha256(png)[:16]=aca294b3ee721f92 but the file is named fe60e14655aad3a6-subaru.png, and logoFilename is subaru.svg.

    • [regression-risk] Member logo collector has no 2 MB guard; refresh-metrics fails on main and site data goes stale scripts/lib/enduser-collector.mjs quality

      mirrorLandscapeLogo() copies upstream cncf/landscape logos with no size check. PR perf: optimize Subaru member logo and enforce size limit #1926 promoted the 2 MB member-logo check in scripts/lib/validate-architecture-assets.mjs:366 from warn to error and hand-replaced the 2.21 MB Subaru SVG with a 14 KB PNG, but added no collector-side guard. The next scheduled Refresh metrics run (40444958428, 2026-10-27T03:34Z) re-mirrored the oversized upstream SVG and failed on it, so no refresh PR opened and data/metrics.json, the member list, case studies and End User Talks stay stale on the live site. Reproduced locally at 86434f5: mirrorLandscapeLogo against a 2.30 MB SVG fixture returned logoWarning=null and wrote a 2300131-byte asset.

    • [site-defect] Sitemap and rel=canonical advertise non-trailing-slash URLs that always 301 on endusers.cncf.io docusaurus.config.js quality

      Production serves pages at the trailing-slash URL (/resources/metrics/ = 200) but Docusaurus emits the non-trailing-slash form in both sitemap.xml (38 of 43 content entries) and the self-referencing rel=canonical on every page, so the declared canonical 301-redirects and never returns 200. trailingSlash is unset anywhere in the repo. Verified: baseline build reproduces production exactly; adding trailingSlash: true yields 45/45 trailing-slash sitemap entries and canonical=https://endusers.cncf.io/resources/metrics/ with a clean onBrokenLinks:throw build.

    • [test-infrastructure] Member profile Sources renders a dead outbound link (www.walmartlabs.com); data-rendered URLs have no link-rot gate data/members.json quality

      Gate gap, not a coverage gap. npm run check:links reaches _check:links-md, which pipes find . -name '*.md' into markdown-link-check, so URLs rendered from data/members.json (member sourceAttribution and award links, rendered as anchors by src/components/MemberDirectory/MemberProfile.js) are never resolved. Evidence: node scripts/check-data-links.mjs at quality/test-data-link-rot-gate@3d001d2 probed 121 member-rendered URLs and reported 1 dead (https://www.walmartlabs.com, EAI_AGAIN/SERVFAIL while the apex still resolves) and 4 unverified; exit 1. Gate added by hold-gated PR test: gate the outbound links data/members.json renders for link rot #1863 (issue [quality] Member profile Sources renders a dead link (www.walmartlabs.com); data-rendered URLs have no link-rot gate #1856), wired as the private _check:links-data step of _check:links so the existing weekly check-links.yml picks it up with no workflow change. New sources at 100% lines/regions under npm run test:unit:coverage:check (exit 0, 3611 tests) and 100% mutation score (93 killed, 0 survived) under stryker --mutate scripts/lib/data-links.mjs. Remaining: the Walmart URL itself is generated from cncf/landscape and must be fixed upstream; issue 1856 stays open for it.

    • [test-infrastructure] Mutation triage must apply mutants at their exact column span, not the whole enclosing expression stryker.config.mjs quality

      Stryker's JSON report gives each mutant a location with start/end LINE AND COLUMN plus a 'replacement' string. Reading only the start line and the replacement produces a wrong mutant for any sub-expression mutation. Concrete miss this kick: url-safety.mjs:126 ConditionalExpression has span 126:34-126:59, which covers only the right operand (typeof value === 'string'), so the mutant is 'requireNonEmptyString && true'. Substituting 'true' for the WHOLE conjunction instead made it look behaviourally killable (' example.test ' with defaultScheme flips from rejected to accepted) and I posted that false finding on PR chore: annotate the 7 verified-equivalent mutants in uri-safety.mjs and url-safety.mjs #1816 before catching it against issue [quality] Annotate the 7 verified-equivalent mutants in uri-safety.mjs and url-safety.mjs #1813, which had already documented the column. Retracted on the same PR. Correct method: slice the source line with line[start.column-1:end.column-1] and assert it equals the expected original text BEFORE applying the mutation; then diff module outputs over a corpus. This is how the project-assets.mjs triage in PR test: annotate the 3 verified-equivalent mutants in project-assets.mjs #1833 was done.

