v5.164.0

Added

• Scheduled issue+PR duplicate-triage lane (#11582). The L5 and L6 packs now ship a dedupe agent (mode: ISSUES_ONLY, kicked every 24h in every governor mode) with a new dedupe-issues.md template. Once a day it reads every open issue and pull request in each repository — the hive's last-actionable.json snapshot plus gh search, since listing is denied to agents — verifies near-duplicates, same-root-cause clusters, PRs that fix an issue without referencing it, conflicting PRs and already-resolved items by reading both sides, and posts one consolidation checklist issue per repository in the shape of cncf/endusers#1283 and projectbluefin/dakota#1764 (Keep / Merge into it / Reason tables, task-list rows, a "Checked and not duplicates" list). The checklist is filed with --needs-decision so it stays out of the work queue, found again on later kicks by its hive:dedupe-checklist marker and updated in place with at most one delta comment, and nothing is posted when there is nothing to report. The lane is recommendation-only: it never closes, labels, merges or comments on the candidate items, complementing the reviewer's per-PR duplicate flag and the mechanical file-set PR sweep rather than repeating them.

Changed

• Human-filed issues receive at most one folded-finding comment, and subject-matched folds say so (#11681). When a scanner finding folds into an open human-filed issue, the watcher now checks the issue for the <!-- hive-finding-folded --> marker first and reuses the issue silently if a folded finding is already recorded, so reworded re-files across sweeps no longer add one comment per sweep (a failed lookup still comments). A fold matched by canonical subject now says it shares the subject instead of claiming the same file set (which also rendered an empty ()). Bot-filed file-set twins still get a comment per re-file (#9376).

Fixed

• Agent issue creates are now idempotent across the scan→create window (#11579, part of #11239). The mutation-boundary claim guarding CreateIssue was keyed on the exact title, so two agents filing the same finding seconds apart with different model-authored titles both passed the open-issue scan and both created. The claim is now keyed on the finding's canonical subject plus its file-reference set — body and agent labels no longer mint a fresh operation — within a 24h idempotency window (the previous window is probed too, so a pair straddling the window boundary still resolves to one issue), and a replayed create hands the caller the journaled issue (reported AlreadyExisted) instead of a zero number. The advisory living-issue create runs under the same boundary, so two concurrent EnsureAdvisoryIssue callers whose searches both came back empty no longer both create. The bounded open-issue scan window and the static ubiquitous-path list are now documented in place with their trade-offs; the upstream-watch filer already checked the <!-- upstream-ref --> marker on GitHub before every create (Watch.handle), which is now stated at the create site.
• Fixed the hub stable-promotion evaluator timing out on every GitHub runs fetch (5s per page over thousands of docker.yml runs): one overall fetch deadline, early stop at the current stable's PromotedAt, truncated fetches no longer drive eligibility, and the WARN is logged once per transition (#11684).
• Repo cards on the Projects view line up again (#11702): the auto-merge label and switch no longer float above the repo name, the N MATCHING pill, drag grabber and swarm/pause chips (a settings-form margin-bottom was leaking onto the toggle); a long repo name such as hivecommons/hivecommons.github.io now truncates with an ellipsis instead of pushing the toggle off the card or wrapping the chips onto a second line; and the ISSUES / N outside Overview bands chips in the card footer are centred on one line like the issue and PR pill rows above them.
• The sentinel sweep no longer re-applies a sentinel-alert label a maintainer removed. The "do not re-apply until a new push" promise was kept only in an in-memory head map, so the first pass after a hub restart re-evaluated the unchanged head and re-labelled the cleared PR (seen on #11614). The sweep now treats "blocking alert comment for this head present, label absent" as the maintainer's clearance and leaves the PR alone until the head changes; a trusted-author notice for the head is not read as a clearance, so turning on sentinel.trusted_authors_block still labels it.
• Make native/shared-UID guide auth diagnostics actionable and honor GH_HOST when the native gh auth login fallback authenticates GitHub Enterprise hosts.
• Entrypoint UID-isolation no longer aborts on an empty or truncated persisted /data/.hive/uid-map.json; it rebuilds from directory ownership and fsyncs the map before the atomic rename, so a node crash can no longer leave every later boot on the shared dev UID with no per-agent GitHub token.

---

SBOMs: SPDX JSON, generated by Syft against the linux/amd64 image digest, attached below for hive, hive-contributor, and hive-hub. They cover linux/amd64 only — see releases.md for why linux/arm64 is not scanned separately.

NOTICE: third-party license attribution for the Go module dependencies compiled into these images, attached below. Does not cover base-image OS packages or the Node.js/tmux layers built from source — see releases.md for the exact boundary.