v5.179.0

Added

• Evidence bundles now record merge.opened_at (the PR's GitHub creation time) on live merges and in hivectl evidence backfill, so time to merge is measurable per PR; pkg/evidence gains Bundle.TimeToMerge and MedianTimeToMerge for the ACMM level × median time-to-merge view. The field is optional and additive in schema v1; older bundles keep their hash and simply report no time to merge. Reporting only; no merge behaviour changes. Refs #12062.
• Added the Shadow gates panel to the dashboard Evidence sub-panel and populated shadow_gate in GET /api/evidence/summary: how many PRs the shadow review gate would have held and shadow intent verification would have blocked, and how those PRs actually turned out (merged, reverted, open) next to the PRs the gates would have passed. Reporting only; no merge behaviour changes. Fixes #12068.
• Added review.shadow (default false): evaluates the review-approval gate without enforcing it and records shadow.review_gate.would_have_held on the PR evidence bundle and in the audit log. It never blocks a merge or weakens require_approval. Fixes #12104.
• Hub admins can click the Fleet quadrant card to open a fleet evidence details panel fed by GET /api/hub/evidence: evidence coverage, the calibration curve with a per-hive overlay, revert rate by ACMM level, same- vs cross-family false-approve, and per-hive rates, each with n and its 95% Wilson interval and "—" where the sample is too small. When no quadrant axis is scored yet, admins get a one-line link in place of the card. Members keep the plain card with no link, and a 403 or fetch error is explained inside the panel. Median time-to-merge, revert rate by author kind and the per-axis criteria table are not reported by spokes yet; the panel says so in place and they are tracked under #12080 (#12117).
• Self-reported issues now say which repositories and owners are affected, not just which hives (#12338). The evidence table of a [selfreport] issue gains repos (count + the owner/repo list the reporting hive watches), owners (the distinct orgs/users derived from them) and, when the error class is scoped to an item, repo / ref (advisory_post_failed now records the digest's repo). The <!-- hive:selfreport-affected --> block carries Affected repos (N) and Affected owners (N) as a union across every hive that joins the issue, re-derived idempotently so a re-report with nothing new never edits the body. Nothing new enters the fingerprint, so dedupe across hives is unchanged. Because the report repo is public and hive.yaml does not record repo visibility, governor.fleet_report.include_repos (default true, also a Settings → Governor → Self-Reported Issues toggle) turns the attribution off for hives whose project.repos include private repositories; the fields then render as — and the block keeps its pre-existing shape.
• Added pkg/hivestate: the per-cycle Nous snapshots in /data/nous/snapshots are now a bounded hive-state time series (raw files kept 24 h, then rolled into hourly buckets, deleted after 30 days) summarized into 24 h / 7 d trends — median/p90 queue depth (issues, PRs, held), SLA-violation rate, agent idle ratio, kicks/day, tokens/day. The trends ride on fleet self-reports and on the hub heartbeat's evidence.hive_state. Refs #12339.
• Intent verification now records every evaluation (merge-eligible lane and App self-merge sweep) as an intent_evaluated audit-log line and a per-tier evaluated/would-block counter, flushed weekly-bucketed to /var/run/hive-metrics/intent-counters.json beside the proxy write counters and exposed as intent_counters in GET /api/evidence/summary. Record-only; nothing reads it back into merge eligibility (#12362).
• The hive now takes the monthly per-repo complexity snapshot itself (evidence.complexity.enabled, on by default; evidence.complexity.static_analysis off by default), writing /data/evidence/<owner>/<repo>/complexity/<YYYY-MM>.json from the default-branch tarball, keeping 24 months, and exposing the newest 12 per repo as complexity_by_repo in GET /api/evidence/summary. Report-only; never affects merge eligibility (RFC #12062, #12363).
• Added the Outcome by author kind panel to the dashboard Evidence sub-panel: merged, closed and reverted-within-14-days counts per human / agent / bot author from outcomes_by_author_kind in GET /api/evidence/summary, with n= and a note on what the bundle schema does not record. Reporting only; no merge behaviour changes. Fixes #12364.
• Added the Claim vs verdict panel to the dashboard Evidence sub-panel and claim_vs_verdict to GET /api/evidence/summary: per ISO week, agent-authored PRs that claimed done against those whose captured CI was not green, whose swarm verdict was not approve, or both; records with empty CI are disclosed under missing.records_empty_ci rather than counted as agreement. Reporting only; no merge behaviour changes. Fixes #12365.
• Added the Work balance panel to the dashboard Evidence sub-panel and work_balance to GET /api/evidence/summary: per ISO week over the Throughput window, audited issues opened by actor kind (human / agent / bot) against issues closed, with missing flags disclosing that only hive-mediated issue writes are observed and that no governor throttle windows are reported (so no weeks are shaded). Reporting only; no merge behaviour changes. Fixes #12366.
• Added hivectl evidence export --since <RFC3339|duration> --format csv|jsonl [--repo] [--out] [--root]: one row per PR from the newest schema v1 evidence bundle on disk, with the same column set the dashboard Evidence charts aggregate (author kind/model, reviewer models and per-perspective verdicts, CI conclusion, merged/open outcome, revert and follow-up links, shadow-gate flags, sentinel hits, signed). Deterministic order, no network, unreadable bundles counted on stderr. Reporting only. Fixes #12367.
• Added the Boundary enforcement panel to the dashboard Evidence sub-panel: attempted-vs-blocked agent writes per intent tier (top block reasons on hover) from the proxy write counters and a sentinel-hits-per-week sparkline, with an empty state when the counter file is absent; write_counters in GET /api/evidence/summary now carries blocked_by_reason. Reporting only; no merge behaviour changes. Fixes #12368.
• Hub evidence drill-down (GET /api/hub/evidence, admin-only) gains hive multi-select and ACMM-level filter chips that re-pool every table client-side, plus fleet analogues of the spoke evidence panels — outcome by author kind, boundary enforcement per intent tier and shadow gates × outcome — drawn as inline SVG from new optional heartbeat aggregates; old spokes report "not reported", never zero, and nothing here reads into merge eligibility (#12370)
• hivectl evidence backfill --repo <owner/repo> --since <date> [--until] [--root] [--dry-run] reconstructs schema v1 evidence bundles from GitHub pull-request history: author with a documented kind heuristic, merged/closed/open outcome and timestamps, merger, and revert / follow-up links under the live recorder's rules. Bundles are marked backfilled: true with a backfill block (source, state, author-kind rule, pre-registration exclusion flags); verdicts, CI, sentinel and shadow fields are left absent, never fabricated. Idempotent and rate-limit aware. Record-only: nothing reads it to decide a merge. Run plan in docs/research/backfill.md (#12371).
• Docs: docs/research/ablation-plan-2026-10.md — the run plan for the study's two opt-in arms (cross-family reviewer; shadow gates) on consenting hives, 30 days each: consent record, hash-based arm order, exact review.shadow / intent.shadow / review_models.exclude_author_family diffs, rollback, metrics quoted verbatim from the pre-registration and where results are read. Auto-merge unchanged everywhere; results reported win or lose (#12373).
• Docs: src/docs/nous-hive-self-experiments.md — document Hive-self background experiment mode under Nous: outcome questions (quality, security, review usefulness, auto-merge, outreach, agent effectiveness, user satisfaction via NPS), cohorts, windows, heartbeat feature flag/channel gating, guardrails, auto-revert, and the strict background-only boundary hidden from spoke dashboards and the Experiment Lab (#12398).
• Hive-owned stage/NNN-* pipeline labels (010-actionable … 100-merge-queue, one per open item, derived from ONE ordered table in pkg/stagelabels), author/* admission-tier labels, and red stage/stalled / stage/regressed markers with a one-line regression comment; written by the automerge sweep only on change, switched by governor.labels.stage.enabled (#12429).
• Issues now carry the hive-owned stage/NNN-* label too: stage/010-actionable, stage/020-claimed, stage/030-pr-in-progress, stage/040-covered-by-pr, and from 040 on the issue mirrors the stage of the PR that covers it so the issue list reads like the PR list. The retired claimed, hive/in-progress and 🐝 covered by PR labels are no longer written and are removed from open items on the first cycle after upgrade; hive/claimed-by-<who> stays as the "who" modifier (#12436).
• Stage-072 contributor nudge (#12436): when a contributor PR goes red the hive posts one <!-- hive:contributor-nudge head=… --> comment per head (re-nudged once at the stall threshold; cap 2) and, for an online relay contributor, pushes a fix-pr interrupt task to their relay session — a parallel fix sub-session when the relay advertises parallel_sessions/max_parallel_fixes, otherwise a preempt that parks the current task and resumes it after the fix. A per-contributor fix budget (contribute.max_parallel_fixes, contribute.min_focus_window) caps in-flight interrupts, queues the rest oldest-first (human changes-requested before CI-red), coalesces same-cause failures into one task, and serves queued fixes before any new work at task boundaries; the contribute page shows "You have N PRs to fix first" and the profile API exposes fix_queue. New leaves governor.labels.stage.contributor_nudge.{enabled,renudge_interval} and governor.labels.stage.presence_window; the shipped relay implements fix_pr_interrupt_v1 (HIVE_MAX_PARALLEL_FIXES).
• stage/074-adopted-by-hive: a contributor PR still red governor.labels.stage.contributor_grace_online (2h) / contributor_grace_offline (1h) after the nudge is adopted — the hive pushes hive/adopt-<n> at the contributor's head (commits and sign-off preserved), opens a superseding App PR carrying the original Closes lines for the scanner's red-PR fix kick to finish, comments once on the original and closes it when the superseder merges; overflow in the per-contributor fix queue is absorbed the same way. governor.labels.stage.adoption.enabled (default true) switches it (#12436).
• Hub Fleet-evidence modal now leads with a plain-language What this says block and a one-line finding under every table, generated from the data with explicit "not enough data" fallbacks; jargon labels replaced (All selected hives, Merged PRs, Reviewer confidence with the spoke card's four ranges, X% of N with the margin (95%) as a muted second line); sections no hive reports collapse into one Waiting on hives list with no issue numbers in visible copy; the modal widens to min(96vw, 1600px) with a horizontally scrollable per-hive table and a sticky hive column; and a 📄 Report / ⬇ Markdown pair serves the same view as a standalone plain-language report from the new admin-only GET /api/hub/evidence/report (format=md|html, download=1, same window and hive / level filters). Read-only; nothing touches merge eligibility. Closes #12456.
• Operations → Connected contributor agents (#12502): each contributor row now shows the relay's parallel capacity (capacity N · spawn|preempt, or "not advertised"), one line per in-flight work item — the primary task plus every fix-pr sub-session — tagged NEW or REWORK with its stage label, and a red "N PRs awaiting rework (not yet dispatched)" line (idle rows read "idle · N PRs awaiting rework") when the contributor has stage/072-returned-to-contributor PRs the hub has not handed them. /api/contribute/fleet gains parallel_capacity, fix_mode, in_flight[] (kind: new|rework), fix_queue_depth, pending_rework and pending_rework_prs[], derived from the fix queue and the stage-label store (which now remembers each PR's author) with no extra GitHub calls.
• Add an opt-in bead-synth publisher integration hook with per-run or daily batching, stable-slug updates, and retries independent of local synthesis; repository publishing remains disabled until a policy-enforcing publisher is installed.
• Add owner-only bead-synth repository publishing settings to the knowledge pipeline API, with disabled-by-default publishing and validated path, mode, and cadence; publication itself is not yet implemented.
• Add an owner-only "Publish to repository" block to Settings → Knowledge → Knowledge pipeline for choosing where bead-synth facts are published (repository, path, base branch, mode, cadence); direct commit is offered only where policy allows.
• Bead-synth facts can now be published to the repository: with knowledge.bead_synthesizer.publish.enabled, each synthesized fact is rendered to <path>/<slug>.md (frontmatter plus the standard "Maintained by Hive" footer) and proposed through one PR on the fixed hive/bead-synth-knowledge branch. Later runs update the same files in the open PR, unchanged facts are a no-op, and facts flagged sensitive (security-tagged, credential-shaped or already-redacted text) or from the personal layer are never published. Publishing always opens a PR (mode: commit falls back to PR), and publish failures never affect the local vault write (#12448).
• Evidence card: 24h / 7d / 30d / custom from–to window pills (persisted per browser; GET /api/evidence/summary accepts from=/to=) and a plain-language ⓘ explainer per panel with a live "What ours shows" section and a Strong / Fair / Weak / Not enough data grade (RFC #12062).
• The hub evidence drill-down now shows median time-to-merge per autonomy level (the median of each hive's own median, labelled as such); hives on older builds and PRs merged before open times were recorded show "not reported", never 0. Reporting only.
• Added governor.first_timer_welcome (default on): when a human first-time contributor opens a PR, the hive posts one welcome comment (per author per repo, marker <!-- hive:first-timer-welcome -->) that thanks them and invites them to run their own hive — contributor profile, leaderboard, trust-tier progression to auto-merge, and offline review-fix/rebase handling. The good-first-issue comment now mentions the same option.
• Hive-curated good first issue labelling is now on by default (good_first_issue.enabled: false opts out), sweeps every 15 minutes and advertises issues from one hour old so it can beat a scanner that claims within minutes; the scorer now also rejects security-titled issues, emoji/[tag]-prefixed epics and RFCs, roadmap/meta-tracker items and the hive's own advisory/selfreport/sentinel/fleet reports, and the labelled set is refreshed every cycle so a hive agent claiming a hand-labelled issue removes the label at once. The welcome comment still directs contributors to this hive's relay (claim → DCO-signed PR → Fixes #n → contributor-lane merge).
• Hub fleet evidence view (GET /api/hub/evidence, admin-only) gains a 24h / 7d / 30d / 90d / custom-range window selector (?hours=, ?from=&to=; spokes now report trailing 24h / 7d / 30d evidence windows in their heartbeat and a custom range is served from the smallest covering window, disclosed as approximate), a ⓘ plain-language explainer on every section (What is measured · Why it matters · How it is measured · How to read our numbers, the last computed live with a graded verdict and 95% CI / minimum-sample explained), sticky section titles and column heads inside the modal, and an always-visible 🔬 Evidence button plus hint on the Fleet quadrant card. Reporting only; nothing here reads into merge eligibility (RFC #12062)
• Hub dashboard Fleet quadrant kite now marks each axis tip with a small muted letter (T, P, S, E — Trust north, then clockwise Productivity, Satisfaction, Efficiency) with full-name <title> hints, so a viewer can tell which corner is which without opening the hover.
• Add the capacity-aware contributor PR-fix scheduling primitive and optional parallel_sessions capability declaration as groundwork for priority relay feedback; live dispatch and stage integration remain tracked in #12436.
• Expose the scalar hub.* settings in the dashboard Settings dialog: a new Hub settings block on the Hub tab edits explicit task acceptance, the already-done label and hold, contributor wall retention, the contributor announcement, the snapshot interval, the self-upgrade drain timeout, task-status push and the NPS prompt through the owner-only PUT /api/config/governor/hub, shows the cluster ID, hive type and deprecated already-done keys read-only, and takes the hub-only provision-request Discord webhook and NPS relay pull secret as write-only values that are never shown (#11854).
• Added the Hive activity monitor dashboard section: one Domino's-tracker-style strip per open issue and PR on a single shared pipeline (Open → Actionable → Claimed → PR in progress → CI / Review → Merge gate → merged). Only the current step is coloured and named; side stages (fixing, returned, adopted, needs-decision, human merge) light the step they branch from; an issue with one covering PR is a single entry (PR listed with an author/*-coloured icon under the PR column, its stage driving the strip from PR in progress on); with several covering PRs they nest beneath the issue as indented sub-rows, each with its own strip; titles truncate with an ellipsis (full title on hover) so rows never wrap; a since column, one health chip and a tooltip with the reason, actor and recent stage hops complete each row. Backed by the new GET /api/stage-tracker endpoint; the stage store now keeps a short per-item transition history.

Changed

• Changed intent.shadow evidence recording when evidence.signing_key_path points at an unreadable or malformed key: the shadow observation is now skipped with a Warn log line instead of being written unsigned, so a misconfigured key can no longer rewrite a previously signed evidence bundle as "signed": false. An absent key path or missing key file still records unsigned as before; only a key that exists but fails to load is affected. Shared with the new review.shadow writer. Refs #12104.
• Dashboard settings dialogs: when clicking "Save & close" with no changes staged, the dialog now closes automatically alongside the "No changes to save" notification instead of remaining open (#12298).
• The legacy dashboard settings footer button now labels the Save action as Save & close to match the Go dashboard (#12333).
• Changed Strategy Lab's Data Collection card to show "Baseline complete · N snapshots collected (target T)" once the baseline target is reached, added a persistent explainer that snapshots are passive baseline samples (not experiments), and clarified the upgrade hint as an owner action. Fixes #12335.
• The Nous lab now presents its snapshots as a State history (hive-state time series) instead of a governor baseline: the "Snapshots (N% of baseline)" tile is just State snapshots, the "Baseline Data" card is State history, and the "Data Collection" N / 672 progress bar is replaced by a single line stating the retention (24 h raw, then hourly for 30 days). Backend fields are unchanged (#12339).
• Deduplicated hive/partially-addressed and hive/likely-done label color and description literals into shared package constants and registered them in escalationIssueLabelDefinitions. Closes #12399.
• hub: drop the em dash from the trust hero headline (#12414)
• The hub Fleet quadrant now scores each criterion on a fixed, documented 0–100 curve instead of a fleet percentile, feeds Trust, Productivity, Efficiency and Satisfaction from the heartbeat evidence summary (revert rate, false-approve and false-block rates, evidence coverage, boundary block rate, per-repo merge throughput, agent idle ratio, SLA kept), leaves a criterion with no data out of the axis average and lists it as "not measured yet" with the reason, takes the fleet view as the per-axis median with n, and adds a ⓘ explainer on every axis label (what it covers, how it's scored, what good looks like, what ours shows) plus a one-line plain summary under the glyph on both the fleet card and the per-hive hover. quadrant/fleet_quadrant gain criteria[], measured, unmeasured, summary, n and aggregate without removing existing fields (#12458).
• labels: fix docs citation drift + changelog fragment location from #12468 (#12476)
• docs: refresh RankActionableIssues citation in scale-envelope.md (#12477)
• Changed the PR stage labels' human hand-off: stage/090-needs-human is renamed stage/090-ready-for-human-merge (the engine renames the GitHub label in place) and now means the hive would merge this itself but trust/role blocks it — reviewer verdict approve at the current head, required checks green (tide excluded), DCO yes, no sentinel alert, no conflicts, soak elapsed, no hold; a maintainer's /lgtm /approve is the only missing step, and one <!-- hive:stage-ready-for-human-merge --> comment carries the evidence. A new stage/085-needs-decision takes the hand-offs that need a human decision rather than a merge (sentinel-alert, hold / do-not-merge* / needs-decision, no reviewer, human-only lane rules) with one entry comment naming the decision. Hand-offs whose head is red, lacks a DCO sign-off, conflicts, or has changes requested route to stage/072-returned-to-contributor (070 when self-authored) with the concrete reasons in the nudge; a head without a current verdict stays at stage/050-review-pending. Leaving 085/090 is never a regression. Closes #12528.
• Stage labels: stage/regressed is retired and stage/stalled now means "no activity" (#12534). The review loop 050 → 060 → 072 → 070 → 050 is the intended cycle, so a backward move is no longer a label: it stays as the one-line deduped stage comment and as the item's transition history (stage.history[] on /api/review/queue entries, backed by /data/stage-labels.json). The sweep strips stage/regressed from every open item it sees and no longer provisions it. stage/stalled is applied only when nobody but the hive has touched the item for the stage's dwell (head push, comment, review submission or verdict, CI state, labels), measured from the head SHA, comment counters, listed review submissions and verdict/CI/label digest the lanes already fetch rather than updated_at (#12491), and never while required checks are running or the reviewer verdict for the current head is pending — specimen #12417 (6h at 050, CI green, no verdict) is now an explicit test. Any activity clears it at once. When the hive itself holds an item past the dwell the signal is hive-side: one warn log per PR, a hive_held count on the review queue and a "waiting on hive Xh" pill, not a label on the PR. New knob governor.labels.stage.stalled.require_quiet (default true; Settings → Labels) restores the entered-at clock when off; the review queue's stage.stalled/past_dwell and hive_held follow the same dwell overrides and knob as the label. Issues in their own stages (010–030) keep the entered-at clock: the issue list payload carries no activity signal. Dashboard: stalled tooltip reads "no activity for Xh", the regressed pill is replaced by the stage history.
• Changed the hive/<hive-id> provenance label on issues and PRs: it is retired. bin/gh-wrapper.sh no longer adds it on create/comment/edit/merge (and no longer creates the label definition per repo), runtime-error self-reports and the hub self-report relay no longer add hive/<slug> when joining, and a boot-time self-heal sweep (Client.RetireHiveIDLabels) strips the label from every open item in the hive's repos, deletes the definition once nothing open carries it, and records /data/hive-id-label-retire-<hive-id>.json. Which hive wrote an item now travels in the body: the identity footer ends with <!-- hive:origin hive=<hive-id> at=… -->, and github.OriginHive reads that marker with a fallback to a leftover label during migration. hive/selfreport, hive/advisory and the other hive/* signal labels are unchanged. Fixes #12539.
• Label rename: the trust tier moved from author/<tier> to role/<tier> (role/trusted, role/contributor, role/newcomer, role/untrusted; same colours). The stage-label reconciler migrates each PR automatically on its next write, so saved searches on author/trusted must switch to role/trusted. author/* is now only the authorship axis: three mutually exclusive labels, author/human (a person pushed the PR), author/clanker (a contributor's own hive authored it under their login), author/hive (this repo's own hive/App did), detected by the new pkg/authorkind from the App login, agent/<lane> stamps, the hive:origin marker, the — hive: attribution trailer, the 🐝 identity footer and the contributor registry; names are configurable under governor.labels.author.{human,clanker,hive}. Only author/clanker PRs get the stage-072 contributor-nudge interrupt and offline adoption; human and hive PRs simply wait. Fixes #12581.
• claims: document the single-live-claim-per-issue ledger invariant (#12628)
• Changed the v2 Tests pull-request gate to run only the Go packages a PR can affect — the packages with changed .go files, their reverse dependencies, tests that read those files as text, and the repo-wide source scanners — instead of the whole suite every time (#12454). Any change the analysis cannot reason about (workflows, CI or repository scripts, go.mod/go.sum, the internal/ test harness, non-Go files under src/, files outside src/ other than docs and changelog fragments, or an analysis failure) still runs the full suite, as do every push to a release branch and every scheduled run. Shards with nothing to test report success immediately, so the required test and coverage checks always report; partial runs score per-package coverage floors only for the packages that ran and take the no-test-files gate from the whole tree. Set the repository variable HIVE_AFFECTED_TEST_SELECTION=off to force the full suite on PRs.
• Documented the knowledge.bead_synthesizer.publish repository-publish block (every field, default paths, PR-only policy for ACMM L<=4 hives) in the knowledge-curator and operator-reference pages and hive.yaml.example.
• Reduced CI runner waste by adding job timeouts, cancelling superseded pull request runs, and moving lightweight checks to GitHub-hosted runners.
• Dashboard FAQ refreshed (#12439): every answer re-audited against current v5 behaviour (the L6 answer no longer claims reviewer verdicts stop auto-merge), twelve new questions (Evidence card, "N behind", release channels, hold labels, shadow mode, Model Gateway/OpenRouter, Experiment Lab, attribution trailer, hiding/reordering sections, audit log, pausing, mobile profile menu), collapsible <details> per question, a client-side filter box, a "Was this answered?" footer, and all inline styles moved to token-based .faq-* classes.
• Experiment Lab: the ⚙ configuration dialog now holds only lab-wide guardrails (trust ladder, output mode and labels, and the repo allow-list, renamed "Repos experiments may target"); the research-question / "Start a new experiment" section is gone and experiments are defined only via + New experiment, whose scope pills come from the allow-list. Cards gain compact ✎ Edit / ⏸ Pause / ▶ Resume / 🗄 Archive icon actions; editing the hypothesis saves in place while changing the question or scope asks "Restart experiment?" and archives the old version (cards show "v2 · restarted from #1"; PATCH /api/nous/campaigns/{id} takes restart: true, else 409 restart_required). The lab-wide baseline progress bar and empty "Experiment Progress" box are replaced by a compact "Data collection" note.
• Experiment Lab: say when the experiment loop is not running instead of waiting forever. The hive designs no proposals itself — proposals, ledger rows and principles come only from the external experiment loop writing /var/run/nous/governor/*. GET /api/nous/status now reports an experimentLoop block (dir, lastWriteAt, running, idleAfterSeconds), and when nothing has been written there for 24 evaluation cycles a ready card in Suggest/Evolve mode reads ready — the experiment loop is not running on this hive (experimentLoopIdle: true) with a docs link, instead of the indefinite ready — generating proposals. docs/strategy-lab.md gains The experiment loop: the component, the files the hive reads, and what the repository does and does not document about deploying it. (#12541)
• Hive-authored issue provenance now lives in one label family, origin/<source>, so operators can tell "where did this come from" apart from agent/<lane> ("who works it", a routing signal) and the stage/* pipeline labels. Review-swarm backlog findings are filed as origin/review instead of from-review; every origin/* label shares one neutral colour (#8250df) and the ensure-label helper creates or recolours it idempotently. A one-time startup reconciler swaps from-review → origin/review on open items (report at /data/origin-label-migration.json, audited as origin_label_migrated), and review.backlog.labels still accepts from-review, mapping it to origin/review without double-labelling. Labels that look like provenance but are read as signals (hive/selfreport, hive/advisory, hive/<hive-id>) are deliberately unchanged and documented under "Label axes" in labels-and-control-signals.md.
• Changed the outreach hold policy: the PR-request watcher now holds an outreach PR only when its target repository is not one this hive manages (cross-repo outreach — an awesome-list, a partner's docs, another org's repo). Outreach PRs into the hive's own repos (README, ADOPTERS.md, docs, keyword tweaks) are ordinary agent PRs: they follow the ACMM level hold at L3–L5 like every other lane and auto-merge on green CI at L6. The decision is made server-side from the PR's target repo (config.AgentOwnsRepo), not from the agent's --label; the outreach prompt, level-hold notice and operator docs describe the new rule. Operator decision by @clubanderson, 2026-10-16. Closes #12352.
• Stage 074 adoption now decides "author unavailable" against the contributor's live hub presence at every sweep — reason=contributor-offline after governor.labels.stage.adoption.after_offline (30m) without a relay heartbeat, contributor-unregistered after after_unregistered (2h) for an author with no profile here, grace-elapsed otherwise — and, when the PR allows maintainer edits (adoption.in_place, default on), adopts it in place: the PR's own branch is routed to the red-PR fix kick (conflicted rows included) instead of opening a superseding PR; a contributor push yields it back. The 072 nudge/adoption interrupt applies to author/clanker PRs only; hold/do-not-merge blocks adoption; the contribute page marks nudged PRs of a stale relay adopting (contributor offline) (#12527).

Fixed

• Hand trusted-bot PRs from the trusted-author tier to the self-authored lane (logged as trusted-bot-lane) only while that lane is active, so their real skip reason surfaces without dropping them at lower ACMM levels.
• kick_failed_repeatedly self-reports no longer fire while the agent is simply mid-turn (#12268). The governor re-kicks an agent whose previous turn is still streaming, each attempt waits out the two-minute prompt timeout as "CLI did not reach input prompt", and three of those inside one long review turn used to file an upstream issue that cleared itself the moment the turn ended. The self-report now waits until the agent's own Copilot transcript has been silent for the busy_no_activity_threshold (default 30m) — the same bar the dashboard applies before calling a Working pane stuck — and the report message carries how long the transcript has been silent. The dashboard kicks_undeliverable counter is unchanged; agents without a transcript cache (non-Copilot backends) report exactly as before.
• Partial PUT /api/config/governor/hub requests that omit snapshot_url no longer clear hub.snapshot_url; an explicit empty string still clears it (#12330).
• Fixed PR-claim label sync marking an open issue hive/likely-done when the only merged PR for it was a reference-only claim (Refs #N / Part of #N). Such a PR never asserted it finished the issue, so Hive now applies hive/partially-addressed (the #11931 "no closing keyword" rule) and the issue stays in the actionable band instead of Confirm & close; the sync also stops re-adding an already-carried hive/likely-done on every tick. Fixes #12383.
• An agent's deferral comment ("Deferred this cycle", "Picks up once #N merges", "Blocked by owner/repo#N") no longer records a 2h start claim that leaves an idle issue marked in progress after its blocker lands; a comment that also says work is starting now still claims.
• Preserve existing hub.snapshot_url queries and fragments at config load with a warning instead of preventing startup; dashboard updates still reject them (#12420).
• Pull contributor Docker base images from mirror.gcr.io to avoid anonymous ECR Public rate limits.
• Fixed a clock/tick race in the complexity runner loop test that intermittently deadlocked the test (rest 1/5) CI shard (#12479)
• Stage labels: a maintainer's PR evaluated by the trusted-author lane no longer gets author/untrusted when the contributor lane (which knows no registry profile for them) also lists it — author tiers now merge by precedence instead of last-writer-wins — and required-check-pending:<check> is classified as CI-pending so the trusted lane's 050-review-pending outranks a lower lane's 090-needs-human (#12490).
• automerge: HeadPushedAt no longer derives from updated_at, so hive label/comment writes stop resetting head age and triggering spurious stage/regressed (#12491)
• Hub POST /api/saas/hives/{id}/upgrade on a spoke already at its reachable target now returns 200 {"status":"current", ...} instead of 409; both dashboards say "already up to date" and the spoke no longer records a failed self-upgrade for the no-op (#12494).
• dashboard: show the full Experiment Lab research question in the header (#12498)
• Experiment Lab: changing the research question now starts a new experiment campaign — the baseline snapshot tile and Data Collection bar restart at 0 / 672 instead of carrying the whole hive's history (2688 / 672 "Baseline sufficient" on a brand-new question), hypotheses and results are scoped to the active campaign, previous campaigns are listed read-only with their results, the observation history stays visible as a muted line, and POST /api/nous/campaign/start (with a confirm in the config dialog) starts a fresh run of the same question (#12501).
• Stage labels: a lane that cannot vouch for a PR's author (trusted-author untrusted-author-role, contributor-lane no-claim/claim-tier-*/no-linked-issue) no longer flips the PR to 090-needs-human when another lane admits the author; leaving 090 is no longer recorded as a regression (and records regressed "from 090" heal on the next cycle); when the review-swarm verdict decided the stage the stored reason, regression comment and log say reviewer-verdict:changes_requested instead of the lane's CI wait (#12503).
• Agents whose pane keeps showing Working with no transcript activity now recover instead of refusing kicks forever (#12505). After at least six undeliverable kicks and twice busy_no_activity_threshold of silence (60m by default), the session is restarted through the restart-storm breaker, at most once per 30m per agent.
• hub: escape apostrophe in quadrant tooltip that broke the My Hives dashboard (#12507)
• The dashboard no longer jumps every few seconds while scrolled below the Cost panel. Every SSE agent-status tick rebuilt the Cost panel with innerHTML, inserting its cost per session / cost by repo sub-tables expanded; the collapse re-apply forced a layout before adding .collapsed, so the browser's scroll anchoring shoved the page by the sub-tables' height (~600 px) and rode the 200 ms max-height transition back down — once per tick (#12512). The Cost panel, Debug grid and Audit table are now patched in place through morphInnerHtml (the keyed morph from #12209) with their persisted collapsed state rendered into the markup, so an unchanged render is a layout no-op and the panels keep their own scroll offsets. The Agent Logs poller also stops hitting /api/pane/<agent> for disabled or stopped agents — they have no tmux window, and the resulting 404s for guide/quality every 5 s were pure console noise — and parks an agent after a 404 until its state changes.
• The hub heartbeat evidence block and hivectl evidence export now fold every bundle of a PR and window on PR open time with the same evidence.FoldPRs as GET /api/evidence/summary, so a spoke with live and backfilled bundles (Bluefin) reports the same PRs, outcomes and false approvals in the fleet Evidence view, the export and the dashboard; the export gains an opened_at column, --since keeps PRs opened at or after it, and outcome is closed for a backfilled close without merge (#12516).
• Hive now lifts its own blocked label when every native GitHub "blocked by" dependency of the parked issue has closed, not only when a PR referencing the issue merges. Scanner-split children parked on an open sibling were otherwise left out of every lane after the sibling landed (#12522).
• hard-suppress: lift hive-applied blocked when native "blocked by" dependencies close (#12524)
• agents: point Copilot login dead-ends at the dashboard login flow (#12536)
• agent/<lane> and hive/<hive-id> no longer leak onto contributor PRs: the gh wrapper's pr edit/pr comment/pr merge arms stamp them only when the PR's author is the hive's own App identity (a review-fix gh pr edit --body on a human's PR re-routed it to the scanner), and the stage reconciler strips stray ones from open PRs the App did not author (#12545).
• ApplyClaimedByLabel no longer strips a co-party's live hive/claimed-by-<login> label — it now adds the claim's own label and removes only backend-named ones, matching the issue reconciler and RemoveClaimedByLabel (one label per party); a takeover removes the previous holder's label explicitly. (#12568)
• Review evidence now preserves the merge-eligibility CI snapshot even when it arrives before the review bundle (#12594).
• dashboard: Evidence FAQ lists every panel and only claims grades for graded ones (#12596)
• fix: tell agents not to attempt out-of-tier writes (#12600)
• Shared-CI red and budget-exhausted behind PRs no longer land in contributor-fix stages. A red PR deferred to an open [shared-ci] incident (base or shared required check red) now stays at stage/050-review-pending / 060-reviewed with reason shared-ci-incident:<n> instead of stage/070-fixing / 072-returned-to-contributor, gets no contributor nudge and never stalls, until the incident closes (#12606). A behind self-authored PR the sweep skips only because the per-tick branch-update budget is spent now records behind-update-budget-exhausted (merge queue, waiting on the hive, retried next tick) instead of the generic check-pending; true conflicts stay author-facing (#12607).
• Stop no longer lets the governor's kick-start path (#12608) restart an agent an operator stopped explicitly from the dashboard/API; crashed or exited agents are still restarted, and starting the agent again clears the stop.
• Restarting an agent now clears its operator-stop marker so the governor can recover it from a later crash, and /api/status agents carry an operatorStopped flag (shown as "stopped by operator" in the dashboard) so an explicitly stopped agent is distinguishable from a crashed one. (#12624, #12626, #12627)
• Recheck reviews after body-only edits (#12629)
• Automerge no longer loops a merge-queue PR through stage-regressed comments every sweep while its head is unchanged (#12557). min_head_age was measured from the PR's updated_at, which the hive's own stage-label flips and regression comments bump, so the gate kept reporting pending: head pushed ~1m ago (< min_head_age) on heads that were hours old and the PR could never auto-merge. Head age now comes from the head commit's committer date (clamped to the PR's creation, cached per head SHA) in the automerge sweep and the merge-request CI gate, and the stage-regressed comment is posted at most once per head SHA even when the stage flaps between recover and regress.
• Owner-triggered spoke backups now preserve the default bead-synth-wiki vault's markdown facts and restore them with the synthesizer's own permissions, even when repository publishing is disabled; other vaults and attachments remain excluded.
• hive/claimed-by-<who> now follows one rule for <who>: the GitHub login of the person a claim is on behalf of (kind=human, kind=contributor, kind=external markers — a Copilot CLI / Claude Code / Codex session claiming for @Someone yields hive/claimed-by-someone), and the agent name only for hive-agent claims with no human principal; a backend name (copilot, claude, codex, gemini, pi) is never a suffix. Two issues claimed the same way had carried hive/claimed-by-copilot and hive/claimed-by-clubanderson. claims.ClaimedByLabel is the single derivation; the claim relay and the claim-ledger hooks use it (the hooks now mirror the label on claim/takeover and remove the holder's label on release), and the issue stage reconciler heals a backend-named label on any open issue it sees — swapped for the live holder's login, or dropped when no claim is live. Documented under "Modifiers, not stages" in src/docs/labels-and-control-signals.md.
• Wake the governor loop when a continuous agent's re-kick cooldown elapses (at most one early eval per 30s, backing off while a due agent is paused or budget-gated) instead of waiting for the next cadence eval tick, so a continuous reviewer no longer sits idle at its prompt for up to 15 minutes after every kick on webhook-healthy spokes; /api/status agents now carry lastKickEnd and idleSince. Also map a requires_human swarm verdict to stage/085-needs-decision with the usual <!-- hive:stage-needs-decision --> entry comment naming the verdict (it was folded into no-verdict and parked at 050 indefinitely), and resolve the stage-072 contributor-nudge sink lazily so the self-authored sweep, built before the dashboard boots, actually queues relay fix tasks instead of comment-only nudges.
• Contributor-lane auto-merge no longer dead-ends a relay contributor's PR on GitHub's author_association. The lane rejected FIRST_TIME_CONTRIBUTOR/NONE authors in its list-time prefilter, before the claim-marker and registry-tier admission paths ever ran — so hive's own hive logged contributor-lane:author-association every cycle for green, 5/5-approved PRs by relay contributors at review-queue positions 1–2 for 15h+ (#12344; #12195, #12290), because GitHub reports FIRST_TIME_CONTRIBUTOR for every contributor's first PR to a repo. The association is now checked only after admission, and only when neither a verified App-authored hive:claim marker nor an operator-set registry tier vouches for the author; an unmarked, unregistered first-timer still skips with contributor-lane:author-association, which now outranks the marker path's own reason.
• Copilot agents stuck at the in-pane login now report the dashboard Copilot Login (device-flow) as the recovery path, and model-discovery self-reports for a missing Copilot credential are attributed to it (#12519, #12529).
• hivectl evidence backfill no longer skips PRs that already have a live evidence bundle without a merge event. It writes the GitHub outcome beside it as <head>.backfill.json and reports these separately as supplemented, so hive-reviewed PRs gain an outcome (#12515).
• Dashboard: the 🔬 Evidence card's charts now use the dashboard's font tokens and render at 1:1 instead of scaling with the card width, so axis, row and value labels match the rest of the Throughput section; its panels tile side by side on wide screens and the shadow-gate labels no longer run into the bars.
• Evidence card panels 4, 5 and 6 now grade what the hive actually does rather than an artifact of where the data was kept. Boundary enforcement headlines blocked ÷ every agent GitHub write in the window (hive-mediated writes from the audit log plus direct writes through the proxy, new write_activity in /api/evidence/summary; ≤ 1% Strong) instead of blocked ÷ proxied-only — the proxy's write-counters.json and the intent intent-counters.json move from container-local /var/run/hive-metrics to the /data/hive-metrics PVC with a one-time migration, so a restart no longer resets them to a handful of writes, and windows that predate the counters say so. Claim vs verdict becomes the CI gate — integrity + convergence panel under this hive's hand-off-to-CI policy (new ci_recovery.gate and ci_recovery.convergence alongside the recovery read, from an hourly GitHub check-run trail rollup under /data/hive-metrics/ci-recovery.json): grade A is gate integrity — GitHub-confirmed breaches (merged with a required check red on the merged head, judged on the base branch's required set exactly as the merge gate does — a failed optional check is disclosed, a required check with no run or a red review-time snapshot is only suspected — each listed with the check names and who merged it) ÷ merged PRs with a known merge-time state, with a red review-time snapshot disclosed as suspected rather than counted, 0 breaches Excellent · ≤ 1% Good · ≤ 3% Fair; grade B is convergence — CI passes to first green for agent PRs (1 / 2 / 3 / 4+ / never, per ISO week with the first-pass share as a neutral C1 line), Excellent at median ≤ 1.5 passes and < 5% abandoned · Good ≤ 2.5 & < 10% · Fair ≤ 4 & < 20%; the panel takes the lower. CI red at claim, swarm non-approve and the recovery of red-at-claim PRs are disclosed, not graded; in-flight and unknown PRs are counts outside every rate. Work balance answers "is the queue keeping up?" from GitHub truth: issue opens and closes for every author via an hourly durable rollup (/data/hive-metrics/issue-activity.json, audit-log fallback for earlier weeks is labelled), PR opens/merges/closes from folded bundles, week-end queue depth from governor snapshots, and issues and PRs graded separately on closed ÷ opened (Excellent ≥ 0.95 · Good ≥ 0.85 · Fair ≥ 0.70, Weak when the queue grows > 10% week over week) with the card taking the lower. Refs #12368, #12365, #12366, #12517, #12062.
• Review evidence: a bundle started after its PR already merged (automerge ran before the first swarm review wrote one, or someone else merged) now records the merge GitHub reports — actor, time, merge SHA, opened time — instead of leaving the PR with no outcome forever; record-only, nothing reads it to decide a merge.
• Evidence card: PRs with no recorded outcome (reviewed here, merged or closed elsewhere, or still open without a backfill) are now shown as an explicit "outcome unknown" count and excluded from every rate instead of being read as open / not merged / false approves; calibration buckets with fewer than 5 known-outcome verdicts are drawn hollow and unjoined; CI state follows the merge gate's reading (skipped/neutral checks are green, running checks are pending) so Claim vs verdict no longer flags every record with a skipped job; each explainer states its denominator policy.
• GET /api/evidence/summary now places a PR in the window by its open time and folds every bundle of the same PR (newest record for verdicts, forge outcome from a backfilled record), so a hive that reviews but does not merge no longer shows every reviewed PR as open and every approval as a false approve; backfilled closes count as closed, a custom range may reach back three years, and the Evidence card says "window too short — switch to 7d/30d" (from the new available_windows) instead of a bare "Not enough data" (#12513).
• Dashboard: the Experiment Lab research question is no longer clipped to 40 characters in the section header. It now uses the remaining header width and wraps when needed (collapsed or expanded), is shown as "Research question: …" without a pasted research_question: key or > marker, keeps the full text in a tooltip, and no longer repeats itself in the collapsed summary.
• Start a stopped agent selected by the governor before delivering its kick, so continuous cadence can restore a tmux session after a hive restart instead of recording a failed kick and leaving the agent stopped.
• Hub dashboard: an unescaped apostrophe in the Fleet quadrant column tooltip (#12469) broke the inline script, leaving My Hives stuck on "Loading your hives…". Fixed, and the hub test suite now parses every inline script block (unterminated-string scan + node --check).
• Issue stage labels now tell the truth about workflow state (#12570, #12571, #12516, #12481, #12560, #12528). An agent comment that escalates — opening with needs-decision/needs-direction/needs-spec/needs-human, "parking this …", or "Triage (x): not a … defect" — or a label request that only adds escalation labels is no longer read as a start signal, so the scanner parking an RFC no longer records a 2h agent claim and stages the issue stage/030-pr-in-progress with no kick running. Issues parked on a person by a hard-suppress label (needs-human, needs-direction, needs-decision, needs-spec) are staged stage/085-needs-decision instead of being left with whatever stage they had. Stage writes outside the reconciler (claim relay, claim release, in-progress sweep, PR-claim 040 sync) now go through a fresh read keyed to the item's updated_at, so a label a human removed is re-applied instead of the mutation journal replaying it as "already applied" while the log claims it was written.
• Experiment Lab "Repo Targets" pills now show which repos are selected (filled amber chip with ✓) versus excluded (dimmed outline); clicking a pill, Enter or Space toggles it and the "N of M repos watched" counter updates live (#12520).
• Dashboard Projects: the cross-repo "Needs human" filtered list now actually replaces the repo cards (.repo-grid display:flex was beating hidden), the 🐝 Swarm header sits directly above the cards it describes and hides with them, the list gets its own persisted collapse chevron, and the header hint says how to collapse/close it and where to reopen it.
• Re-arm review after PR body/title edits invalidate a non-approve verdict and surface requires_human reviewer summaries in the needs-decision handoff.
• Route reviewer-deferred maintainer calls to stage/085-needs-decision instead of leaving the PR at review-pending/stalled when the review comment/verdict asks for a human decision.
• Fixed the scale-envelope.md citation of RankActionableIssues that drifted after #12468 and turned the docs-links check red on every open PR.
• Validating a hub snapshot_url that still carries a legacy query or fragment now logs the warning once per distinct URL per process, instead of on every config validation, reload and dashboard hub save (#12445).
• stage/100-merge-queue is no longer applied while a non-required check on the PR head is red: the CI gate now reports the red optional checks it walks past (CommitCIState.FailingNonRequired) and the stage engine holds such a PR at stage/080-awaiting-merge-admission with reason optional-check-failing:<check> (named in the stall note); a red required check stays 072/070, and a note for an older head does not bind a new one (#12538, seen on #12457).
• Stage labels: issue stages (010–040) and PR stages (050–100) are now disjoint and stagelabels.Enforce / EnforceStage clamp every write to the item's kind, so a PR-only stage can never land on an issue and vice versa. The issue reconciler no longer mirrors the covering PR's stage onto the issue: a covered issue stays at stage/040-covered-by-pr and the PR's own stage is recorded in the issue's stage reason (open PR #N covers it (PR at 060-reviewed)). This is what left #12451 wearing stage/010-actionable + stage/040-covered-by-pr + stage/050-review-pending at once (the mirrored 050's remove was stuck behind an unresolved mutation-journal op on the pre-#12526 build) and #12483 a lone stage/050-review-pending. An issue's store record never holds a PR stage any more, so a PR falling back (100 → 060) no longer reads as the issue regressing. Reconcile log lines carry clamped / wanted. hive/partially-addressed and hive/verified-open are documented as merged-PR evidence modifiers, orthogonal to the stage (#12451).
• stagelabels: every stage write (PR lanes, issue reconciler, claim-ledger hooks) now goes through one enforcer that re-reads the item before writing and leaves exactly one stage/NNN-* label, healing items found with two; the hub journals those label writes against the item's observed updated_at so a stage label another writer put back can be removed again instead of replaying as an already-applied no-op. A contributor claim landing after the reconciler staged an issue 010 no longer leaves 010 and 020 side by side (#12525; seen on #12512, #12516, #12443)
• Stage labels: a weak admission opinion (contributor-lane:no-claim, untrusted-author-role, …) is no longer written while a lane enabled for the repository is missing from the same reconcile pass. Two sweep drivers share one tracker, so a maintainer PR the trusted-author lane had already admitted was flipped to stage/090 and back (stage/regressed) whenever a drain split its observations; the trusted-author lane already auto-merges approved human PRs and now keeps their stage steady.
• Stage labels: any red check on the PR head — required or not — now puts the PR in stage/070-fixing / stage/072-returned-to-contributor (reason optional-check-failing:<check>, every red check listed in the contributor nudge), never stage/080-awaiting-merge-admission or stage/100-merge-queue; the earlier fix held a red optional check at 080. Parking modifiers (hold, needs-human, admission reasons) still take precedence (#12538, seen on #12457 and #12423).
• Fixed the v5 test baseline: TestApplyStageLabelsWeakOpinionWaitsForEveryLane (#12574) still asserted the retired stage/090-needs-human label for a no-reviewer hand-off, which #12531 now routes to stage/085-needs-decision; the two PRs merged minutes apart without a rebase, turning test (rest 3/5) red for every PR (#12590).
• The supersession sweep no longer flags a live PR as superseded, and no longer re-applies needs-human every cycle after it was cleared. The sweep treated every issue a PR mentioned as a supersession candidate, so #12322 — Fixes the open #12117, Part of the closed parent #12080 — was escalated to needs-human as "also claims another issue that is still open", and got the label back 20 minutes after an operator removed it because the label add ran unconditionally once the notice existed (#12349). Now only closing-keyword issues are candidates when any exist (bare Part of/Refs references are context; a PR with no closing keyword still falls back to its branch-name issue and references), a PR with any open candidate is left alone entirely, and an unchanged notice never re-labels — a different merged PR or reason rewrites the notice and escalates afresh.

Security

• The public /api/registry and /api/saas/my-hives endpoints no longer expose the spoke compliance profile and posture-check summary to unauthenticated callers or non-admin members (#12264).
• Validate and normalize hub.snapshot_url on config load and in PUT /api/config/governor/hub: require an absolute http(s) URL with a host and no credentials, and trim trailing slashes; the dashboard also rejects query strings and fragments, while config load warns and preserves legacy values carrying them verbatim (#12356, #12420).
• The gh wrapper's PR-ownership cache (/tmp/.hive-labels-ensured-owner-*, introduced with the #12545 authorship gate) now only records and only honours a negative verdict. A positive "this PR is ours" answer is re-verified against the PR author on every call instead of being read back from a file in world-writable /tmp, so a planted yes can no longer make a lane stamp agent/<lane> on — and the hive claim ownership of — a contributor's PR (#12602).
• Transitive proxy-addr moves from 2.0.7 to 2.0.8 in the dashboard/ and src/proxy/ lockfiles, picking up the fix for IPv4-mapped IPv6 peers being mis-classified as inside a trust proxy subnet. Neither service sets trust proxy today, so this is hygiene rather than a live hole; it clears the remaining npm audit --omit=dev finding in dashboard/ (#12604).

---

SBOMs: SPDX JSON, generated by Syft against the linux/amd64 image digest, attached below for hive, hive-contributor, and hive-hub. They cover linux/amd64 only — see releases.md for why linux/arm64 is not scanned separately.

NOTICE: third-party license attribution for the Go module dependencies compiled into these images, attached below. Does not cover base-image OS packages or the Node.js/tmux layers built from source — see releases.md for the exact boundary.