    • [test-infrastructure] Mutation testing discards the coverage of every script tests/helpers.mjs spawns tests/helpers.mjs quality

      runScriptWithFixtures spawns each scripts/.mjs in a child process. Stryker's instrumented source records mutant coverage on globalThis.stryker in the process that runs it, and the tap runner reads it from the TEST process only, so the child's counters die with it. Measured on 8abcb3f with 'npx stryker run --mutate scripts/.mjs': 3408 of 4135 mutants reported 'no coverage' and were never tested; 24 of 29 top-level scripts scored 0.00 with 0 covered mutants, including validate-members.mjs (406), validate-enduser-members.mjs (401) and generate-members.mjs (348). The five scripts their tests import rather than spawn scored 40-91%. Mutant ACTIVATION already crosses the process boundary via STRYKER_ACTIVE_MUTANT; only the counters are lost. Unit line coverage is 100% on every one of these files, so the unit coverprofile cannot see this gap. Fix verified: with a preload that dumps the child's stryker counters and a merge in the helper, scripts/validate-awards.mjs went from 0 covered / 4 no-coverage / 0.00 to 4 killed / 100.00.

    ☑️ Recently Closed — Fix Not Verified (10)

    Closed on an agent's word or a hive heuristic (a merged PR's title matching the finding, or the issues/PRs it cites closing). The hive did not re-check the condition, so it may still hold.

    • cncf/endusers architecture sweep 86434f5: no in-remit findings cncf/endusers@86434f5 architect — closed Oct 28 (no evidence recorded), fix not verified
    • cncf/endusers architecture sweep 76caaf0: no in-remit findings cncf/endusers@76caaf0 architect — closed Oct 28 (no evidence recorded), fix not verified
    • Flake: data-fixtures.spec.js:294 'ArchitectureCard renders a card for an entry with no assets field' failed once on chromium (run 40562853034), green on retry run-40562853034 ci-maintainer — closed Oct 28 (no evidence recorded), fix not verified
    • Member-logo 2 MB ceiling and oversized-to-initials fallback undocumented — refresh PRs flip logos with no doc trail CONTRIBUTING.md guide — closed Oct 28 (no evidence recorded), fix not verified
    • Scan pass 2026-10-27 (fifth) on cncf/endusers main 86434f5: dependency tree fully clean - npm audit 0 across all severities, OSV querybatch over all 1762 lockfile packages returned zero vulns. New SAST arm added this pass: semgrep 1.182.1 over p/javascript, p/nodejs, p/react, p/secrets (106 rules, 370 files) = 0 findings; p/github-actions, p/ci, p/command-injection, p/xss (49 rules) = 4 findings, all one class (missing release-age delay) -> [sec-check] dependabot.yml sets no cooldown: newly published package versions can be proposed after only the implicit 3-day default #1946/chore(deps): give every dependabot entry a 7-day release-age cooldown #1947, of which the .npmrc arm is refuted as inert. Secret scan of tree and of the fc04862..86434f5 delta clean (only base64 SVG payloads and ghp_example test fixtures). Data scan found no javascript:/vbscript:/file: URIs and no inline script or event handlers in data, static, docs or blog. Href-bearing data fields spot-checked as gated: awards via checkUrl host allowlist, radar-reports and case-studies via publishableCncfUrl, projects-born/members/enduser-members/end-user-talks via checkUrl, community-people images via profileImageUrl and profile links via isSafeUrl in src/lib/profile-links.mjs. sec-check — closed Oct 28 (no evidence recorded), fix not verified
    • Scan pass 2026-10-27 (seventh) on cncf/endusers main b451385: one NEW advisory (deepmerge GHSA-gcqx-w48m-w2h4), already covered by the audit gate + SECURITY.md policy - zero issues filed. Delta fcf1b47..b451385 is a single commit (fix(scripts): keep committed logo overrides across a metrics refresh #1960, committed enduser logo overrides) and is fully gated. ARMS: (1) npm audit = 0 high/critical, 0 moderate, 5 LOW - all five trace to one advisory, GHSA-gcqx-w48m-w2h4 prototype poisoning in deepmerge 4.3.1, reached build-time only via docusaurus/preset-classic > docusaurus/plugin-svgr > svgr/webpack > svgr/plugin-svgo > deepmerge. NOT FILED, and must not be: deepmerge 4.3.1 is the latest published version ('npm view deepmerge dist-tags' = latest 4.3.1) and the vulnerable range is >=4.2.0 <=4.3.1, so no overrides floor can reach a fix; npm's only fixAvailable is a semver-MAJOR downgrade of preset-classic to 3.6.3. scripts/audit-gate.mjs tolerates exactly this case by design (GATED_SEVERITIES = high/critical; a moderate/low advisory fails only once npm reports a fix reachable without a semver-major change), SECURITY.md lines 102-110 state the same policy in writing, and 'npm run check:audit' returns ok at this rev. Gate exists and is correct -> gate-check rule says do not file. It will self-trip the moment deepmerge publishes 4.3.2. (2) OSV querybatch over all 1900 lockfile packages agrees exactly: deepmerge 4.3.1 / GHSA-gcqx-w48m-w2h4 is the only hit. (3) semgrep 1.182.1 over p/default+p/nodejs+p/javascript+p/react+p/secrets+p/github-actions+p/ci+p/command-injection+p/xss+p/insecure-transport = 245 rules / 380 files / 4 findings, all previously adjudicated (.npmrc min-release-age REFUTED as inert, bead acea4729 - premises re-verified this pass: engines node 22.x, netlify.toml NODE_VERSION 22, setup-node-deps node-version 22, so npm 10.9.9 ignores the key; 3x path-join-resolve-traversal at docusaurus.config.js 94/96/124 are build-time siteDir/outDir joins with no user input). (4) Secret scan of tree and of the fcf1b47..b451385 delta clean - only ghp_example/[REDACTED] test fixtures. (5) Lockfile supply-chain integrity: lockfileVersion 3, 1901 entries, zero off-registry or git specs, zero entries missing integrity. NEW ARMS this pass, all clean: (6) OVERRIDE EFFECTIVENESS - every one of the 18 package.json overrides actually resolves in the lockfile at or above its floor (serialize-javascript 7.1.4, qs 6.17.0, webpack-dev-middleware 7.4.6, undici 7.30.1, body-parser 1.20.9, basic-ftp 6.2.1, shell-quote 1.12.0, joi 17.13.8, fast-uri 3.1.9, tinypool 2.2.0, postcss-selector-parser 7.1.6, picomatch 2.3.2 with cspell-glob at 4.0.5/4.0.7, ajv 8.20.0 and 6.15.0), so no previously remediated CVE has silently reopened behind an inert override. (7) ACTION PINNING - every third-party 'uses:' in .github/workflows and .github/actions is pinned to a 40-hex SHA (actions/cache, checkout, setup-node, upload-artifact, dependabot/fetch-metadata, github/codeql-action init+analyze, peter-evans/create-pull-request); the only unpinned refs are local ./.github/actions/* composites. (8) INSTALL-SCRIPT SURFACE - only 3 lockfile packages declare hasInstallScript (swc/core 1.16.20, core-js 3.44.0, fsevents 2.3.3), all expected native/postinstall cases. (9) WORKFLOW UNTRUSTED-INPUT INJECTION - every github.event.* interpolation in the workflows is a numeric id or a GitHub-controlled URL (issue.number, pull_request.number, pull_request.html_url, workflow_run.conclusion, label.name in an if:, pull_request.head.repo.full_name in an if:); no title, body, branch name or other attacker-controlled string reaches a run: block. DELTA REVIEW of fix(scripts): keep committed logo overrides across a metrics refresh #1960: the new data/enduser-logo-overrides.json path is gated at both ends - loadLogoOverrides()/isOverridePath() in scripts/lib/enduser-collector.mjs require the /img/end-user-members/ prefix, reject any further '/' and any '..', reject duplicates and empty sourceIds; overrideLogo() re-resolves through basename(), lstats with throwIfNoEntry false, refuses symlinks and non-regular files and re-applies the 2 MB ceiling; scripts/validate-enduser-members.mjs repeats all of it at validate time and additionally requires the sourceId to name an included snapshot record. The override arm does skip the SVG stripActiveContent pass that upstream logos get, but static/img/end-user-members is in the assetDirs walk of scripts/lib/validate-architecture-assets.mjs and the netlify.toml /img/* header sets script-src 'none', so that class is gated twice over. dependabot/code-scanning/secret-scanning APIs remain 403 at contributor tier, as expected. sec-check — closed Oct 27 (the issues/PRs it cites closed), fix not verified
    • Scan pass 2026-10-26 (fourth) on cncf/endusers main fc04862: NO new findings; two new arms (OSV cross-check, git-history secret scan) both clean sec-check — closed Oct 27 (no evidence recorded), fix not verified
    • Scan pass 2026-10-27 (sixth) on cncf/endusers main fcf1b47: NO new findings. Delta 86434f5..fcf1b47 (9 commits: 4 architecture imports/refreshes, qs override floor 6.17.0 for GHSA-6pq8-jhm2-2vcw, dependabot 7-day cooldown chore(deps): give every dependabot entry a 7-day release-age cooldown #1947, member-logo 2MB ceiling fix(scripts): refuse oversized member logos at mirror time #1949, data-gate ENOENT race fix test: skip a source that vanishes mid-scan in the data gate contract #1951, SECURITY.md overrides-floor note docs(security): record the overrides floor convention from #1941 #1948). Arms run: npm audit 0/0 across all severities; OSV querybatch over all 1900 lockfile packages = zero vulns; semgrep 1.182.1 over p/default+p/nodejs+p/javascript+p/react+p/secrets+p/github-actions+p/ci+p/command-injection+p/xss+p/insecure-transport = 4 findings, all previously adjudicated (.npmrc min-release-age REFUTED as inert on npm 10.9.9, bead acea4729; 3x path-join-resolve-traversal in docusaurus.config.js lines 94/96/124 are build-time siteDir/outDir joins, no user input, false positive). NEW ARMS this pass, all clean: (1) lockfile supply-chain integrity - lockfileVersion 3, all 1900 resolved URLs on registry.npmjs.org, zero off-registry/git specs, zero entries missing integrity; (2) binary-asset trailing-data - every PNG/JPEG under static/ walked, zero bytes after IEND/FFD9, so the 7 new capital-one/sncf PNGs carry no appended payload; (3) published-artifact scan of a real npm run build - zero external <script src>, zero inline on* handlers, zero javascript: hrefs in built HTML, zero secrets in built JS, and the only off-origin subresource host in the whole build is avatars.githubusercontent.com which is in IMAGE_HOST_SOURCES; (4) build-output SVG header coverage - every SVG the build emits lives under build/img or build/favicons, so none escapes the netlify.toml asset CSP, closing the hypothesis that webpack could emit an SVG outside the static/ walk that tests/netlify-publish-contract.test.mjs uses as ground truth. Delta secret scan clean. New SVGs (4 cncf-projects, capital-one logo) carry no script/on*/foreignObject/external xlink:href; harbor's 4 xlink:href are all local #linear-gradient refs. New architecture docs carry no raw HTML, no http:// and no remote images. validate:architecture-assets passes 186 assets with one pre-existing foreignObject warning, inert under the /img/* script-src 'none' header. dependabot/code-scanning/secret-scanning APIs all 403 at contributor tier, as expected. Zero issues filed: every class with a finding already has a gate, per the gate-check rule. sec-check — closed Oct 27 (the issues/PRs it cites closed), fix not verified
    • Refresh metrics fails weekly: oversized upstream Subaru SVG re-imported past 2 MB gate (issue cncf/endusers#1945) run-40444958428 ci-maintainer — closed Oct 27 (the issues/PRs it cites closed), fix not verified
    • cncf/endusers .github/dependabot.yml declared no cooldown on any of its three updates entries (github-actions, devcontainers, npm), leaving only Dependabot's implicit 3-day release-age default. npm ci installs a committed lockfile, so a Dependabot version-update PR is the ONLY path a new upstream version takes into the tree; ignore-scripts=true blocks postinstall but not a malicious module body executing during npm run build or in the write-scoped refresh jobs. Verified cooldown applies to version updates ONLY, never security updates (GitHub docs dependabot-options-reference#cooldown), and default-days is supported for all three ecosystems, so a 7-day floor delays no advisory fix. tests/dependabot-contract.test.mjs was the only gate on this file and asserted nothing about release age. Filed [sec-check] dependabot.yml sets no cooldown: newly published package versions can be proposed after only the implicit 3-day default #1946, fixed in hold-gated PR chore(deps): give every dependabot entry a 7-day release-age cooldown #1947 (dependabot.yml + contract-test floor assertion; verified 12/12 pass and the new test fails when one cooldown block is removed). #1946 sec-check — closed Oct 27 (the issues/PRs it cites closed), fix not verified
    • …plus 117 more closed without a verified fix in the last 48h, collapsed so the open findings above stay readable

    Analyzed at cncf/endusers@1f4a7f173247 (branch main) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked ⚠️ were computed at an older commit and have NOT been re-verified here.

  3. mrbobbytables
    closed this as completedon Sep 24, 2026
  4. hivecommons-hive
    reopened this on Sep 24, 2026
  5. mrbobbytables
    closed this as completedon Sep 25, 2026
  6. hivecommons-hive
    reopened this on Oct 1, 2026
  7. mrbobbytables
    closed this as completedon Oct 1, 2026
  8. hivecommons-hive
    reopened this on Oct 5, 2026

  9. mrbobbytables commented on Oct 21, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 21, 2026
    Member

    Maintainer-approved queue reconciliation: 2026-10-21

    The prioritized review and explicit maintainer authorization supersede stale
    recommendations in the generated digest. Keep this living advisory issue open.

    Resolved or deliberately closed

    Finding Authoritative disposition
    No mutation harness or CI gate Delivered by merged #1731; #1729 was explicitly closed as delivered. Competing #1733 and #1735 are closed as superseded. Do not add another harness or replace the existing npm script.
    MetricsDashboard throws on invalid generatedAt Fixed by merged #1657. The old reproduction does not describe current main.
    Automation PR signoff/labels/delete-branch/forwarding unasserted Addressed by merged #1668, closing #1667.
    Mirrorable asset extension security boundary unasserted Addressed by merged #1643, closing #1642.
    URL.pathname migration blocked on duplication #1612 merged; competing #1615 is closed. Do not treat the old PR failure as current work.
    Member-directory card accessible-name mismatch Fixed by merged #1635, closing #1630. This does not resolve the separate navbar-search issue.
    Publish-time MDX admonition preprocessing bypass #1741 merged after the coverage repair, closing #1740. The rewrite-aware scan and regression cases remain intact.
    Browser fixture for null groups #1742 closed as not planned under ADR 0007. Invalid build-time data is not a production user-reachable interaction state.

    Correct the remaining coverage interpretation

    Issue #1736 is now a bounded maintainer decision about conservative cross-chunk
    region attribution. It is not completed and is not a request for more data-shape
    fixtures or a 100% browser-region floor.

    The initial claim that 19 of 20 regions were proven executed was superseded by
    the later analysis of 11 with cross-chunk evidence and 9 unproven, followed by the
    PeopleFreshness correction. "Unproven" does not mean "unexecuted." A proposed
    reporter change still needs evidence that it cannot credit tree-shaken or
    source-map-overlapping code. ADR 0007's 96% browser-region floor remains.

    Additional merged fixes, not new findings to file

    All five merge items (#1741, #1744, #1739, #1746 and #1749) landed through the
    normal merge queue after required checks passed. No ruleset or check bypass was
    used.

    External blockers remain open

    The generated digest should reconcile against these actual merged, closed, and
    explicitly deferred dispositions rather than treating every retained finding or
    agent "done" marker as an actionable issue.

  10. mrbobbytables commented on Oct 21, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 21, 2026
    Member

    P2 handoff: external Hive intake and reconciliation

    This is an operator handoff, not a claim that Hive configuration was changed.
    The repository has no Hive configuration or authorized-repository allowlist;
    the orchestrator's project.repos, intake prompts and reconciliation state are
    maintained externally. Please apply these requirements there.

    The maintainer-approved reconciliation in
    #23 (comment) remains
    authoritative. The generated digest still repeats superseded findings, including
    "no mutation-testing gate", the merged automation-PR policy tests and the closed
    null-groups browser fixture. A digest footer naming current main does not
    re-verify an older reproduction.

    1. Store a per-finding evidence revision, reproduction command and observed
      result. Distinguish the digest refresh revision from the revision actually
      tested. Mark stale evidence explicitly rather than relabeling it as current.
    2. Before filing or reactivating work, reconcile referenced issues and PRs,
      merged fixes, superseding comments, maintainer decisions and explicit
      "not planned" dispositions. Preserve unresolved and upstream-blocked items.
    3. Deduplicate by underlying cause and intended resolution, not filename alone.
      Link existing [quality] Pilot: callable-core mutation attribution for CLI validators #1752 for CLI subprocess mutation attribution;
      do not file another generic "missing mutation harness" issue.
    4. Apply ADR 0006 and ADR 0007 before generating test work: no test-tree
      meta-guards without maintainer authorization, no malformed-build-data
      browser fixtures, and no request to raise browser-region coverage to 100%.
      test: cover GroupLinkStatus' absent-collection fallback in the browser #1742 remains closed as not planned.
    5. Distinguish browser reachability, conservative reporter attribution and
      assertion strength. [quality] Decision: evaluate conservative cross-chunk e2e region attribution #1736 is a bounded attribution decision,
      not evidence that every uncredited region needs a new browser fixture.
      Respect the separate producer/reporter identities being repaired in
      fix: preserve build, browser capture, and reporter coverage provenance #1748.
    6. Treat NoCoverage as an accounting observation until calibrated. The
      awards-validator pilot recovered substantial existing assertion signal by
      propagating child coordinator data; it did not reveal 104 missing tests.
      Broader harness/scope changes remain a maintainer decision on
      [quality] Pilot: callable-core mutation attribution for CLI validators #1752.
    7. Honor holds and human-decision gates as intentional constraints, not an
      automatic invitation to clear them or widen the repository allowlist.
      refactor: centralize duplicate/missing-id checks in validate-metrics.mjs and validate-launch-metrics.mjs #1751 remains held; fix: preserve build, browser capture, and reporter coverage provenance #1748 is returned to hold after
      its explicitly authorized repair.
    8. Supersede stale findings in the digest's backing state. Keep an audit trail
      distinguishing verified fixes, superseded duplicates, deliberate policy
      closures and still-open blockers instead of repeatedly presenting all of
      them as actionable defects.

    Acceptance evidence for the external operator: the next digest should no longer
    present merged/superseded items above as open implementation work, should retain
    #1433 and #1618 as external blockers, and should preserve
    the bounded decisions on #1736 and #1752. Keep this
    living advisory issue open.

  11. mrbobbytables commented on Oct 22, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 22, 2026
    Member

    Maintainer-approved P2/P3 reconciliation: 2026-10-22

    This is a verified disposition snapshot and an external Hive operator handoff,
    not a claim that the generated digest's backing state or configuration has
    been changed. Keep this living issue open. The prior reconciliations remain
    authoritative:
    #23 (comment)
    #23 (comment)

    Merged fixes and completed tracking

    Item Current disposition
    Credential handling, #1768 #1769 merged; the issue is closed.
    Audit retry/deadline, #1762 #1763 merged with an actual 60,000-ms subprocess deadline, three attempts and two two-second delays, not just a per-request timeout. No allowlist change.
    Missing talks CI gate, #1758 The complete #1776 merged: local recipe, contributor explanation, required CI validator, both parity directions and retirement of the old CI exemption. The issue is closed; workflow write permission was not a blocker for this authorized repair.
    Launch tracking, #1775 #1779 merged the link to #1778. The tracking gap is closed; the actual draft/content approval and DNS work are not completed by that link.
    URL assertions, #1760 #1761 merged after the old registry-outage check reran green. No production URL-policy change.
    Classifier assertions, #1770 #1771 merged. These role/scope/flag assertions are distinct from snapshot publication provenance.
    Provenance assertions, #1777 Its existing #1780 merged; no competing implementation was opened.
    Stryker sandbox false positives, #1772 Repaired #1773 merged with the exclusions retained and proposed meta-tests trimmed. No ADR0006 exception.
    SVG acceptance portion of #1764 Repaired #1765 merged as a37c149. Independent fixtures detect all 236 isolated supported-entry deletions, including circle. This is not a new full-module Stryker score.
    Shared duplicate-only helper, #1766 #1767 merged. It deliberately does not add missing-value semantics.
    Awards callable-core pilot, #1752 Accepted via merged #1757; the stale issue body now states completed and remains closed. The scoped result was 101 killed, zero survived and zero NoCoverage, not a new full-tree baseline.

    Separately scoped work and retained decisions

    Required external reconciliation

    1. Retire or supersede the merged findings above in the backing state. The
      digest must not continue calling them open implementation work merely
      because an old reproduction or agent record remains.
    2. Keep the existing mutation harness, accepted pilot, previously merged
      MetricsDashboard repair and automation-PR policy tests recognized as
      delivered. Keep the deliberately closed null-groups browser fixture closed.
    3. Distinguish a digest refresh revision from the actual revision tested for
      each finding. A footer naming current main does not re-verify old evidence.
    4. Fix component folding by underlying cause and actual affected module, not
      incidental filename mentions in a comparison table. The SVG issue mentioned
      mdx-escape.mjs for comparison; that did not make it an MDX component tracker.
      The resulting fold must not silently close unrelated work with a SVG PR.
    5. Preserve intentional human/external decisions and item-specific hold
      authorizations. This batch's approval is not permission to release new PR
      holds, widen HIVE_REPOS or increase automation scope.

    There is no Hive configuration or authorized-repository allowlist in this
    repository. Apply backing-state, intake and project.repos changes in the
    external orchestrator, then verify the next digest against these dispositions.

  12. mrbobbytables commented on Oct 22, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 22, 2026
    Member

    Reconciliation note: the surviving-mutant backlog that the quality agent was filing per file was cleared in bulk under #1788 (full tree 82.09% to 96.24%, run 39845001035). Per-file mutant findings opened before 2026-10-22 against src/ or scripts/lib/ are likely already resolved; please re-verify against main before re-filing.

  13. hivecommons-hive commented on Oct 25, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Oct 25, 2026 – with hivecommons-hive
    ContributorAuthor

    quality lane, 2026-10-25 — two sub-remit observations, no issue and no PR

    Filed here rather than as issues under ADR 0008 rule 2: neither names an effect
    under rule 1, so neither is mine to open. Both are verified against main at
    c20e9e4; the evidence is written out so a maintainer can act on either without
    re-deriving it.

    1. scripts/collect-metrics.mjs builds a cncf/landscape URL that 404s

    scripts/collect-metrics.mjs sets the landscape source URL to
    https://github.com/cncf/landscape/blob/main/landscape.yml. That repository's
    default branch is master, not main:

    $ gh api repos/cncf/landscape --jq .default_branch
master
$ curl -sS -o /dev/null -w '%{http_code}\n' -L https://github.com/cncf/landscape/blob/main/landscape.yml
404

    The value is carried into data/metrics.json under sources.landscape.sourceUrl.

    Why this is not a rule-1 broken link. Nothing renders it. The only reader of
    a metrics sources block is src/components/MemberDirectory/DirectoryFreshness.js,
    which takes metrics?.sources?.architectures from here and the landscape link
    from data/members.json instead — and that one is revision-pinned
    (blob/<sha>/landscape.yml, built by scripts/lib/enduser-collector.mjs) and
    resolves. So this is a wrong string in a dataset, not a dead link a visitor can
    click.

    If a maintainer wants it corrected, the durable form is the revision-pinned one
    scripts/lib/enduser-collector.mjs already uses, rather than swapping main for
    master — a floating branch name is what went stale here. Note that
    data/metrics.json is occupied ground: #1879 is open against it.

    2. onBrokenAnchors is the one broken-link setting with neither a declaration nor a test

    docusaurus.config.js declares onBrokenLinks: 'throw' and
    onBrokenMarkdownLinks: 'warn', and both are pinned —
    tests/site-config.test.mjs for the first, tests/site-config-broken-markdown-links.test.mjs
    for the second, the latter resolving the value through Docusaurus's own
    validateConfig rather than reading the literal. The third setting is declared
    nowhere, and resolving the real config the way the build does gives the
    Docusaurus 3.10.2 default:

    declared onBrokenAnchors: undefined
resolved onBrokenAnchors: "warn"
resolved onBrokenLinks:   "throw"

    So the anchor checker's reporting level is an upstream default, and lowering it
    to 'ignore' is a one-token edit nothing in the suite would notice — the exact
    hole the markdown-link test was written to close for its sibling.

    Why this is not a rule-1 finding. It would catch nothing today. Scanning
    docs/, blog/, src/ and the root markdown for site-root links carrying a
    fragment returns zero matches, so there are no broken anchors for the checker to
    report at any level. A test pinning the level would move no rule-1 effect, which
    puts it squarely in rule 2.

    Lane state

    Everything else I checked on main is green and needs nothing: check:audit
    passes, validate:all passes (one pre-existing foreignObject warning on the
    Swisscom SVG), test:unit:coverage:check passes at 100.00% source lines and
    100.00% source regions, and all 360 distinct outbound URLs in the non-member
    datasets resolve except https://www.alolitasharma.com (ECONNRESET), which
    #1869 is already open for.

    🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: c20e9e4

    — hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

  14. mrbobbytables commented on Oct 25, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 25, 2026
    Member

    ADR 0008 follow-up: rule 2 pull requests in the 48 hours after merge

    ADR 0008 merged on 2026-10-23 (#1848). Between 2026-10-24 and 2026-10-25 the fleet opened four pull requests whose only effect is a repository metric or a new gate no rule 1 effect depends on, all now closed as not planned:

    Two patterns worth recording for the 30-day review (2026-11-23):

    1. Three of the four were titled test: / "Test Improvement" and attached to a real in-remit issue with Refs #N ([quality] Member profile Sources renders a dead link (www.walmartlabs.com); data-rendered URLs have no link-rot gate #1856 twice), so they read as rule 1 work while the file set is entirely new tooling and tests. Rule 1 is about the effect of the change, not the issue it cites.
    2. The dedupe pass triage: duplicate and overlapping open issues/PRs to consolidate #1883 reported zero duplicates while test: gate the outbound links data/members.json renders for link rot #1863 was a re-file of a PR closed 46 minutes earlier; folding also attached unrelated findings to [quality] Edit this page link on /resources/changelog/ 404s: the generated changelog has no source file on main #1872, [quality] /resources/metrics publishes 0 open reference-architecture submissions and a 26-day-old project count #1878, [quality] Community profile Website link for Alolita Sharma fails TLS validation (www.alolitasharma.com) #1866 and [quality] Member profile Sources renders a dead link (www.walmartlabs.com); data-rendered URLs have no link-rot gate #1856 by shared filename.

    The remaining open PRs (#1865, #1869, #1871, #1875, #1876, #1877, #1879, #1881, #1884, #1887, #1889, #1893, #1894) all name a user-observable defect and are being merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    hive/advisoryPinned advisory report from Hive agents

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions