Skip to content

🐝 Hive Advisory Report #23

Open
Open
🐝 Hive Advisory Report#23
Labels
hive/advisoryPinned advisory report from Hive agents

Description

@hivecommons-hive
hivecommons-hive
bot
opened on Aug 5, 2026

This issue collects advisory findings from Hive agents.

At lower ACMM levels, some agents work in advisory mode — they analyze code and post findings here but do not create issues or PRs. At higher levels, designated agents (e.g. quality) can open issues and PRs directly, while other agents remain advisory-only.

The governor posts periodic digest comments summarizing what advisory agents found.

Do not close this issue. It is a living document.

— hive: agent=governor

Activity

  1. hivecommons-hive
    added
    hive/advisoryPinned advisory report from Hive agents
    on Aug 5, 2026

  2. hivecommons-hive commented on Aug 7, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Aug 7, 2026 – with hivecommons-hive
    ContributorAuthor

    🐝 Advisory Digest — 2026-10-31 17:10 EDT

    Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

    Advice

    Frozen for governor mode IDLE until 2026-11-07 (next review in 7 day(s)). The list of recommendations is frozen; their numbers, items and links are recomputed on every digest.

    Counts quoted: governor actionable queue 1 PRs / 0 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 1 open PRs / 0 open issues (every open or held item across repo cards; the queue-health advice counts these).

    • Reduce the blocked PR queue — No longer applies: the signal that triggered this advice has cleared since the epoch began.
    • Widen HIVE_REPOS — The governor's actionable backlog is shallow in a low-pressure mode; adding repositories can feed more work to the hive. (signals: mode=IDLE, repo_count=1, governor_queue_total=1)

    Findings: 10

    💡 Showing top 10 findings (by severity). 539 more exist. Set governor.advisory.show_all: true to see all.

    Severity Count
    🟠 high 10

    🟠 HIGH (10)

    • [advisory] main is red on the required Lint repository check: docs/community/user-groups/telecom/index.md fails npm run check:format docs/community/user-groups/telecom/index.md quality
    • [broken-link] Research User Group page deep-links CNCF Slack workspace; signed-out readers hit a 403 sign-in wall docs/community/user-groups/research/index.md quality

      docs/community/user-groups/research/index.md:40 (merged 93c38f7, docs: add Research User Group #1996, 2026-10-29) links the channel as https://cloud-native.slack.com/archives/CTW1NRLBW. Verified with curl: that URL answers 302 to https://cloud-native.slack.com/?redir=... which answers 403 to an anonymous client, three times in a row. Public-sector, telecom and platform-engineering all link https://slack.cncf.io/ (the open invite page) and name the channel in text. Secondary effect: the weekly check-links workflow (.github/workflows/check-links.yml, last green run 40270211879 on 2026-10-26, before the merge) reports '1 dead link found' on this URL, so it goes red on main at its next scheduled run. Fix aligns the page with its three siblings and adds a guard in tests/community-group-coverage.test.mjs.

    • [content-defect] Argo is split into three options in the /architectures CNCF project filter data/architectures/catalog.json quality

      The 'Filter by CNCF project' select on /architectures and /community/members offers one option per distinct projects string and matches on exact equality. Six of the ten catalog records use the CNCF Argo project, but they label it three ways: Argo (adobe, allianz, cern-scientific-computing), ArgoCD (sncf-onprem, swisscom-kubernetes-service) and Argo Workflows (flipkart-chaos-engineering). Each option returns only its own subset. The pages' own CNCFProjectCard tags all link these labels to https://www.cncf.io/projects/argo/, so the split is a labelling difference, not three projects. Fixed by normalising the front matter labels to Argo and gating the class with a contract test that compares labels by the cncf.io project the pages link them to.

    • [missing-workflow] Content-only CI path skips the document-contract suites that guard authored docs (adr-contract, root-docs-links) .github/workflows/ci.yml quality

      Re-verified at cncf/endusers main c686990 on a clean npm ci tree (2026-10-30). The focused trio (docs-contract, markdown-references, community-group-coverage) reports tests 19 / pass 19 / fail 0 with an unindexed adr/0012-example-decision.md present, while node --test tests/adr-contract.test.mjs on the same tree reports tests 13 / pass 12 / fail 1, 'every number-prefixed ADR file is listed in the index'. The proposed 16-suite list runs tests 134 / pass 134 / fail 0 in 1.26s, so the focused path stays fast. Filed as cncf/endusers#2002. DUPLICATE ROOT CAUSE with cncf/endusers#2003 (sec-check lane, same step, CONTENT-SECURITY.md as the motivating document); the two were cross-linked on [quality] Content-only CI path skips the document-contract suites that guard authored documents #2002 on 2026-10-30 and one edit to the 'Check content contracts' step closes both. NOT PUSHABLE by any contributor-tier lane: the whole fix lives in .github/workflows/ci.yml and that tier is minted without the Workflows permission, so it needs a human or an ISSUES_PRS_MERGE agent. [sec-check] Content-only CI path skips the contract tests that hold CONTENT-SECURITY.md to the gates it documents #2003's non-workflow half is already open as PR fix(docs): describe the advisory and browser gates as full-validation only #2004 and does not overlap.

    • [regression-risk] /members lists ExternalDNS twice and shows SNCF under the stale name External-dns: data/members.json was not regenerated after the 🐛 fix(architectures): list ExternalDNS once in the catalog project filter #1991 catalog fix data/members.json quality

      cncf/endusers main cbffa80. PR 🐛 fix(architectures): list ExternalDNS once in the catalog project filter #1991 (e2f5f26, 2026-10-29) normalised ExternalDNS in data/architectures/catalog.json but did not regenerate the dependent artifact data/members.json, which scripts/generate-members.mjs derives from that catalog. Unit evidence: 'npm run generate:members' on main produces exactly one content change (sncf projects 'External-dns' -> 'ExternalDNS'); remaining diff is Prettier formatting. End-to-end evidence: not applicable - this is stale committed data, not an unexercised code path; the /members page renders members.json directly. User-observable: /members 'Filter by CNCF project' lists both 'ExternalDNS' (Swisscom) and 'External-dns' (SNCF); selecting ExternalDNS omits SNCF; SNCF's card contradicts /architectures/sncf-onprem. Gate gap: tests/generate-members.test.mjs tests the generator against synthetic fixtures and tests/members-data.test.mjs pins only member name ordering - nothing reconciles committed members.json against committed catalog.json, so the half-update passed every required check. Weekly refresh-members.yml (cron 47 3 * * 2) self-heals the value but is not a gate. Filed as cncf/endusers#2014 with the regeneration command and the reconciliation test; issue-only because part of the fix is regenerated data, outside the quality lane's PR scope.

    • [regression-risk] /resources/metrics publishes a submissions chart ending at 11 against a card of 10; no gate on committed metrics data data/metrics.json quality

      data/metrics.json at main (generatedAt 2026-10-29T15:35:49.162Z, refreshed by chore: refresh metrics #1989) predates the collector fix in fix(metrics): count only published architectures in the submissions series #1992 (merged 17:03Z). The reference-architectures card reads 10 while series.referenceArchitectures ends at {date 2026-10, value 11}, both rendered on /resources/metrics by src/components/MetricsDashboard. scripts/validate-metrics.mjs checks series shape only (lines 130-149) and has no card/series agreement check, so the committed artifact passes the required Validate CI job while contradicting itself. Refresh metrics runs weekly (cron 17 3 * * 2), so the contradiction stands until Tuesday unless a maintainer dispatches it.

    • [regression-risk] Refresh metrics lane aborts on an oversized upstream member logo, freezing /events talk schedule .github/workflows/refresh-metrics.yml quality

      Run 40444958428 (2026-10-27) failed at npm run test:unit (tests/validators-smoke.test.mjs -> validate-architecture-assets: static/img/end-user-members/fe60e14655aad3a6-subaru.svg 2.21 MB > 2 MB), so no refresh PR was opened and four datasets froze at 2026-10-24. Observable: /events shows three KubeCon NA 2026 sessions in 'Regency Ballroom B-D' where Sessionize now says 'Regency Ballroom CD', plus one speaker-name correction; verified by running npm run collect:end-user-talks on main e7ac6e8 at 2026-10-29 (83 talks, none added/removed, validate:end-user-talks passes). Filed as cncf/endusers#1980; fix lives in .github/workflows/refresh-metrics.yml so it needs a human to land.

    • [user-observable-defect] Industry filter splits one vertical: Financial vs Financial Services hides architectures and members docs/architectures/allianz/index.md quality

      Rendered build/architectures/index.html and build/community/members/index.html both list adjacent industry options 'Financial' (Allianz Direct) and 'Financial Services' (Capital One). ArchitectureFilters.filterArchitectures matches industries with exact equality, so each option returns one architecture and hides the other. Same symptom maintainers fixed for project names in PR 🐛 fix(architectures): list ExternalDNS once in the catalog project filter #1991. Fixed by normalising the Allianz front matter to 'Financial Services' and gating the catalog against word-subset industry labels.

    • [user-observable-defect] /resources/metrics labels a commit count as "Reference architecture submissions" scripts/collect-metrics.mjs quality

      architectureTimelineData() counts commits touching content/en/architectures and publishes the cumulative total as the 'Reference architecture submissions' chart on /resources/metrics. Any edit commit (typo, image swap, rename) increments it. Live data: chart ends at 28 for 2026-07 while the 'Reference architectures' stat card on the same page reads 8. Reproduced: the committed fixture in tests/collect-metrics.test.mjs has 2 architecture directories and 3 commits, and the pinned expectation is a series reaching 3.

    • [advisory] Semantic prompt injection classifier warn scanner

    ☑️ Recently Closed — Fix Not Verified (10)

    Closed on an agent's word or a hive heuristic (a merged PR's title matching the finding, or the issues/PRs it cites closing). The hive did not re-check the condition, so it may still hold.

    Analyzed at cncf/endusers@b684795cbe65 (branch main) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked ⚠️ were computed at an older commit and have NOT been re-verified here.

  3. mrbobbytables
    closed this as completedon Sep 24, 2026
  4. hivecommons-hive
    reopened this on Sep 24, 2026
  5. mrbobbytables
    closed this as completedon Sep 25, 2026
  6. hivecommons-hive
    reopened this on Oct 1, 2026
  7. mrbobbytables
    closed this as completedon Oct 1, 2026
  8. hivecommons-hive
    reopened this on Oct 5, 2026

  9. mrbobbytables commented on Oct 21, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 21, 2026
    Member

    Maintainer-approved queue reconciliation: 2026-10-21

    The prioritized review and explicit maintainer authorization supersede stale
    recommendations in the generated digest. Keep this living advisory issue open.

    Resolved or deliberately closed

    Finding Authoritative disposition
    No mutation harness or CI gate Delivered by merged #1731; #1729 was explicitly closed as delivered. Competing #1733 and #1735 are closed as superseded. Do not add another harness or replace the existing npm script.
    MetricsDashboard throws on invalid generatedAt Fixed by merged #1657. The old reproduction does not describe current main.
    Automation PR signoff/labels/delete-branch/forwarding unasserted Addressed by merged #1668, closing #1667.
    Mirrorable asset extension security boundary unasserted Addressed by merged #1643, closing #1642.
    URL.pathname migration blocked on duplication #1612 merged; competing #1615 is closed. Do not treat the old PR failure as current work.
    Member-directory card accessible-name mismatch Fixed by merged #1635, closing #1630. This does not resolve the separate navbar-search issue.
    Publish-time MDX admonition preprocessing bypass #1741 merged after the coverage repair, closing #1740. The rewrite-aware scan and regression cases remain intact.
    Browser fixture for null groups #1742 closed as not planned under ADR 0007. Invalid build-time data is not a production user-reachable interaction state.

    Correct the remaining coverage interpretation

    Issue #1736 is now a bounded maintainer decision about conservative cross-chunk
    region attribution. It is not completed and is not a request for more data-shape
    fixtures or a 100% browser-region floor.

    The initial claim that 19 of 20 regions were proven executed was superseded by
    the later analysis of 11 with cross-chunk evidence and 9 unproven, followed by the
    PeopleFreshness correction. "Unproven" does not mean "unexecuted." A proposed
    reporter change still needs evidence that it cannot credit tree-shaken or
    source-map-overlapping code. ADR 0007's 96% browser-region floor remains.

    Additional merged fixes, not new findings to file

    All five merge items (#1741, #1744, #1739, #1746 and #1749) landed through the
    normal merge queue after required checks passed. No ruleset or check bypass was
    used.

    External blockers remain open

    The generated digest should reconcile against these actual merged, closed, and
    explicitly deferred dispositions rather than treating every retained finding or
    agent "done" marker as an actionable issue.

  10. mrbobbytables commented on Oct 21, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 21, 2026
    Member

    P2 handoff: external Hive intake and reconciliation

    This is an operator handoff, not a claim that Hive configuration was changed.
    The repository has no Hive configuration or authorized-repository allowlist;
    the orchestrator's project.repos, intake prompts and reconciliation state are
    maintained externally. Please apply these requirements there.

    The maintainer-approved reconciliation in
    #23 (comment) remains
    authoritative. The generated digest still repeats superseded findings, including
    "no mutation-testing gate", the merged automation-PR policy tests and the closed
    null-groups browser fixture. A digest footer naming current main does not
    re-verify an older reproduction.

    1. Store a per-finding evidence revision, reproduction command and observed
      result. Distinguish the digest refresh revision from the revision actually
      tested. Mark stale evidence explicitly rather than relabeling it as current.
    2. Before filing or reactivating work, reconcile referenced issues and PRs,
      merged fixes, superseding comments, maintainer decisions and explicit
      "not planned" dispositions. Preserve unresolved and upstream-blocked items.
    3. Deduplicate by underlying cause and intended resolution, not filename alone.
      Link existing [quality] Pilot: callable-core mutation attribution for CLI validators #1752 for CLI subprocess mutation attribution;
      do not file another generic "missing mutation harness" issue.
    4. Apply ADR 0006 and ADR 0007 before generating test work: no test-tree
      meta-guards without maintainer authorization, no malformed-build-data
      browser fixtures, and no request to raise browser-region coverage to 100%.
      test: cover GroupLinkStatus' absent-collection fallback in the browser #1742 remains closed as not planned.
    5. Distinguish browser reachability, conservative reporter attribution and
      assertion strength. [quality] Decision: evaluate conservative cross-chunk e2e region attribution #1736 is a bounded attribution decision,
      not evidence that every uncredited region needs a new browser fixture.
      Respect the separate producer/reporter identities being repaired in
      fix: preserve build, browser capture, and reporter coverage provenance #1748.
    6. Treat NoCoverage as an accounting observation until calibrated. The
      awards-validator pilot recovered substantial existing assertion signal by
      propagating child coordinator data; it did not reveal 104 missing tests.
      Broader harness/scope changes remain a maintainer decision on
      [quality] Pilot: callable-core mutation attribution for CLI validators #1752.
    7. Honor holds and human-decision gates as intentional constraints, not an
      automatic invitation to clear them or widen the repository allowlist.
      refactor: centralize duplicate/missing-id checks in validate-metrics.mjs and validate-launch-metrics.mjs #1751 remains held; fix: preserve build, browser capture, and reporter coverage provenance #1748 is returned to hold after
      its explicitly authorized repair.
    8. Supersede stale findings in the digest's backing state. Keep an audit trail
      distinguishing verified fixes, superseded duplicates, deliberate policy
      closures and still-open blockers instead of repeatedly presenting all of
      them as actionable defects.

    Acceptance evidence for the external operator: the next digest should no longer
    present merged/superseded items above as open implementation work, should retain
    #1433 and #1618 as external blockers, and should preserve
    the bounded decisions on #1736 and #1752. Keep this
    living advisory issue open.

  11. mrbobbytables commented on Oct 22, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 22, 2026
    Member

    Maintainer-approved P2/P3 reconciliation: 2026-10-22

    This is a verified disposition snapshot and an external Hive operator handoff,
    not a claim that the generated digest's backing state or configuration has
    been changed. Keep this living issue open. The prior reconciliations remain
    authoritative:
    #23 (comment)
    #23 (comment)

    Merged fixes and completed tracking

    Item Current disposition
    Credential handling, #1768 #1769 merged; the issue is closed.
    Audit retry/deadline, #1762 #1763 merged with an actual 60,000-ms subprocess deadline, three attempts and two two-second delays, not just a per-request timeout. No allowlist change.
    Missing talks CI gate, #1758 The complete #1776 merged: local recipe, contributor explanation, required CI validator, both parity directions and retirement of the old CI exemption. The issue is closed; workflow write permission was not a blocker for this authorized repair.
    Launch tracking, #1775 #1779 merged the link to #1778. The tracking gap is closed; the actual draft/content approval and DNS work are not completed by that link.
    URL assertions, #1760 #1761 merged after the old registry-outage check reran green. No production URL-policy change.
    Classifier assertions, #1770 #1771 merged. These role/scope/flag assertions are distinct from snapshot publication provenance.
    Provenance assertions, #1777 Its existing #1780 merged; no competing implementation was opened.
    Stryker sandbox false positives, #1772 Repaired #1773 merged with the exclusions retained and proposed meta-tests trimmed. No ADR0006 exception.
    SVG acceptance portion of #1764 Repaired #1765 merged as a37c149. Independent fixtures detect all 236 isolated supported-entry deletions, including circle. This is not a new full-module Stryker score.
    Shared duplicate-only helper, #1766 #1767 merged. It deliberately does not add missing-value semantics.
    Awards callable-core pilot, #1752 Accepted via merged #1757; the stale issue body now states completed and remains closed. The scoped result was 101 killed, zero survived and zero NoCoverage, not a new full-tree baseline.

    Separately scoped work and retained decisions

    Required external reconciliation

    1. Retire or supersede the merged findings above in the backing state. The
      digest must not continue calling them open implementation work merely
      because an old reproduction or agent record remains.
    2. Keep the existing mutation harness, accepted pilot, previously merged
      MetricsDashboard repair and automation-PR policy tests recognized as
      delivered. Keep the deliberately closed null-groups browser fixture closed.
    3. Distinguish a digest refresh revision from the actual revision tested for
      each finding. A footer naming current main does not re-verify old evidence.
    4. Fix component folding by underlying cause and actual affected module, not
      incidental filename mentions in a comparison table. The SVG issue mentioned
      mdx-escape.mjs for comparison; that did not make it an MDX component tracker.
      The resulting fold must not silently close unrelated work with a SVG PR.
    5. Preserve intentional human/external decisions and item-specific hold
      authorizations. This batch's approval is not permission to release new PR
      holds, widen HIVE_REPOS or increase automation scope.

    There is no Hive configuration or authorized-repository allowlist in this
    repository. Apply backing-state, intake and project.repos changes in the
    external orchestrator, then verify the next digest against these dispositions.

  12. mrbobbytables commented on Oct 22, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 22, 2026
    Member

    Reconciliation note: the surviving-mutant backlog that the quality agent was filing per file was cleared in bulk under #1788 (full tree 82.09% to 96.24%, run 39845001035). Per-file mutant findings opened before 2026-10-22 against src/ or scripts/lib/ are likely already resolved; please re-verify against main before re-filing.

  13. hivecommons-hive commented on Oct 25, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Oct 25, 2026 – with hivecommons-hive
    ContributorAuthor

    quality lane, 2026-10-25 — two sub-remit observations, no issue and no PR

    Filed here rather than as issues under ADR 0008 rule 2: neither names an effect
    under rule 1, so neither is mine to open. Both are verified against main at
    c20e9e4; the evidence is written out so a maintainer can act on either without
    re-deriving it.

    1. scripts/collect-metrics.mjs builds a cncf/landscape URL that 404s

    scripts/collect-metrics.mjs sets the landscape source URL to
    https://github.com/cncf/landscape/blob/main/landscape.yml. That repository's
    default branch is master, not main:

    $ gh api repos/cncf/landscape --jq .default_branch
master
$ curl -sS -o /dev/null -w '%{http_code}\n' -L https://github.com/cncf/landscape/blob/main/landscape.yml
404

    The value is carried into data/metrics.json under sources.landscape.sourceUrl.

    Why this is not a rule-1 broken link. Nothing renders it. The only reader of
    a metrics sources block is src/components/MemberDirectory/DirectoryFreshness.js,
    which takes metrics?.sources?.architectures from here and the landscape link
    from data/members.json instead — and that one is revision-pinned
    (blob/<sha>/landscape.yml, built by scripts/lib/enduser-collector.mjs) and
    resolves. So this is a wrong string in a dataset, not a dead link a visitor can
    click.

    If a maintainer wants it corrected, the durable form is the revision-pinned one
    scripts/lib/enduser-collector.mjs already uses, rather than swapping main for
    master — a floating branch name is what went stale here. Note that
    data/metrics.json is occupied ground: #1879 is open against it.

    2. onBrokenAnchors is the one broken-link setting with neither a declaration nor a test

    docusaurus.config.js declares onBrokenLinks: 'throw' and
    onBrokenMarkdownLinks: 'warn', and both are pinned —
    tests/site-config.test.mjs for the first, tests/site-config-broken-markdown-links.test.mjs
    for the second, the latter resolving the value through Docusaurus's own
    validateConfig rather than reading the literal. The third setting is declared
    nowhere, and resolving the real config the way the build does gives the
    Docusaurus 3.10.2 default:

    declared onBrokenAnchors: undefined
resolved onBrokenAnchors: "warn"
resolved onBrokenLinks:   "throw"

    So the anchor checker's reporting level is an upstream default, and lowering it
    to 'ignore' is a one-token edit nothing in the suite would notice — the exact
    hole the markdown-link test was written to close for its sibling.

    Why this is not a rule-1 finding. It would catch nothing today. Scanning
    docs/, blog/, src/ and the root markdown for site-root links carrying a
    fragment returns zero matches, so there are no broken anchors for the checker to
    report at any level. A test pinning the level would move no rule-1 effect, which
    puts it squarely in rule 2.

    Lane state

    Everything else I checked on main is green and needs nothing: check:audit
    passes, validate:all passes (one pre-existing foreignObject warning on the
    Swisscom SVG), test:unit:coverage:check passes at 100.00% source lines and
    100.00% source regions, and all 360 distinct outbound URLs in the non-member
    datasets resolve except https://www.alolitasharma.com (ECONNRESET), which
    #1869 is already open for.

    🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: c20e9e4

    — hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

  14. mrbobbytables commented on Oct 25, 2026

    @mrbobbytables
    mrbobbytables
    on Oct 25, 2026
    Member

    ADR 0008 follow-up: rule 2 pull requests in the 48 hours after merge

    ADR 0008 merged on 2026-10-23 (#1848). Between 2026-10-24 and 2026-10-25 the fleet opened four pull requests whose only effect is a repository metric or a new gate no rule 1 effect depends on, all now closed as not planned:

    Two patterns worth recording for the 30-day review (2026-11-23):

    1. Three of the four were titled test: / "Test Improvement" and attached to a real in-remit issue with Refs #N ([quality] Member profile Sources renders a dead link (www.walmartlabs.com); data-rendered URLs have no link-rot gate #1856 twice), so they read as rule 1 work while the file set is entirely new tooling and tests. Rule 1 is about the effect of the change, not the issue it cites.
    2. The dedupe pass triage: duplicate and overlapping open issues/PRs to consolidate #1883 reported zero duplicates while test: gate the outbound links data/members.json renders for link rot #1863 was a re-file of a PR closed 46 minutes earlier; folding also attached unrelated findings to [quality] Edit this page link on /resources/changelog/ 404s: the generated changelog has no source file on main #1872, [quality] /resources/metrics publishes 0 open reference-architecture submissions and a 26-day-old project count #1878, [quality] Community profile Website link for Alolita Sharma fails TLS validation (www.alolitasharma.com) #1866 and [quality] Member profile Sources renders a dead link (www.walmartlabs.com); data-rendered URLs have no link-rot gate #1856 by shared filename.

    The remaining open PRs (#1865, #1869, #1871, #1875, #1876, #1877, #1879, #1881, #1884, #1887, #1889, #1893, #1894) all name a user-observable defect and are being merged.

  15. hivecommons-hive commented on Oct 28, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Oct 28, 2026 – with hivecommons-hive
    ContributorAuthor

    quality lane, 2026-10-28 — full gate sweep clean, one sub-remit observation

    Filed here rather than as an issue under ADR 0008 rule 2: nothing below names an
    effect under rule 1.

    Sweep at origin/main 1f4a7f4. Every gate reproducible outside CI passes:

    gate result
    test:unit:coverage:check pass — src 100.00% lines / 100.00% regions, all files 99.71% / 96.82%
    check:format, check:lint, check:unused pass
    check:duplication pass — 35 clones against the 35 ceiling
    validate:all pass — only the pre-existing foreignObject warning on the Swisscom telco SVG
    _check:links-data pass — 463 URLs, 0 broken, 13 unverifiable (403 bot blocks / DNS)
    build:production + test:e2e 381 passed, 34 skipped, 1 sandbox-only failure (below)

    Observation (harness shape, rule 2). tests/e2e/focus-trap-trigger-unmounted.spec.js
    is the suite's slowest spec and carries no test.slow(). On this host it finishes
    in 33.7s, i.e. just past Playwright's 30s default, and fails as
    Tearing down "context" exceeded the test timeout on every attempt at the default
    timeout; its sibling member-directory specs run 22–30s on the same host and pass.
    The spec's own steps are not what is slow — scripted against the same build
    outside the runner, goto through context close totals under 1s — so this is host
    speed, not the test.

    It is not failing upstream and needs no change: the last 40 ci.yml runs are
    merge-queue green, and no recent run uploaded a flaky-specs.json artifact, so
    retries: 1 is not masking a flake either. Recording it only so the next agent
    that sees this spec red on a slow host recognises it as the environment and does
    not file it.

    Checked and not re-filed. The label-content-name-mismatch baseline in
    tests/e2e/accessibility.spec.js is accurate as written:
    docusaurus-plugin-search-local's SearchBar.jsx renders <SearchButton> with no
    translations prop, so neither buttonText nor buttonAriaLabel is reachable
    from docusaurus.config.js. Decided question, no new information, no issue.

    No issue and no pull request opened this run.

    🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 1f4a7f1

    — hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

  16. hivecommons-hive commented on Oct 29, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Oct 29, 2026 – with hivecommons-hive
    ContributorAuthor

    Re-verified 2026-10-29 aacacc1: ADR 0008 still binding, no in-remit strategic finding. Actionable queue is empty (0 open issues); the two open PRs (#1995, #1976) are maintainer-authored, not agent work. Milestones 1-5 all show 0 open issues (fully closed). Since the prior strategist sweep (Oct 26), PR #1841 (merged, this sweep) deleted ROADMAP.md, MILESTONES.md, data/milestones.json, and the milestone-creation workflow/tests outright — a maintainer decision to retire planning-doc infrastructure, not a gap to fill. Per ADR 0008 'decided questions stay decided,' strategist should not recreate ROADMAP.md or milestone docs for this repo. gh-1841,adr-0008

    🐝 Hive Agent: strategist | Instance: hosted-available-lke648397-260827-5n31 | SHA: aacacc1

    — hive: agent=strategist backend=copilot model=claude-sonnet-4-6 copilot=1.0.88

  17. hivecommons-hive commented on Oct 30, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Oct 30, 2026 – with hivecommons-hive
    ContributorAuthor

    Re-verified 2026-10-30 99eb7b9: no in-remit strategic finding this sweep.

    ADR 0008 still binding; #1841 (merged 2026-10-23) was the maintainer's explicit
    decision to delete ROADMAP.md, MILESTONES.md, data/milestones.json and
    every reference to them. Per "decided questions stay decided," strategist does
    not recreate planning-doc infrastructure for this repo.

    All five milestones (Phase 0 through Launch) still show 0 open issues via
    gh api repos/cncf/endusers/milestones. The two PRs open as of the prior
    sweep are resolved: #1995 merged, #1976 remains open and maintainer-authored
    (not agent work). 17 commits landed on main since the last strategist sweep
    (Oct 29), all routine content/metrics/CI work with no roadmap-shaped gap or
    adoption blocker surfaced.

    No issue and no pull request opened this run.

    🐝 Hive Agent: strategist | Instance: hosted-available-lke648397-260827-5n31 | SHA: 99eb7b9

    — hive: agent=strategist backend=copilot model=claude-sonnet-4-6 copilot=1.0.88

  18. hivecommons-hive commented on Oct 30, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Oct 30, 2026 – with hivecommons-hive
    ContributorAuthor

    quality lane, 2026-10-30 — production sweep clean, one sub-remit observation

    Swept main at 5b83c01. Filed here rather than as an issue or PR under
    ADR 0008:
    the one thing found is a consistency gap with no reachable user-visible effect today.

    What was checked (all clean)

    • npm run validate:all — all 13 validators pass (102 members, 155 landscape records, 83 talk links, 5 born projects, 4 theme backgrounds).
    • Production probe of https://endusers.cncf.io: every one of the 47 sitemap.xml URLs answers 200.
    • Every /img/cncf-projects/... and /img/architectures/... path referenced from docs/ and data/ resolves to a committed asset.
    • Every architectures[].id on a member profile (MemberProfile's /architectures/<id> links) has a page under docs/architectures/.
    • main workflow health: refresh-members, refresh-metrics, refresh-community-people, refresh-radar-reports, audit-schedule and check-links all green on their latest runs; no required check red on main.
    • Near-duplicate scan of every catalog and member filter dimension. The only hit is the Argo / ArgoCD / Argo Workflows triple in the project select, which is already covered by held PR 🐛 fix(architectures): list the Argo project once in the project filter #2022 — confirmed still live in the server-rendered /architectures/ HTML.

    Sub-remit observation: the tag select is the one filter comparator left unpinned

    #2016 pinned English collation at the eight filter-option builders
    (compareLabels, a.localeCompare(b, 'en')). The ninth list in the same
    function was not changed — useArchitectureFilterOptions still sorts the tag
    select with a bare tagKey(a).localeCompare(tagKey(b))
    (src/components/ArchitectureFilters/index.js), which uses the runtime's
    default locale rather than the pinned one.

    This is not the defect #2016 fixed: tagKey lowercases, so the lowercase
    block that motivated that PR cannot occur here. The only residual difference is
    that the build host and the visitor's browser could collate the list
    differently. Every current tag is [a-z0-9 ] after tagKey, and no locale
    orders that alphabet differently from en (the usual divergences — Danish/
    Norwegian aa, Swedish ö, German phonebook — need characters or digraphs no
    tag has), so there is nothing a visitor can observe today. Recording it only so
    the next reader of that function knows the omission was looked at rather than
    missed; worth a line if a non-ASCII tag ever arrives from upstream.

    — hive: agent=quality

    🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 5b83c01

  19. hivecommons-hive commented on Oct 31, 2026

    @hivecommons-hive
    hivecommons-hiveBot
    on Oct 31, 2026 – with hivecommons-hive
    ContributorAuthor

    [quality] Latent: /metrics numbers are formatted in the visitor's locale, not a pinned one

    Advisory only — this is not observable on the production site today, so per
    ADR 0008
    it gets this comment rather than an issue or PR. Recording it because the trigger
    is a data value crossing a threshold, not a code change, so it will arrive without
    anything in src/ being touched.

    What

    src/components/MetricsDashboard/index.js formats three user-visible numbers with
    no locale argument, so Intl resolves the host default:

    • :72 — `${card.value.toLocaleString()} ${card.suffix || ''}` (lifecycle cards)
    • :119 — {metric.value.toLocaleString()} (metric cards)
    • :165 — {series.values.at(-1)?.value.toLocaleString()} (chart range)

    The page is server-rendered once at build time (Node, en-US) and hydrated in the
    visitor's browser, where the host default is whatever the visitor's OS/browser is.

    Why it is latent, and what makes it live

    Grouping separators only appear at |value| >= 1000. Every value in
    data/metrics.json is currently below that:

    metrics: cncf-projects=259, reference-architectures=10
series endUserMembers last={ date: '2026-10-29', value: 649 }
series referenceArchitectures last={ date: '2026-10', value: 10 }
lifecycle cards: (none)

    Below 1000 every locale renders the same digits, so there is nothing to see. Once a
    value reaches 1000 the two sides disagree:

    en-US -> 12,345    de-DE -> 12.345    fr-FR -> 12 345

    endUserMembers is the one that will get there (649 and rising). At that point a
    non-en visitor gets markup that differs from the SSR HTML, which React 18 treats
    as a hydration mismatch for that subtree.

    Why the suites will not catch it

    tests/metrics-dashboard.test.mjs:120,263,352,375 and
    tests/e2e/metrics-dashboard.spec.js:101,238,314 build their expected strings with
    the same unpinned value.toLocaleString(), so expectation and subject move together
    in any locale. A guard would have to assert the pinned output literally.

    The repo already decided this question for dates

    src/components/shared/formatDate.js pins 'en-US' and writes down the same
    reasoning ("the site is built once (in UTC) and hydrated in the visitor's browser
    ... would ... mismatch the server-rendered text"), and src/components/shared/compareLabels.js:14
    pins 'en' after d760cde. These three calls are the remaining unpinned sites in
    src/. The fix is toLocaleString('en-US') at each; whether that is worth doing
    before a value crosses 1000 is the maintainers' call.

    Verified at 01ceee8 (npm run test:unit:coverage:check green, src 100% lines/regions).

    — hive: agent=quality

    🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 01ceee8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    hive/advisoryPinned advisory report from Hive agents

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions