v5.182.0

Added

• Add a separate Hive-self experiment model and validated persistent ledger in pkg/nous, with opt-in cohorts, pre-registered metrics and fast-fail bounds, and explicit missing-evidence results.
• hivectl evidence backfill-issues writes weekly GitHub issue-open and issue-close series files for reporting and downstream evidence readers (#12517).
• Self-merge review gate (shadow by default). Immediately before the hive merges its own PR, the self-merge sweep now reads the swarm review verdict for the head SHA and classifies it as no-review-bundle, awaiting-review-approval, changes-requested:<perspectives> or approved. New knob governor.review_gate.mode: off | shadow | enforce (default shadow): shadow records shadow.review_gate (lane: self-merge) in the evidence bundle and merges as before; enforce holds anything but approved with reason review-gate:<outcome>. review.require_approval raises the gate to enforce and review.shadow to at least shadow; all are re-read on every evaluation. Each evaluation writes a review_evaluated audit line, the bundle is started when none exists so the merge and CI snapshot are never lost, and the Evidence card's Shadow gates panel splits the review gate by lane (review_gate_by_lane). See docs/hive-merge.md#self-merge-review-gate (#12592).
• Provider auth and provider availability are now reported as two separate dimensions (#12611, ADR-0024). Each agent's backend-auth evidence gains backendAuthRefreshable (for Claude: whether a CLI restart heals an expired access token, so no login is needed). The spoke rolls its enabled agents up per provider into a redacted providers[] block (auth_state, availability_state, since, evidence, next_action, affected_agents). It appears on /api/status, in the hub heartbeat, as a providers row on /fleet and as a Providers chip in the spoke header, so "not authenticated" no longer reads as "provider unavailable". The spoke heartbeat now also carries the per-agent backendAuthStatus fields that the hub's auth_health roll-up reads. This is read-only status: hive does not refresh, warm or pool credentials. Set providers.status.enabled: false to omit the block.
• Add Nous observation recovery tracking with a seven-day lifecycle, hub-relayed recovery comments, and issue closure.
• adoption: use live relay presence and adopt offline clanker PRs after 15m (#12676)
• Hive activity monitor now lists every open issue and PR (claimed, in-progress, needs-* filtered, draft and exempt items were being dropped), adds text / label / age / author / needs-attention filters, four sort orders, paging with counts, and serves /api/stage-tracker from a server-side cache with ETag so it never calls GitHub per request (dashboard.stage_tracker.cache_ttl_s).
• hivectl evidence backfill --refresh-fields merge.opened_at fills merge.opened_at on bundles an earlier backfill already wrote, only where absent and from the list page alone (no per-PR requests), so pre-#12465 backfills gain a measurable time to merge without a delete-and-rewrite.
• Inception Campaigns: a 🗑 icon button (in-app confirm) and DELETE /api/campaigns/{id} remove a stale campaign record while keeping knowledge-base facts and Jam threads; Revise chains now fold into one row with a rev N pill and an earlier-revisions disclosure instead of one identical row per click (#12698).
• Show Nous baseline and experiment progress with result links in the Experiment Lab.
• Experiment Lab: run several experiments at once. Each research question is an Inception-style card (question, scope pills, status, stage line saying what happens next, per-card baseline "N / 672 ≈ 7 days of observations (4/hour)" with an ⓘ, Pause/Resume/Archive) plus "+ New experiment"; a confound guard refuses two running experiments on the same repo target (or both hive-wide) with an in-app warning offering to pause the other or narrow the scope. New GET/POST /api/nous/campaigns and PATCH /api/nous/campaigns/{id}; status.campaigns lists every campaign with stage/nextAction. A completed baseline in Observe mode now shows a single "Generate proposals" button instead of telling the user to switch modes; the Principles tile explains why 0 is normal; /api/nous/status reports the live mode. The research question no longer appears in the section header (#12498) — it lives only on its card. (#12532)
• Apply an origin/<source> provenance label to every hive-created issue: Client.CreateIssue requires an origin and injects it, the GitHub proxy injects origin/<lane> into an agent's own gh issue create, selfreports carry origin/selfreport next to the deprecated hive/selfreport, and the one-time startup migration (v3) backfills the axis on open hive-authored issues from agent/<lane> / hive/selfreport.
• Enrolled Hive in Anthropic's OSS Scanner: .oss-scanner/Dockerfile builds the v5 tree offline-ready (toolchain, module cache, hive/hivectl/bd/hive-backup/apiproxy binaries, tmux) and .oss-scanner/threat_model.md tells the scanner where untrusted input enters (GitHub content in agent prompts, the policy proxy and relay boundary, hub and dashboard auth, tenant isolation), how to rate severity, and what to leave alone. Findings arrive privately by email to the maintainers; SECURITY.md says so.

Changed

• Changed the DCO signal on PRs from Prow's dco-signoff: yes / dco-signoff: no to a hive-owned pair the stage pass writes from the PR's commits: green dco (same green as role/trusted, "All commits are DCO signed-off") when every non-merge commit on the head carries a Signed-off-by: trailer, red no-dco otherwise. The pair is registered in the stage label table, provisioned and recoloured in place by the same ensure step, planned idempotently, read once per head (cached in the stage store), and the legacy Prow pair is removed from an open PR once the hive has read its head. A missing sign-off now sends the PR to stage/072-returned-to-contributor (070-fixing when self-authored) on the first evaluation of the head — before CI or a reviewer verdict — with reason dco-missing, and the contributor nudge / relay fix-pr names the exact fix (git rebase --signoff HEAD~<n> && git push --force-with-lease). The 072 routing is per repo: it applies only where a dco/DCO context is required or reported on the head (detected during the lane's CI walk) or where governor.labels.stage.dco.required sets it; elsewhere no-dco is informational and the stage is unchanged. The merge-eligible export reads the new labels first and the legacy pair as a fallback during migration. Closes #12542.
• Evidence card: advisory blocks are dissent, not false blocks. reviewer_accuracy_by_model in /api/evidence/summary now splits blocks by the bundle's policy.require_approval into enforced_blocks and advisory_blocks (with merged_after_enforced_block, dissent_before_merge and per-split unknown counts; totals and rows are kept). The false-block rate counts only blocks an enforcing gate was overridden on; advisory blocks that preceded a merge are reported as dissent before merge (count and share), so a hive with review.require_approval off no longer shows a red "false block" rate (#12595).
• changelog: move misplaced fragments from src/changelog.d to changelog.d (#12675)
• Stage-074 adoption now sees live relay presence (the late-bound nudge sink did not expose it, so every clanker PR waited the nudge-time grace) and adopts an offline or unregistered clanker's PR 15 minutes after its last heartbeat/nudge (after_offline, after_unregistered, contributor_grace_offline defaults were 30m/2h/1h). An online clanker keeps its 2h grace.
• Settings and docs now state that auto_merge.contributor_lane.soak_minutes: 0 means the built-in default rather than an instant merge (the operator reference previously claimed the opposite), and that default drops from 120 to 30 minutes so reviewed contributor PRs stop parking for two hours.
• Retitled the hub landing page hero slide headlines with value-led copy while keeping the ledes unchanged.
• Rename the review-backlog provenance label origin/review to origin/reviewer ("filed by the reviewer swarm"; provenance only, distinct from the agent/reviewer routing label). review.backlog.labels accepts from-review and origin/review and maps both to origin/reviewer; at startup the hive swaps either retired name for origin/reviewer on open items once and deletes the retired origin/review label definition from each repo.
• Fleet self-report issues now list each affected hive on its own line of the Affected hives block with the GitHub login(s) of the hive owner(s), its anonymous instance id and per-hive seen/last-seen counters (- <hive> (instance <id>) — owner(s): @login — seen N, last <time>), and the Evidence table gains an owner(s) row, so maintainers can see who is affected and ping them. Owner logins come from dashboard.authorized_users owner-role entries and the device-flow operator, travel as an explicit owners field (the hub relay fills it from its own owner record for older spokes and edits the block in place when it joins), and governor.fleet_report.include_owners: false renders (anonymous) instead. Existing inline Affected hives lists are upgraded on the hive's next join.
• Added stage/071-needs-author ("Needs author", dwell 24h) for human-authored red PRs — CI red, changes requested, DCO missing or conflicting; the hive has posted its diagnosis and the person must act. stage/072-returned-to-contributor keeps its slug, colour and "Returned to contributor" word but is now only for author/clanker PRs (the contributor hive is nudged / adopted as before); hive-authored PRs stay at 070-fixing. 071 is author-blocked everywhere 072 was (dwell/stall, needs-rebase → 07x, regression rules, tracker CI / Review word with the author-kind icon, "Needs attention" filter); humans at 071 are never nudged or adopted. On upgrade the reconciler provisions the new label and, on a repo that picked up the short-lived #12713 spelling stage/072-needs-author, renames it back to stage/072-returned-to-contributor in place (items keep their stage); no existing item changes stage except human-authored PRs currently wearing 072, which the next sweep re-derives to 071.
• Retire the needs-direction and needs-decision labels: stage/085-needs-decision is now the single "parked for a maintainer ruling" signal (hard-suppressed at enumeration, cleared by /hive approve / /hive decision). The issue relay, dedupe reclassification, and policies write the stage label; agents may add it (and only it) through the label relay. The issue stage reconciler migrates open items still carrying a retired label (085 added, then the old label removed) and deletes the two label definitions from a repo once nothing open carries them. Dashboard bands, the stage tracker, and the Needs-human preset key on the stage label; needs-human is unchanged (#12683).

Fixed

• Give the Hive-self experiment ledger its own ExperimentStore API so it builds alongside the existing nous campaign store.
• dashboard: list every open activity-monitor item (#12707)
• review: fold digestless perspective reports into the head's aggregate (#12708)
• Fix adopted contributor PRs dropping stage/074-adopted-by-hive for stage/050-review-pending as soon as the hive's fix went green: adoption is an ownership state, not a CI state, so a live adoption (in place and not yielded, or superseded at this head) now reads 074 whatever the lane sees — pending, green, reviewed or red — until the merge gate (080/085/090/100) takes the PR or the adoption is released; the reconciler heals a drifted 050 back to 074, and a contributor push over a green in-place adoption now yields it (#12736).
• Stage-074 adoption now counts the grace from last_nudge_at for contributor PRs whose stage record was nudged before first_nudge_at existed; those records (nudged by an earlier build) previously never became due for adoption.
• In-place adoption no longer yields the PR back to an offline contributor when the hive's own fixer agent pushes: a push now releases the adoption only when it is attributable to the PR author, so fixer commits with a bare git identity (no GitHub login) keep the adoption instead of bouncing the PR to 072 and re-adopting it 15 minutes later.
• Contributor-lane auto-merge soak now measures from when the head went green on GitHub (latest check-run completed_at), seeded once per head, so hive pod restarts and candidate rolls no longer reset an in-progress soak back to zero.
• Dashboard Experiment Lab: "+ New experiment" and ✎ Edit now open a modal dialog ("New experiment" / "Edit experiment #N") instead of sharing one inline slot where Edit silently replaced an open New draft; only one dialog opens at a time, Esc / Cancel / backdrop close it and focus returns to the trigger. Small breathing room added between the stat tiles and the Experiments card, between form labels and their fields, and between a card's title, meta row and stage / baseline lines (#12697).
• Connected contributor agents cards label the relay's advertised slot count "max parallel" (it is the contributor's setting) and size the status and tier pills identically.
• governor: stop fold/verify comment storms on canonical finding issues — same-component folds edit the existing <!-- hive-finding-folded --> comment instead of posting a new one per variant, build artefacts (dist/, coverage*/, lcov.info, *.min.js, lock files) no longer count as shared citations, agent verification markers are posted once and a claim right after a verification is refused, and unattended comments are capped at 5 per issue per day (HIVE_ISSUE_COMMENT_BUDGET_PER_DAY) (#12733)
• Hive activity monitor: an issue parked on stage/085-needs-decision with no covering PR now lights the Actionable chevron (the issue side) with "Needs human decision" instead of the Merge gate, no longer shows Claimed → CI / Review as passed, drops the "(its PR)" suffix, and sorts at Actionable under "Furthest along" rather than above every PR. An issue whose covering PR sits on 085 still rides the PR's merge gate.
• Hive activity monitor: a pull request is never rendered as its own parent issue. Standalone PRs are named once on the left of their row (kind icon, author-kind icon, #N title) over a single continuous strip; the PR in progress column carries only covering PRs. Server-side, /api/stage-tracker drops issues-feed copies of pull requests, keys issue↔PR pairing on (repo, kind, number) and never self-links an item.
• Fixed the Hive activity monitor repo filter: the <select> no longer inherits the dashboard button chrome, so it is chip-sized (same height, font and pill radius as the All / Pull requests / Issues chips, single token border) and never overlaps its "Repo" label.
• Hub dashboard: the per-agent restart-storm badge now shows the real 24h restart count. The verdict row the badge read never carried the spoke's restart ledger, so it rendered "agent restarts: guide ×0/24h" next to a storm of ×23 (#12466). The verdict JSON now includes restarts, and the badge falls back to the count embedded in restartProblem when a hub omits it.
• Hub dashboard: grouping hives by upgrade state no longer files hives that are 100+ commits behind under "Up to date". Hives behind their target with no rollout in flight and nothing queued now get their own "Behind target (no upgrade pending)" group, sorted between Upgrading and Up to date (#12466).
• The merge-eligibility sweep now routes PRs carrying prow's needs-rebase label to the conflict fix lane (ci-failing.json) instead of skipping them; conflicting hive-authored and adopted contributor PRs were never rebased once prow labelled them.
• List configured project repositories in Nous Experiment Lab repo targets.
• Review aggregation now folds perspective reports that omit body_digest into the digest-keyed aggregate for the same head; keyed apart they produced two incomplete ledger items and a 5/5 approval never became merge-eligible (#12332, #12421, #12674).
• Stage-label provisioning no longer aborts with 422 description is too long: the 074/085/090 label descriptions fit GitHub's 100-character cap, every provisioned description is clamped at the API edge, and a test guards the limit. The failure had stopped the whole stage reconcile — including offline-contributor adoption — on every repo.
• hive-open-pr now checks title claims (workflow/test/migration) against the full paged compare file list, so large diffs whose matching files sit beyond the first 300 are no longer wrongly rejected (#12666).
• Agent: token-triggered login restarts are now bounded to 3 per rolling 24h per agent. A Copilot CLI whose credential is present but rejected boots to a clean prompt every time, which legitimately re-armed the per-boot cap after every restart, so the heal fired as "attempt 1 of 3" 5–17 times a day and the hub reported restart storms on six hosted hives (#12466). An operator reset/resume still clears the window immediately.
• The un-park sweep (/hive approve, /hive decision, label-driven approval) no longer removes needs-human: a maintainer's decision supplies a ruling, not the human-held identity, consent or operator step the label asks for, so the issue stays at stage/085 and out of the agent queue. Agents may add needs-human through the relay label command and must /unclaim when an owner's direction reserves the work for people; the relay refuses an agent's re-park on stage/085 while approved-direction is present and the recorded decision is unchanged. The good-first-issue labeler always skips issues carrying needs-human, stage/085, the retired park spellings or a hive/claimed-by-* label.

---

SBOMs: SPDX JSON, generated by Syft against the linux/amd64 image digest, attached below for hive, hive-contributor, and hive-hub. They cover linux/amd64 only — see releases.md for why linux/arm64 is not scanned separately.

NOTICE: third-party license attribution for the Go module dependencies compiled into these images, attached below. Does not cover base-image OS packages or the Node.js/tmux layers built from source — see releases.md for the exact boundary.