v5.176.0

Added

• Expose the review gate settings in the dashboard Settings dialog (Features → Review gate): post review comments, webhook-triggered dispatch and its debounce, the pending review TTL and re-dispatch cap, the per-head review cap, the re-review cutoff, and the out-of-scope finding backlog toggle and cap, with YAML-key hints on the existing review controls (#11854).
• Settings → Security now edits the global agent_sandbox.* scalar settings (image, runtime, network mode, timeout, workspace dir, env allowlist) and the Kubernetes Job service account, TTL and workspace claim/mount.
• Settings → Security now edits the intent.* path-pattern and feature-signal lists (empty restores the built-in defaults, shown as placeholders) and shows YAML-key hints for the sentinel.* list settings.
• Added automatic Development-sidebar linking for fix PRs that target a non-default branch (e.g. v6 while v5 is the default): hive now calls GitHub's addCloseIssueReferences mutation for every same-repo Fixes #N reference when it opens such a PR, and for strong open PR claims during enumeration, so the issue list shows the linked-PR icon and count for release-line work (#11888).
• GET /api/evidence/summary aggregates stored review evidence bundles into outcomes by author kind, reviewer calibration and per-model accuracy, weekly sentinel hits and shadow-gate counts, with n and missing counts on every series; it is read-only and never affects merging (#12063).
• Evidence bundles now link reverts and follow-up fixes: when a merged PR's title or body says reverts/revert of or fixes/follow-up to/regression from a PR of the same repo merged in the previous 14 days, the new bundle records revert_of/followup_of and the earlier one reverted_by/followed_up_by (a change-failure-rate proxy; best-effort, never affects a merge). Fixes #12067.
• Durable attempted vs blocked agent GitHub write counters by intent tier and block reason, with a weekly series, persisted to /var/run/hive-metrics/write-counters.json and served read-only at GET /api/evidence/write-counters; no change to gating or auto-merge. Part of #12069.
• Pre-registration document for the Hive effectiveness study (src/docs/research/preregistration-2026-10.md): hypotheses H1–H7 including expected-negative H2/H5, metrics and sources, populations and exclusion rules, analysis plan, opt-in experimental arms, and a dated never-edit rule. Refs #12071, RFC #12062.
• Evidence: report-only monthly complexity and static-analysis snapshot package (pkg/evidence/complexity) writing /data/evidence/<org>/<repo>/complexity/<YYYY-MM>.json. Fixes #12072.
• Hub: owner-only GET /api/hub/evidence cross-hive evidence view and an optional heartbeat evidence summary that feeds new Fleet quadrant criteria (Trust delegation, Efficiency revert rate, Satisfaction override/follow-up rates). Refs #12080, RFC #12062.
• Evidence bundles gain an optional shadow block (review_gate.would_have_held, intent.would_have_blocked, with reason, tier, confidence and evaluated_at) for recording what shadow-mode gates would have done; bundles without it are byte-identical and merge behaviour is unchanged. Fixes #12103.
• Added intent.shadow (default false): while intent.enforce is off, both merge lanes (merge-eligible.json and the App self-merge sweep) evaluate intent verification as if enforced and record shadow.intent.would_have_blocked (+ reason, tier, confidence) on the PR evidence bundle and in the audit log. It never blocks a merge; enforce: true is unchanged. Fixes #12105.
• README gains a "Contributor relay" section explaining donated compute/tokens with no shared secrets and no forge permission changes (#12122).
• hive-gh: compact gh --json projections for pr view|list|checks, issue view|list and run view that keep every gate field (labels, author, head SHA, mergeable/merge state, review decision, check conclusions) and leave the full fetch one --full away; gh-wrapper and proxy denials are now one actionable line ending in a machine-readable reason=<code> (#12127, refs #12134).
• Token spend can now be read per issue, PR, and head SHA: the governor and review-swarm kick paths record which work each kick was launched for (/data/launch-attribution.jsonl, attached to the existing token collector), a cached join against the existing per-message usage timeline and price table serves GET /api/launch-cost (with a repeat-spend launches counter per ref and ?ref= filtering), and the dashboard Cost panel gains a "cost by work item" table. Attribution only — no new budget gate (#12128, refs #12134).
• Read-only widget token for the iPhone widget: hive owners create (or revoke) it from the dashboard's 📱 iPhone widget dialog, which shows a QR code that hands the hive URL and token straight to Scriptable, plus when the token was last used and a "Copy script URL" button. The token only authenticates GET /api/widget/summary (sent as X-Hive-Widget-Token), is stored hashed, and replaces the need for a GitHub token on the phone; hosted hives let that one path through the hub's auth gate. The dashboard also ships a web app manifest and apple-touch-icon, so a Home Screen bookmark is named "Hive" with the bee icon (#12147).
• Hub fleet widget: GET /api/hub/widget returns every hive you can see on the hub with its open and actionable issue/PR counts, agents and last heartbeat, plus fleet totals and history; the iPhone Scriptable widget gains a hub mode (widget parameter hub) showing fleet totals with sparklines, "N hives need you" and the hives with the most actionable work. Spokes now report total open issues and PRs in the heartbeat (#12148).
• Saved label filters and presets can be pinned to the dashboard sidebar: a Filters nav group shows each pinned filter with a live count across all projects and opens a cross-repo view of the matching issues and PRs grouped by repository, with the facet bar on top; Needs human is pinned by default (#12172).
• Projects cards gain a collapsible Filter section driven by a faceted label filter (labels, free-text terms with quoted phrases and -term exclusion, type/state/author facets, any/all toggle) with named saved filters persisted per hive in the browser; the built-in Needs human preset (hard-suppress labels, needs-signal and the hold labels, sourced from the server via labelPresets[] on /api/status) is selected by default (#12172).
• In-memory attempted vs blocked agent GitHub write counters in the proxy, keyed by ACMM mode and block reason (GitHubProxy.WriteCounts()); no change to gating or auto-merge. Part of #12069.
• contribute-k8s: optional HIVE_K8S_RUNTIME_CLASS sets runtimeClassName on the contributor workload (#12204)
• Added a github-actions[bot] PR takeover to automerge: when a trusted github-actions[bot] PR is stuck at required-check-missing because its pull_request workflows can never run, the hive App re-authors it as a signed-off hive/takeover-<n> PR and closes the original (auto_merge.bot_takeover.enabled, default on) (#12003).
• New hives start with the dashboard's non-critical cards collapsed (#12014): a browser with no persisted dashboard state shows Overview, Governor, Projects, Review, Approvals, Agents and Agent activity expanded and starts Throughput, Tokens, Cost, Advisory, Knowledge, Contributors, Inception, ACMM Eval, Diagnostics, Audit Log, Agent Logs, Strategy Lab and FAQ collapsed with their summaries visible. Browsers that already hold dashboard state are marked legacy and keep today's all-expanded default; an explicit expand/collapse always wins and round-trips through saved layouts, export/import and reset. The avatar menu's Layout section gains Expand all sections / Collapse all sections.
• Auto-merge gains a default-on contributor-lane tier (auto_merge.contributor_lane.*) that merges PRs produced by this hive's own contributor lane — linked issue carries the hive's hive:claim kind=contributor marker for the PR author — once CI is green on the current head for the soak window (default 120 minutes), the reviewer verdict approves (when a reviewer agent is configured), and Sentinel has no blocking finding. Skips are logged with distinct contributor-lane:* reasons; Settings → Features gets matching controls.
• Added hover help marks to the dashboard's GitHub API budget panel: "ETag hit rate" now explains that it is the share of cacheable REST GETs answered 304 Not Modified via a remembered ETag (free against the core rate limit, counted since process start), and "Core remaining" explains the hourly core limit, the bar's warn/critical colours, and the governor's conserve/critical behaviour when the budget runs low.
• Hive-curated good first issue advertising (good_first_issue.*, default off): a periodic sweep scores open, unclaimed issues, applies GitHub's canonical good first issue + help wanted labels to the few that qualify, and leaves one <!-- hive:gfi --> welcome comment pitched at contributors who bring their own coding agent — why hive chose it, a deep link to this hive's relay (/contribute?issue=<owner/repo>#<n>), the Fixes #n + DCO rules, and a paste-to-your-agent prompt. A hive agent starting the issue releases the label and marks the comment superseded; relay claims on labelled issues are counted as conversions on Settings → Features.
• Dashboard avatar menu gains 📱 iPhone widget, which hands the Scriptable widget script (now served by every spoke at /ios-widget/hive-widget.js) to Scriptable and runs its setup pre-filled with this hive's URL; reveals an App Store link when Scriptable is not installed.
• iPhone Home Screen widget for a hive (src/pkg/dashboard/static/ios-widget/hive-widget.js, docs in src/docs/ios-widget.md): open issues, open PRs, actionable issues and actionable PRs, each with a sparkline; small, medium and Lock Screen sizes; tap opens the hive. Runs in Scriptable and authenticates with a GitHub token through the hub's existing bearer auth-check, so no spoke or hub change is required.
• Expose issue close-on-merge, Jev, duplicate PR sweep, agent policy repo, PR follow-up window and re-entrant turn settings in the dashboard Settings dialog (Features tab).
• Expose data directories, standalone deployment, review evidence, GitLab/Gitea forge, token mint limits, design-first planning, supersession and compliance windows, swarm banner and tool approval inbox settings in the dashboard Settings dialog, and show YAML keys on the existing escalation, intent, sentinel, auto-merge and publication controls.
• Expose the long-running runs settings in the dashboard Settings dialog (Features → Experimental): stage checkpoints and the checkpoint wait timeout and severity, run triage minimum body length and clarification comment, the Spek recheck cadence, delta cap, discovery proxy and discovery limits, and the Flue, OMP and vibe-kanban external-execution modes, endpoint, workflow versions, project and state directory. The vibe-kanban MCP command is shown read-only (#11854).

Changed

• Changed the hive/covered-by-pr issue label to 🐝 covered by PR (hive amber). Hive renames the legacy label in place the first time it is needed in a repository, so issues that already carry it keep it without per-issue writes; readers (claim sync, close-on-merge backfill, dashboard done band) accept both spellings during the transition (#11888).
• dashboard: unique, section-specific sidebar nav icons (#12058)
• README and introduction now list Codex and Antigravity (replacing the retired Gemini CLI) among example agent CLIs (#12082).
• Troubleshooting and documentation-map now guide operators without host shell access to the admin MCP diagnostic reads for logs, startup output, request logs, agent terminals, kick logs, and crash/restart/memory evidence (#12119).
• The knowledge primer and Context7 fetches are now byte-capped the way code maps are: knowledge.primer.max_bytes (default 4096) bounds the rendered # Relevant Knowledge block per kick, dropping facts whole in rank order and ending with a visible … truncated: N facts / M bytes omitted (size cap) marker plus a scheduler log line; Context7 llms.txt bodies keep whole, topic-ranked snippets up to HIVE_CONTEXT7_MAX_TOTAL_BYTES (default 16 KiB; HIVE_CONTEXT7_MAX_SNIPPETS, HIVE_CONTEXT7_MAX_SNIPPET_BYTES) with the same marker and a log line. Nothing is ever clipped mid-entry. Closes #12124. Refs #12134.
• Kick prompts are now laid out static-first for provider prompt caching: the [agent:…] header, governor work-source rule, and every static seam (independent review, workflow push ceiling, formal quality, work tracker) precede the policy body, and the data-bearing seams (hold-gated PR coordination, fix-before-new blocks, PR follow-up handoff) plus REPO-SCOPED CADENCE TARGET / AUTHORIZED REPOS follow it in a fixed documented order. /clear, the random canary preamble (still first), and every mandatory seam are unchanged (#12125).
• Review swarm: the combined-perspectives kick now emits the shared review boilerplate (scope contract, read instructions, review-bot thread obligations, grounding, output schema, publish contract) exactly once under SHARED INSTRUCTIONS, followed by one short [perspective:<name>] section per perspective; the grounding budget is stated once for the session and the review-bot thread fetch is bounded to the finding plus the first few replies (comments(first:5)). Per-perspective verdicts, the review-bot thread contract and (repo, PR, head SHA, perspective) dispatch keying are unchanged. combined_perspectives stays opt-in (decision recorded in docs/review-swarm.md) and is now promoted as recommended in hive.yaml.example and the docs (#12126).
• The repo AGENTS.md block prepended to a kick is now capped at project.agents_md_max_bytes (default 8192, the same as the skills cap). The cap drops whole sections at #/## heading boundaries (or the whole file) — never a clipped rule — and when anything is dropped the kick carries a one-line ⚠️ AGENTS.md exceeded N bytes; sections omitted: … — read AGENTS.md … warning right after the precedence statement, and the scheduler logs the omitted sections. The precedence paragraph is shortened to one sentence (~0.5 KB from ~1.1 KB) with every pinned clause kept. Closes #12129. Refs #12134.
• prompt_source kick templates fetched from GitHub are now capped at 64 KiB (promptsrc.DefaultMaxPromptBytes, >2× the largest shipped template; HIVE_PROMPT_SOURCE_MAX_BYTES overrides) instead of 512 KiB, and a body over the cap is rejected whole rather than truncated: the kick falls back to the last successfully fetched copy, then the normal template chain, with a logged warning naming repo, path, size and cap, and the dashboard refuses to bake an over-cap source instead of writing a half-policy (#12130).
• Retro analysis and intent alignment model calls are now cached in bounded in-memory LRUs: retro keys on a hash of the deterministic finding set and skips the model only for an empty set; intent alignment keys on (head SHA, intent revision) and never short-circuits on the deterministic verdict. Cache hits/misses are logged and exposed via CacheStats() (#12131).
• The trajectory-review lane now skips a review only when the agent manager's own state proves the agent idle (turn ended or awaiting CI), no output has appeared since its last review, and the review is not overdue (at most 6 intervals between reviews); a stalled-but-running agent is always reviewed and the transcript is never used as a skip signal. Skips are logged with a reason, counted in the Trajectory Review panel, and exported as hive_trajectory_reviews_total / hive_trajectory_skipped_total on /metrics (#12132).
• Kick prompt size is now measured, not guessed: every rendered kick logs a kick rendered line with kick_bytes, the issue/PR counts listed versus open, and the active governor.kick_limits caps; a TestKickSizeMeasurement table renders the shipped scanner policy at representative backlogs and a guard pins what the lists may add at the default caps. The measurements (fixed policy cost 32.9 KiB; lists add ≤ 30.5 KiB at 100/50 on a 302-PR backlog) are documented under "Kick size and the list caps" in docs/operator-reference.md; the 100 / 50 defaults are unchanged because lowering them saves little and slows draining large automerge queues (#12133).
• docs: point admin MCP links at the v6 reference so the v5 link check passes (#12161)
• Hub landing page: hero headline, meta descriptions and the rotating carousel now carry the same plain-language Hive intro as the docs ("co-maintainer that never sleeps", three rules vs a terminal agent, ACMM L1→L6 limits in code, checks before and after, hub and spoke, contributor relay, project vs hosted service), one slide per idea with a link to the matching docs section; stale "autopilot"/"earned with coverage" framing and the Gemini-first agent list in the meta tags are gone.
• README, Hive introduction and the ACMM Policy Matrix page spell out ACMM as the AI Codebase Maturity Model on first use, with a short definition and the paper link.
• Experiment Lab (Strategy Lab) is now repo-only. The Governor / Repo / Both scope selector is gone, the lab shows repo-scope phases and the single repo research question, and the config dialog drops the Governor Research Question, Controllable Knobs, and Invariants sections. GET /api/nous/status always reports "scope": "repo", strips any phases.governor block, and derives researchQuestion from repoGoal only. PUT /api/nous/scope is kept for compatibility but accepts only "repo"; governor, both, or anything else returns 400. Governor wording was removed from the lab's UI, help text, and docs. Closes #12206.
• The dashboard's 🔗 Knowledge Sources modal now has room to breathe: it opens as a wide, fixed-height dialog (min(1480px, 94vw) × min(92vh, 1100px), body remains the single scroller) instead of a cramped 960px box, the Git Sources / Wiki Subscriptions / Documents / Context7 / Import Facts blocks sit in spaced section cards with consistent header, explainer and empty-state rhythm, the "▼ Add …" forms get a proper vertical gap and right-aligned action row, and the "+ New channel" button no longer wraps onto two lines. On phones (≤768px and the landscape tier) the two-column grid now folds to a single column inside the full-screen sheet — previously the columns stayed side by side and overflowed the viewport. The inline recipes moved into stylesheet classes, lowering the style ratchet baselines (inline style= 1559→1537, raw font-size 650→646, raw padding 223→222).
• The root README is now a plain-language landing page, with the Docker Compose, Podman, and Kubernetes walkthroughs moved into dedicated src/docs/ guides.
• Documentation links that still referred to root README quick-start anchors now point at the dedicated Docker Compose, Podman, and Kubernetes guide pages.
• The Settings dialog's Features tab is now organised into eight titled sections (#12032) instead of one flat list: Auto-merge, Review gate, Autonomy & ACMM, Work intake & issue lifecycle, Agents & tooling, Quality loops & release health, Integrations & observability and Experimental. Each section has a heading that stays pinned while its controls scroll, a one-line description, and a stable id/data-settings-section anchor; a chip table of contents at the top of the tab jumps the dialog body to a section, and Settings search names each Features hit by its new section heading. No control, key or action changed. Inline wrappers moved into stylesheet classes, lowering the style ratchet baselines (inline style= 1537→1507, raw font-size 646→632, raw padding 222→206).
• Budget conserve mode no longer sheds the unstick steps (sha_hold, supersession sweep, escalation); only critical skips them, and /api/gh-rate-limits.api_budget lists both tiers (#12005).
• Renamed the v5 dashboard's Strategy Lab to Experiment Lab and rebuilt its ⚙️ configuration dialog so the content no longer sits flush against the dialog edges: the dialog now uses the wide fixed-size modal recipe (sticky header with its own Close ×, the body as the single scroller, a footer for Cancel/Save) with every section rendered as a padded card and the Trust Ladder as an equal-cell segmented control with tint-based active state, folding to one column on phones. Backports v6 #11715 and #12033. The config key is now dashboard.experiment_lab; dashboard.strategy_lab keeps working as a deprecated alias for one release (it enables the panel, logs a one-line deprecation at load and is folded into the new key on the next save). The /api/status features block carries both experiment_lab and the strategy_lab alias; /api/nous/* and the nous-section id are unchanged.

Fixed

• Fixed the TestFetchBranchSHASpokeTargetWalkbackStopsAtCurrentTarget CI flake (#11753): the test helpers waited only 2s for leaked background commit-behind/commit-order resolvers whose GitHub compare call may run for 10s, so the wait now covers the resolvers' full timeout.
• dashboard: persisted last-good CLI catalogs are no longer aged against the wall clock at load time. newCLIModelCache read the on-disk cli-models-last-good-*.json files and discarded any older than 24h using time.Now before the cache's clock could be installed, so the cutoff was applied twice with two different clocks. Expiry now lives only in lastGoodFor, which evaluates cliModelLastGoodTTL with the cache clock on every read — the same verdict, decided once. This also un-breaks the v5 dashboard test shards, which pinned a 2026-10-14 clock and began failing deterministically a day later (#11994, #11995, #11996).
• The task-list sweep no longer hard-parks issues with needs-human from remainder prose; only the explicit Refs #N (needs-human: …) marker does, and prose hand-offs get the soft hive/handoff label so another lane can claim the issue (#12002).
• timeline: an agent commenting on its own PR no longer records a started stage on the PR journey. The Delivery SLA now ignores PR-keyed journeys when deriving pr_to_merge, so merges are no longer double-counted and n_started is no longer inflated (#12006, part of #11998).
• timeline: Delivery SLA no longer reports already-merged issues as stale in-progress. Issue-side pr_opened/merged stages only began recording with #11880, so on a freshly upgraded spoke every issue an agent started earlier stayed "started, no PR" and was counted in stale_in_progress (hive's spoke showed 61, all of them closed by merged PRs). On startup the hive now lists each repo's PRs merged in the last 7 days once and folds every merged PR onto the issues it closes (Fixes/Closes #N), stamping pr_opened at the PR's real created_at and merged at its merged_at; the merge sweep does the same for every merge it observes. Only issues the timeline already tracks are touched and an issue already marked merged is skipped, so the backfill is idempotent across sweeps and restarts. Merged issues drop out of the stale list, and start_to_pr / open_to_merge have samples from day one (#12007, part of #11998).
• agent: the blocked-action thrash breaker no longer pauses agents for displaying marker text. The breaker matched git push blocked: / blocked by hive policy anywhere in any pane line, so a reviewer that ran git diff / grep -n over hive's own thrash-breaker tests was paused indefinitely without ever running git push. A line now counts only when it starts with the ⛔ glyph the credential helper emits (after stripping whitespace, ANSI escapes and agent-TUI gutters), so diff +/-, grep -n N: prefixes, quoted source and markdown are ignored. The governor's agents_skipped log now names the real pause trigger (reviewer (paused by thrash-breaker) instead of operator-paused), and the dashboard Power table badge shows non-operator triggers inline with the pause provenance as a tooltip (#12015).
• dashboard: the Delivery SLA ⓘ no longer shows two tooltips at once. The tile wrapper carried the full explainer as a native title= while the ⓘ inside it rendered the same text in the styled help tooltip, so hovering the ⓘ drew both. The tile's title= is gone (the ⓘ keeps the text and its aria-label), and a new webstatic test scans index.html — static markup and the JS template literals that build it — and fails when any styled-tooltip trigger also inherits a non-empty native title= (#12017).
• Evidence bundles for agent-authored PRs now record the author's agent, backend and model (from the agent_pr_created audit entry the attribution trailer is rendered from), so author family can be paired with reviewer family; read-only, never affects a merge. Fixes #12065.
• Fix beads.Store.Ready() ignoring depends_on: beads with a non-closed (or unknown) dependency are no longer offered as ready. Fixes #12070.
• dashboard: show upgrade animation when upgrade is hub-initiated (#12073)
• Experiment Lab header no longer shows the stale mode × scope pill (e.g. OBSERVING · GOVERNOR); it now shows the research question for the active scope as muted text when one is set, and nothing otherwise. GET /api/nous/status gains a researchQuestion field. Fixes #12089.
• dashboard: the legacy LiteLLM endpoint block now warns when it diverges from the litellm gateway. Settings → Model Gateways → "Legacy LiteLLM endpoint (governor.litellm)" sat collapsed at the bottom of the tab with no hint that its URL differed from the litellm gateway card above it — the #9945 state where pre-#11794 builds sent the gateway's key to the stale legacy URL and failed with a 401 while the gateway's Test passed. The block now opens by default and shows an inline ⚠ naming both URLs and the fix (set it to the gateway URL or clear it, then Save) whenever they disagree, and saving the litellm gateway mirrors its endpoint into the legacy block client-side so the warning clears without a reload (#12090, refs #9945).
• link every covered-by-PR claim to its PR, not only closing claims on release lines (#12092)
• Hub: the exhausted heartbeat-fallback Deployment patch now re-pulls a release-channel hive on its channel tag instead of pinning it to a SHA tag, so channel-tracked spokes roll once per upgrade instead of being rolled again by the tracked-channel re-arm (#12108).
• hub leaderboard: battle log rows are left-aligned with zebra striping, link public repo#N refs to GitHub with kind-aware verbs (merged PR / closed issue) instead of rendering a [project] placeholder, URL paths are no longer scrubbed as repositories, repeated joins per actor are collapsed, Hive of the Week only renders a video when HIVE_OF_WEEK_VIDEO_URL (or ?video=) is configured and otherwise shows an empty state, team leagues only render non-empty groups so the count matches, and the standing strip explains that standings count contributor-relay tasks (#12109)
• leaderboard: Battle Log hive#N links and Hive of the Week now treat a hive's own project repos as public whenever the hub registry lists the hive as public (hub.is_public), so HIVE_PUBLIC_REPOS is an optional addition rather than a required, drifting duplicate of the registry (#12109)
• dashboard: the Operations tab's "Your contribution" card no longer reports "could not be loaded. This is a bug" to a signed-in viewer with no contributor profile on the hive (routinely the hive's own owner). /api/contribute/me now answers that state as a 200 with has_profile:false instead of a 403 — which the hosted spoke's Ingress, inheriting the controller's global custom-http-errors, had been replacing with an HTML error page served as 200 — and the card renders an empty state pointing at connecting a contributor agent. The hive-contribute Ingress now pins custom-http-errors: "502,503" (template and reconciler) so no JSON answer on that prefix can be intercepted again (#12111).
• ci: give the test (rest i/R) shards a 20m go test -timeout so a loaded runner no longer trips the default 10m panic on pkg/dashboard (#12113).
• Settings dialog: the sticky section heading on the Features tab now sits flush under the search row — the dialog body's top inset is a scrolling spacer instead of padding, which Chromium measured sticky top from, so rows no longer scroll through a gap under the search bar. The dialog is taller (fills the viewport minus a small gutter, capped at 1200px) and a new left-hand rail lists the active tab's sections, scrolls the body to one on click, highlights the section in view, collapses on narrow dialogs and hides while search results are shown. Fixes #12169.
• Fixed the dashboard account menu not opening from the mobile navbar (#12192): the avatar is now a real <button> (iOS Safari never synthesised a click from a tap on the bare <img>), and on phone layouts the dropdown is pinned under the navbar with position: fixed instead of being clipped by the scrolling overflow: hidden chip strip.
• contribute-hive: do not print a tmux attach hint when the contributor agent runs headless (#12196)
• Dashboard: the Diagnostics "GitHub API budget (1h)" tile now spans two grid cells so its per-caller table (Caller, Endpoint, Charged, Req, 304, 429) is fully visible; endpoint and caller cells ellipsise with a full-path tooltip and the table scrolls horizontally as a fallback instead of silently cutting columns (#12203).
• Fixed the dashboard page jumping on every status refresh while the AGENTS section was scrolled into view (#12208): the agents grid was rebuilt via innerHTML each tick, so terminal-tail panes in rows above the viewport changed height and pushed the visible cards (unrecoverable in Safari, which has no scroll anchoring). Cards are now patched in place, the render scroll anchor follows the first visible agent card, and tail panes only auto-follow when already at the bottom.
• hub dashboard: the stable release-channel row no longer renders a stray "auto: on"/"paused" chip on its own line after the pause/resume auto-promotion button; the button label already carries the state (#12210).
• Fixed hivectl hives use not reaching a container-mode relay (#12225): the container entrypoint (PID 1) now traps SIGUSR1 and forwards it to the relay, so hive switches take effect without a restart.
• Refreshed stale task_list_sweep.go citation from lines 797-815 to 848-854 in labels-and-control-signals.md.
• rate-limit accounting: only daemon-credential responses update the shared core snapshot. With auth injection off, an agent's own pass-through credential could report the same X-RateLimit-Limit as the daemon's bucket and move the shared coreRemaining, driving the reserve-floor 429 and budget mode for every agent. Such observations are still recorded per agent for metrics, but only daemon-credential responses (including agent requests with the injected credential) now update the shared snapshot (#12244).
• Fixed the merge-eligibility poll loop stalling behind a GitHub PR fetch: the review evidence writer now fetches PR metadata before taking reviewEvidenceMu instead of while holding it (#12248).
• Fixed the agent configuration dialog's Model picker being unreadable for gateway backends (Refs #9945): the "no per-agent model" option was labelled "(from launch command)", gateway model ids were shown with their provider prefix stripped (glm-5-3 for rits/zai-org/glm-5-3) while the current model kept its prefix, and nothing said the current model was the reason every call 403'd. The option now reads "(backend default — )" (for CLI backends, "chosen by the CLI"), every option shows the full gateway id, a current model outside the gateway's entitled set is marked "(current — not allowed by gateway)", and the select's tooltip states the precedence (per-agent model → gateway default_model → CLI default). /api/inference/models/{backend} now reports default_model and the full entitled_models set. Saved values were always the full ids; only the labels changed.
• Fixed agents on a LiteLLM gateway sending inference for a model the gateway's team is not entitled to when the gateway's default_model is (Refs #9945): an agent entry's own model: — typically left over from an earlier copilot/claude backend, e.g. claude-sonnet-4-6 — always beat the gateway default, so every call 403'd with team not allowed to access model … Tried to access aws/claude-sonnet-4-6 while the Model Gateways card showed the right default. Once the gateway reports its entitled set (key-info probe or that 403), a non-entitled per-agent model now falls back per-request to the gateway default_model, with a warning naming the agent and the remedy. The opened gateway card's form-level Test now prints the same endpoint / default model / key SHA / route diagnostic as the saved-card Test instead of a bare "OK — N models", and flags when the endpoint typed is not the one agents use yet.
• dashboard: the "legacy endpoint" named by LiteLLM route diagnostics can now be found and is kept in step with the litellm gateway. The standalone LiteLLM settings tab had been retired, so the legacy governor.litellm endpoint, key and default model were editable only in hive.yaml even though Test results told operators to reconcile them. They are now under Settings → Model Gateways → Legacy LiteLLM endpoint, every diagnostic and setup hint names that location, and saving the gateway named litellm with a new endpoint repoints the legacy endpoint, default model and key store to it so agents can no longer send the new key to the old proxy (#9945).
• Test Connection now names the kind of proxy (e.g. AWS Elastic Load Balancer) that refused a gateway probe, identified from its Server header (#9945)
• Fixed the ACMM pack apply that runs on every restart re-seeding the pack's model (e.g. copilot's claude-sonnet-4-6) onto agents moved to a litellm/vLLM/llm-d backend or a named model gateway (#9945). That model outranked the gateway's default_model and 403'd as not entitled, and deleting the agent's model: line in hive.yaml did not stick. The pack now leaves the model unset on such agents and clears a pack-owned one, so the gateway default applies; a model an operator picked is kept.
• automerge: a trusted bot's pristine head is no longer blocked on required contexts its workflow skips by design. When the author is in trusted_bot_authors and a required context has no check run but its same-repo workflow run concluded skipped on the head (for example verify PR contents on a Dependabot bump), the sweep now counts that context as satisfied, logs required-check-skipped-by-design:<ctx>, and still requires every other required check to be green and the head to pass min_head_age. Contexts that were never scheduled, fork heads and non-bot authors keep their required-check-missing: hold. GitHub branch protection remains the final gate. The untrusted-author-role tier=trusted-author log noise is tracked separately in #12195. (#12004)
• Inference-routed claude agents no longer stall on Claude Code's interactive "auto mode … this session isn't eligible because your requests go through 127.0.0.1:18444 … Enter to continue" notice: sessions launch with CLAUDE_CODE_AUTO_MODE_SERVER=0 (the OpenAI-format gateway behind the translator cannot return a server-side classifier verdict), and the lifetime prompt watcher presses Enter for any pane already showing it (#9945).
• Contributor-lane auto-merge now admits a PR whose author holds a require_tiers tier (default trusted/merger) in the hive's contributor registry without needing a linked issue or hive:claim marker (auto_merge.contributor_lane.registry_tiers_sufficient, default on; logged as contributor-lane:registry-trusted). Operator-trusted contributors' PRs no longer sit at contributor-lane:no-linked-issue / no-claim when the body only references the issue or the claim happened outside the relay. All other gates still apply.
• The shared core rate-limit snapshot behind API budget mode and the agent reserve-floor 429 no longer takes readings from foreign buckets: proxied agent responses carrying GitHub's unauthenticated X-RateLimit-Limit: 60 (or a limit different from the daemon's) previously flipped the hive to critical and refused every agent GitHub read for up to an hour after each restart while the real bucket had ~14k remaining.
• Repo-card issue pills now show the 🔗 covering-PR glyph for every issue hive considers covered by a PR — closing or partial, actionable or suppressed — from hive's own claim evidence, with a tooltip that says "closes via PR #N" or "covered by PR #N (partial)"; a PR whose body says Refs #N is graded as a reference claim even when its branch is named after the issue, so it never gets a GitHub closing link, and the sweep retracts a closing link the hive App itself added for a pair that is now reference-only (#12144).
• Evidence bundles now record the CI conclusion (status, checks, captured_at) when merge eligibility is evaluated, so ci.captured_at is no longer zero when the merge-time capture fails; capture is best-effort and never affects a merge decision (#12066).
• Hub now delivers each hive's recorded cluster_id in the heartbeat response; spokes with no configured cluster id (provisioned before #11432) adopt and persist it and start reporting node health, and the hub's push-reported note names missing node RBAC (node_rbac: forbidden / 403 on /api/v1/nodes) with a link to src/docs/push-reported-node-health.md.
• Keep hosted-spoke vanity ingress TLS on the existing wildcard domain path instead of minting certificates for legacy domains.
• Fix the hub admin users table actions so icon buttons stay side-by-side with zebra-striped rows.
• Fix lifecycle timeline endpoint markers so they render as fixed-size circles instead of stretched ovals.
• Balanced the /contribute Management tab by grouping operator admin controls into a responsive section grid.
• Merge gate: refuse to merge when any completed non-required check run on the head SHA has failed or timed out, so a red syntax-check can no longer be merged past.
• Stop self-reporting model_discovery_degraded when a hive simply has no Copilot SDK helper and serves the HTTP chat-completions catalog, an expected steady state.
• Dashboard: restore the modeColors lookup used by the Experiment Lab sidebar mode indicator, which #12095 removed along with the header pill (left v5 failing syntax-check with an undefined identifier).
• Fixed the Operations tab layout so the left column expands when the log rail collapses, the contributor-agent header stays readable, and Issue triage stays in the center column.
• Review swarm: an aggregate whose delivered perspectives all approve but which is missing some of the perspectives the head is owed is now incomplete (reason review coverage incomplete: missing <perspectives>) instead of requires_human with "did not unanimously approve"; the dispatcher no longer parks such a head on a human hold and re-asks only the missing perspectives, so a reviewer kick that dies after its peers reported can no longer leave a PR unable to self-merge (observed on #12045).
• Push-reported node health docs: the per-namespace ClusterRole now grants nodes/proxy and cluster-wide pods list in addition to nodes; without them the hub card showed "pods API failed … 403" and no disk figures even after HIVE_CLUSTER_ID was set (seen on vLLM-d, follow-up to #12049).
• Review swarm: a dispatched review that posts no verdict now expires after review.pending_ttl (default 45m) and its perspectives are re-dispatched, instead of leaving the PR stuck as "not reviewed at this head" until someone pushes a new commit (#12045, #12025 sat hours at queue position 1 with the contributor lane at no-verdict); after review.max_redispatch expiries (default 3) of the same head the planner stops re-kicking and records a review-dispatch-exhausted requires_human hold. GET /api/review/queue items gain pending_since and redispatch_count with a "review dispatched Xm ago, no verdict yet" reason.
• hub/dashboard: a daily or weekly hive that misses its upgrade window now says why. When the window opened while a hive was behind its target (for example a :stable hive at 13:00 ET), every gate that could turn it away (an unresolved channel, a claim still being delivered, an earlier upgrade not yet landed, an undeliverable hive, a full upgrade wave, the merge debounce) logged only at Debug, so the spoke dashboard kept showing the previous manual upgrade as if the schedule had never run. The hub now persists the hold reason on the hive record, relays it in the heartbeat upgrade policy (scheduled_hold_reason / scheduled_hold_at), and the spoke shows it as a Held row and in the auto-update status detail (autoUpdate.heldReason / heldAt); it clears once the hive is armed, reaches its target, or its auto-upgrade setting changes (#11196).
• Settings search now takes you to the exact setting: clicking a result row or "Open tab" switches to the tab where the control is actually rendered (derived from the live DOM, not the hand-written index), scrolls that row into view inside the dialog, flashes and focuses it, and Enter opens the first result. Every setting row now carries a stable data-setting-key anchor and a test audits the search index against the rendered tabs, catching entries that pointed at the wrong tab (Strategy Lab, Trajectory review) or at no control at all.
• timeline: SLAHistory.Series read the per-repo day map outside the lock, racing concurrent Update (fixes #12077).
• Delivery SLA: empty tiles now say what they are waiting for, and the Open → triage and Triage → start spans are rendered. Previously n=0 tiles showed a bare — and the two spans that already had data were hidden (#11998).
• Fixed troubleshooting.md and documentation-map.md links to the admin MCP reference, which lives on v6; v5 now links to the v6 document instead of a missing local file (#12162).
• Spoke /api/version no longer reports "Upgrade available" when the hub-resolved channel target lags the commit the spoke already runs (e.g. right after a promotion); such an offer was always refused by the hub as "not armed — already at target".

Security

• Contributor-lane auto-merge now merges only for contributors an operator vetted: the hive:claim marker stamps the contributor's trust tier and whether their GitHub login was proven (reissue-token flow), and the tier requires a tier in the new auto_merge.contributor_lane.require_tiers (default trusted, merger) plus a verified login. It also skips PRs whose author association is NONE/first-time, PRs that touch CI workflows or delete tests, and hives with no reviewer agent; existing claims without the new fields are refused (#12041).

---

SBOMs: SPDX JSON, generated by Syft against the linux/amd64 image digest, attached below for hive, hive-contributor, and hive-hub. They cover linux/amd64 only — see releases.md for why linux/arm64 is not scanned separately.

NOTICE: third-party license attribution for the Go module dependencies compiled into these images, attached below. Does not cover base-image OS packages or the Node.js/tmux layers built from source — see releases.md for the exact boundary.