🐝 Hive Advisory Report

This issue collects advisory findings from Hive agents.

At lower ACMM levels, some agents work in advisory mode — they analyze code and post findings here but do not create issues or PRs. At higher levels, designated agents (e.g. quality) can open issues and PRs directly, while other agents remain advisory-only.

The governor posts periodic digest comments summarizing what advisory agents found.

Do not close this issue. It is a living document.

— hive: agent=governor

🐝 Advisory Digest — 2026-11-06 08:55 EST

Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

Advice

Frozen for governor mode IDLE until 2026-11-11 (next review in 5 day(s)). The list of recommendations is frozen; their numbers, items and links are recomputed on every digest.

Counts quoted: governor actionable queue 1 PRs / 0 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 1 open PRs / 0 open issues (every open or held item across repo cards; the queue-health advice counts these).

Reduce the blocked PR queue — 1 of 1 open PRs (100%) are Blocked. 1 of 1 have merge conflicts — rebase or close the oldest. (signals: overview_open_prs=1, blocked=1, blocked_pct=100, failing_ci=0, merge_conflict=1, verdict_blocked=1, stale_blocked=0, oldest_blocked_days=1, top_repo=endusers (1, 100%), top_author=github-actions[bot] (1, 100%))
- First: endusers#2112 (merge conflict; verdict blocked: blocked — CI pending)
- Full list: Blocked PRs (CSV), Blocked PRs in endusers (CSV)
Widen HIVE_REPOS — The governor's actionable backlog is shallow in a low-pressure mode; adding repositories can feed more work to the hive. (signals: mode=IDLE, repo_count=1, governor_queue_total=1)

Bands named above (same rules as the Overview chart):

Blocked (PRs): blocked sweep verdict, merge conflicts, or failing CI — read the verdict, rebase, or fix the checks

Findings: 10

💡 Showing top 10 findings (by severity). 571 more exist. Set governor.advisory.show_all: true to see all.

Severity	Count
🟠 high	10

🟠 HIGH (10)

[advisory] Shared-CI incident [quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096 (classify job, node not found on self-hosted) deferred PRs Redirect architectures.cncf.io to the catalogue like architecture.cncf.io #2095 and test: require a Node setup step before a job runs node #2097 with hive-shared-ci-2096 markers cncf/endusers#2096 ci-maintainer
[advisory] Accessibility gate never evaluated axe heading-order; 8 published pages skip a heading level tests/e2e/accessibility.spec.js quality

axe tags heading-order cat.semantics/best-practice, so the WCAG_TAGS filter in tests/e2e/accessibility.spec.js (wcag2a/2aa/21a/21aa) never ran it, despite the file's header naming 'a heading level skipped by an MDX edit' as a regression it catches. Unit evidence: n/a (browser-rendered rule). End-to-end evidence: npx playwright test tests/e2e/accessibility.spec.js at 0cb2477 with the rule enabled reports heading-order on /, /community, /community/members, /community/technical-advisory-board, /community/awards, /resources/radar-reports, /blog/archive, /community/get-involved and 3 interactive states, in both colour modes; 120/120 pass once baselined. Provenance: local production build of cncf/endusers main 0cb2477.
[content-defect] members.json holds Mercedes-Benz twice: /community/members shows an 'End User Member' card and a 'Membership not specified' card for the same organization data/members.json quality

On main d19bbf2, data/members.json carries two records for one organization: id mercedes-benz (name 'Mercedes Benz AG', membershipStatus 'member', from the CNCF landscape Silver member record, enduser true, joined 2020-08-01, no awards) and id mercedes-benz-tech-innovation (name 'Mercedes-Benz', membershipStatus 'unknown', carrying the 2023 Top End User Award). A production build renders both as separate cards in build/community/members/index.html; membershipLabel() maps 'unknown' to 'Membership not specified', so the card holding the Top End User Award reads as not a member, and filtering the directory to 'End User Member' hides it. Reproducible: npm run generate:members on d19bbf2 regenerates data/members.json content-identical, so this is a live generator defect, not stale committed data. Root cause: DISPLAY_NAME_OVERRIDES renames the award source 'Mercedes-Benz Tech Innovation' to display name 'Mercedes-Benz' but leaves its id/slug mercedes-benz-tech-innovation, while mergeLandscapeMembers() matches landscape records by exact display name only; 'Mercedes Benz AG' matches nothing and a second member is created. Neither existing guard fires: the ambiguity guard needs >1 exact name match, and the id-collision guard does not fire because the ids differ.
[missing-workflow] ci.yml classify job runs node with no Node setup; fails on self-hosted runners .github/workflows/ci.yml quality

ci.yml job 'classify' (Classify changed paths) invokes 'node --input-type=module -e ...' with no Node setup step; it is the only job in ci.yml that does not use ./.github/actions/setup-node-deps. It relied on Node being preinstalled on the GitHub-hosted ubuntu-24.04 image. Run 41475921935 (PR 2095, head b97cef8) routed every job to the CNCF self-hosted 'gpus' runner group (runner cncf-c-ubuntu-24.04-16-64-x86-2xrtxpro6000-bdf7b-runner-g7wwt), whose image has no node on PATH: job 125381334634 failed with 'node: command not found' exit 127. The four jobs in the same run that use setup-node-deps (Validate/Lint/End-to-end tests/End-to-end coverage) all passed on the same runner group. Run 41458212840 at 14:02Z passed on a GitHub-hosted runner, so the failure tracks runner routing, not any PR diff. Fix: add actions/setup-node@949feb2 (v7.1.0) with node-version '22' before the classify step; the classifier imports only node: builtins so npm ci is not needed.
[regression-risk] ci.yml classify job fails on gpus-group self-hosted runners: every ci.yml run since 2026-11-02T15:52Z is red on a required gating check .github/workflows/ci.yml quality

Filed as cncf/endusers#2096; guard PR test: require a Node setup step before a job runs node #2097 (held). NEW evidence this kick: the gpus routing began 2026-11-02T15:52Z and has hit 100% of ci.yml runs since. Run 41475921935 (PR Redirect architectures.cncf.io to the catalogue like architecture.cncf.io #2095) on runner cncf-c-ubuntu-24.04-16-64-x86-2xrtxpro6000-bdf7b-runner-g7wwt and run 41479256008 (PR test: require a Node setup step before a job runs node #2097) on ...-runner-jrrws both failed 'Classify changed paths' with node: command not found (exit 127); every ci.yml run at or before 14:02Z was on GitHub-hosted runners and green. Two different gpus machines => runner-group image, not one bad host. classify gates every other job via needs: classify, so the required-check rollup is red on both PRs. Workflow-scan on main confirms classify is the ONLY job in any workflow that runs node/npm/npx with no preceding setup step, so the one-step ci.yml fix in [quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096 is complete. Unpushable at this token tier (no Workflows permission).
[regression-risk] PR test: require a Node setup step before a job runs node #2097 closed its own blocker: Fixes [quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096 rewritten to Refs so the unfixed ci.yml classify bug survives merge .github/workflows/ci.yml quality

PR cncf/endusers#2097 body read 'Fixes [quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096' while its prose said [quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096 must stay open for the ci.yml change the PR cannot push (no Workflows permission at this token tier). GitHub honours the keyword, so merging test: require a Node setup step before a job runs node #2097 would have auto-closed the live fleet-wide CI bug with no fix landed. Rewritten to 'Refs [quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096 (needs-human: ...)' per AGENTS.md ('a PR that does not complete an issue's deliverable says Refs, never Fixes'). Verified via GET /repos/cncf/endusers/pulls/2097 after PATCH: line 63 now reads 'Refs [quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096'.
[regression-risk] PR 2072 Lint repository check fails on its own new file src/theme/BlogArchivePage/index.js src/theme/BlogArchivePage/index.js quality

Required check 'Lint repository' red on cncf/endusers#2072 (head ed46e5d). Job 124960755116: eslint no-unused-vars, 'React' is defined but never used at src/theme/BlogArchivePage/index.js:13 — Docusaurus 3 automatic JSX runtime makes the import unnecessary. PR-local (FIX_DIFF), not a shared-CI incident: the file is new in that diff and main's checks are green. Scanner lane owns the branch; diagnosis commented on the PR, no push made.
[security-advisory] Moderate advisory GHSA-3g3m-2fjr-6pw4 (glob 13.0.6) is in the tree with no written decision and a reachable fix package.json quality

npm audit on 52275da reports 28 moderate findings; 27 trace to GHSA-g3hv-75wg-m249 (minimatch, accepted in SECURITY.md) and 1 to GHSA-3g3m-2fjr-6pw4 (glob 13.0.6, 'AbortSignal cancellation bypass allows post-timeout filesystem traversal', patched 14.0.2), which is absent from the accepted moderate register. Sole dependent: stryker-mutator/tap-runner (~13.0.0), which calls glob(patterns,{ignore,posix}) once. Verified: adding "glob": "^14.0.2" to package.json overrides resolves glob to 14.0.3, drops moderate count 28->27, and a stryker --dryRunOnly discovers and passes all 239 test files; knip, eslint and tests/lockfile-overrides.test.mjs stay green.
[user-observable-defect] Concluded conference pages still tell readers the schedule may change src/components/EndUserTalkSchedule/index.js quality

Verified on a local production build of main 882b433 (npm run build, SUCCESS). build/events/2026/{kubecon-china,kubecon-japan,kubecon-india}/index.html each render 'Times, rooms, and speakers may change; check the live official schedule for updates' although those conferences ended 2026-09-09, 2026-07-30 and 2026-06-19 (data/end-user-talks/.json days). scripts/collect-end-user-talks.mjs already classifies all three as final: npm run collect:end-user-talks printed 'Skipping ; its schedule is final' for each and refreshed only kubecon-na-2026. Hydration-safe fix: compare schedule.days.at(-1).date with schedule.generatedAt.slice(0,10), both in the snapshot, so server and client agree. Fix is in src/, which the hold-gated quality lane may not PR.
[advisory] endusers: 'Classify changed paths' red on PRs Redirect architectures.cncf.io to the catalogue like architecture.cncf.io #2095/test: require a Node setup step before a job runs node #2097 is a shared incident (gpus self-hosted runner ships no node), tracked in [quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096 #2096 scanner

☑️ Recently Closed — Fix Not Verified (10)

Closed on an agent's word or a hive heuristic (a merged PR's title matching the finding, or the issues/PRs it cites closing). The hive did not re-check the condition, so it may still hold.

Do not re-sweep: cncf/endusers main 001d74d is green on every local gate; only live defect is the gpus-runner classify incident ([quality] ci.yml classify job runs node with no Node setup and fails on self-hosted ubuntu-24.04 runners #2096) AGENTS.md quality — closed Nov 3 (the issues/PRs it cites closed), fix not verified
CONTRIBUTING.md still cites a weekly full-tree mutation run that Remove agent work feeds and check agent PRs for a Remit line #1850 removed CONTRIBUTING.md quality — closed Oct 23 (the issues/PRs it cites closed), fix not verified
e2e accepted-region staleness is reported without saying the span merely moved, so rationale gets deleted tests/tools/e2e-coverage-report.mjs quality — closed Oct 23 (the issues/PRs it cites closed), fix not verified
6 verified-equivalent mutants in uri-safety/url-safety report as Survived, not Ignored scripts/lib/uri-safety.mjs quality — closed Oct 22 (the issues/PRs it cites closed), fix not verified
profileImageUrl userinfo and trim guards survive mutation (6 survivors, 87.76%) scripts/lib/profile-image.mjs quality — closed Oct 22 (the issues/PRs it cites closed), fix not verified
CONTRIBUTING.md e2e runtime-drift guidance is not monotonic: node v26.12.0 measures below the pinned major CONTRIBUTING.md quality — closed Oct 21 (the issues/PRs it cites closed), fix not verified
e2e --check-source-regions floor stale at 96 while main sustains 97.33-97.48%; ten regions of silent slack .github/workflows/ci.yml quality — closed Oct 21 (the issues/PRs it cites closed), fix not verified
Every uncovered src region in the e2e report is demonstrably executed in the browser (region-attribution ceiling, not a test gap) tests/tools/e2e-coverage-report.mjs quality — closed Oct 21 (the issues/PRs it cites closed), fix not verified
DirectoryFreshness all-absent return-null arm is unreachable in e2e because MetricsDashboard throws on an unparseable metrics.generatedAt src/components/MemberDirectory/DirectoryFreshness.js quality — closed Oct 19 (the issues/PRs it cites closed), fix not verified
e2e coverage artifact records no revision, so stale coordinates read as live findings tests/tools/e2e-coverage-run.mjs quality — closed Oct 19 (the issues/PRs it cites closed), fix not verified
…plus 6 more closed without a verified fix in the last 48h, collapsed so the open findings above stay readable

Analyzed at cncf/endusers@10a59105f329 (branch main) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked ⚠️ were computed at an older commit and have NOT been re-verified here.

Maintainer-approved queue reconciliation: 2026-10-21

The prioritized review and explicit maintainer authorization supersede stale
recommendations in the generated digest. Keep this living advisory issue open.

Resolved or deliberately closed

Finding	Authoritative disposition
No mutation harness or CI gate	Delivered by merged #1731; #1729 was explicitly closed as delivered. Competing #1733 and #1735 are closed as superseded. Do not add another harness or replace the existing npm script.
MetricsDashboard throws on invalid generatedAt	Fixed by merged #1657. The old reproduction does not describe current main.
Automation PR signoff/labels/delete-branch/forwarding unasserted	Addressed by merged #1668, closing #1667.
Mirrorable asset extension security boundary unasserted	Addressed by merged #1643, closing #1642.
URL.pathname migration blocked on duplication	#1612 merged; competing #1615 is closed. Do not treat the old PR failure as current work.
Member-directory card accessible-name mismatch	Fixed by merged #1635, closing #1630. This does not resolve the separate navbar-search issue.
Publish-time MDX admonition preprocessing bypass	#1741 merged after the coverage repair, closing #1740. The rewrite-aware scan and regression cases remain intact.
Browser fixture for null groups	#1742 closed as not planned under ADR 0007. Invalid build-time data is not a production user-reachable interaction state.

Correct the remaining coverage interpretation

Issue #1736 is now a bounded maintainer decision about conservative cross-chunk
region attribution. It is not completed and is not a request for more data-shape
fixtures or a 100% browser-region floor.

The initial claim that 19 of 20 regions were proven executed was superseded by
the later analysis of 11 with cross-chunk evidence and 9 unproven, followed by the
PeopleFreshness correction. "Unproven" does not mean "unexecuted." A proposed
reporter change still needs evidence that it cannot credit tree-shaken or
source-map-overlapping code. ADR 0007's 96% browser-region floor remains.

Additional merged fixes, not new findings to file

fix: gate Stryker break threshold to the pull_request lane #1744 merged, closing [ci-maintainer] Scheduled full-tree mutation run fails weekly on main: score 82.09% under break threshold 83 #1743. Scheduled full-tree mutation runs are report-only;
local and pull-request runs retain the threshold. The merge queue also caught
an environment-dependent test failure, repaired on that same PR before merge.
ci: run dependency audits daily #1749 merged, closing [ci-maintainer] audit-schedule.yml runs weekly — a new GHSA breaks every open PR at once with up to 6 days of no signal #1737. The dependency audit now runs daily at 07:47 UTC.
Daily scheduling reduces detection latency; it does not guarantee discovery
before every pull request.
refactor: centralize sourceUrl and id-dedup checks across case-studies/radar-reports validators #1739 merged, closing [architect] Duplicated sourceUrl/id-dedup validation harness in validate-case-studies.mjs and validate-radar-reports.mjs #1738: the duplicated source URL and ID checks now share
the existing validation utility module.
refactor: group duplicated landing-page card shell/body CSS #1746 merged, closing [architect] Duplicated landing-page card shell/body CSS across 5 variants in custom.css #1745: the identical landing-card CSS declarations are
grouped and the clone ceiling is lowered.

All five merge items (#1741, #1744, #1739, #1746 and #1749) landed through the
normal merge queue after required checks passed. No ruleset or check bypass was
used.

External blockers remain open

a11y: search button accessible name does not contain its visible label (WCAG 2.5.3) #1618: wait for a conforming upstream search-plugin release. The digest's
"fixed by swizzling" statement is incorrect: fix: give the navbar search button an accessible name containing its visible text #1631 was closed unmerged because
the maintainer chose the upstream path. Do not restart a local swizzle.
DNS cutover to endusers.cncf.io: add Netlify custom domain and point DNS (external dependency) #1433: keep one tracker for CNCF DNS and Netlify custom-domain configuration.
This is an external infrastructure dependency, not another repository change.
Do not revive the retired GitHub Pages/CNAME workflow work.

The generated digest should reconcile against these actual merged, closed, and
explicitly deferred dispositions rather than treating every retained finding or
agent "done" marker as an actionable issue.

P2 handoff: external Hive intake and reconciliation

This is an operator handoff, not a claim that Hive configuration was changed.
The repository has no Hive configuration or authorized-repository allowlist;
the orchestrator's project.repos, intake prompts and reconciliation state are
maintained externally. Please apply these requirements there.

The maintainer-approved reconciliation in
#23 (comment) remains
authoritative. The generated digest still repeats superseded findings, including
"no mutation-testing gate", the merged automation-PR policy tests and the closed
null-groups browser fixture. A digest footer naming current main does not
re-verify an older reproduction.

Store a per-finding evidence revision, reproduction command and observed
result. Distinguish the digest refresh revision from the revision actually
tested. Mark stale evidence explicitly rather than relabeling it as current.
Before filing or reactivating work, reconcile referenced issues and PRs,
merged fixes, superseding comments, maintainer decisions and explicit
"not planned" dispositions. Preserve unresolved and upstream-blocked items.
Deduplicate by underlying cause and intended resolution, not filename alone.
Link existing [quality] Pilot: callable-core mutation attribution for CLI validators #1752 for CLI subprocess mutation attribution;
do not file another generic "missing mutation harness" issue.
Apply ADR 0006 and ADR 0007 before generating test work: no test-tree
meta-guards without maintainer authorization, no malformed-build-data
browser fixtures, and no request to raise browser-region coverage to 100%.
test: cover GroupLinkStatus' absent-collection fallback in the browser #1742 remains closed as not planned.
Distinguish browser reachability, conservative reporter attribution and
assertion strength. [quality] Decision: evaluate conservative cross-chunk e2e region attribution #1736 is a bounded attribution decision,
not evidence that every uncredited region needs a new browser fixture.
Respect the separate producer/reporter identities being repaired in
fix: preserve build, browser capture, and reporter coverage provenance #1748.
Treat NoCoverage as an accounting observation until calibrated. The
awards-validator pilot recovered substantial existing assertion signal by
propagating child coordinator data; it did not reveal 104 missing tests.
Broader harness/scope changes remain a maintainer decision on
[quality] Pilot: callable-core mutation attribution for CLI validators #1752.
Honor holds and human-decision gates as intentional constraints, not an
automatic invitation to clear them or widen the repository allowlist.
refactor: centralize duplicate/missing-id checks in validate-metrics.mjs and validate-launch-metrics.mjs #1751 remains held; fix: preserve build, browser capture, and reporter coverage provenance #1748 is returned to hold after
its explicitly authorized repair.
Supersede stale findings in the digest's backing state. Keep an audit trail
distinguishing verified fixes, superseded duplicates, deliberate policy
closures and still-open blockers instead of repeatedly presenting all of
them as actionable defects.

Acceptance evidence for the external operator: the next digest should no longer
present merged/superseded items above as open implementation work, should retain
#1433 and #1618 as external blockers, and should preserve
the bounded decisions on #1736 and #1752. Keep this
living advisory issue open.

Maintainer-approved P2/P3 reconciliation: 2026-10-22

This is a verified disposition snapshot and an external Hive operator handoff,
not a claim that the generated digest's backing state or configuration has
been changed. Keep this living issue open. The prior reconciliations remain
authoritative:
#23 (comment)
#23 (comment)

Merged fixes and completed tracking

Item	Current disposition
Credential handling, #1768	#1769 merged; the issue is closed.
Audit retry/deadline, #1762	#1763 merged with an actual 60,000-ms subprocess deadline, three attempts and two two-second delays, not just a per-request timeout. No allowlist change.
Missing talks CI gate, #1758	The complete #1776 merged: local recipe, contributor explanation, required CI validator, both parity directions and retirement of the old CI exemption. The issue is closed; workflow write permission was not a blocker for this authorized repair.
Launch tracking, #1775	#1779 merged the link to #1778. The tracking gap is closed; the actual draft/content approval and DNS work are not completed by that link.
URL assertions, #1760	#1761 merged after the old registry-outage check reran green. No production URL-policy change.
Classifier assertions, #1770	#1771 merged. These role/scope/flag assertions are distinct from snapshot publication provenance.
Provenance assertions, #1777	Its existing #1780 merged; no competing implementation was opened.
Stryker sandbox false positives, #1772	Repaired #1773 merged with the exclusions retained and proposed meta-tests trimmed. No ADR0006 exception.
SVG acceptance portion of #1764	Repaired #1765 merged as `a37c149`. Independent fixtures detect all 236 isolated supported-entry deletions, including circle. This is not a new full-module Stryker score.
Shared duplicate-only helper, #1766	#1767 merged. It deliberately does not add missing-value semantics.
Awards callable-core pilot, #1752	Accepted via merged #1757; the stale issue body now states completed and remains closed. The scoped result was 101 killed, zero survived and zero NoCoverage, not a new full-tree baseline.

Separately scoped work and retained decisions

refactor: reuse duplicate checks for End User members #1785, the approved follow-up for [architect] duplicate Set-based dedup checks in validate-enduser-members.mjs not using shared helper #1774, merged at
2026-10-22T17:12:06Z as 5c1ceff. The issue
is closed. Both call sites preserve presence checks, messages and ordering.
The maintainer separately approved exactly one additional callable-core
extraction under [quality] Extend the merged callable-core mutation pattern to scripts/validate-architecture-assets.mjs #1759. Its implementation is published as
refactor: expose the architecture-assets validator as a callable core #1787; use that PR for live check/queue/merge state. Scoped
mutation measured 304 killed / 8 individually triaged equivalent survivors /
0 NoCoverage / 97.44%. All 35 behavioral survivors from the initial campaign
were killed. This is not a broad validator rollout or
authorization for new mutation globs, workflows, thresholds or runner
bridges. The assets validator is filesystem-only; JSON input contracts
copied from the awards template do not apply.
[quality] Decision: evaluate conservative cross-chunk e2e region attribution #1736 remains open and human-gated. Its former automatic closure
was corrected. Producer/reporter provenance delivered by fix: preserve build, browser capture, and reporter coverage provenance #1748
is separate from deciding conservative cross-chunk attribution. The browser
region floor and ADR0007 reachability rule are unchanged.
[quality] Decision: folded MDX grammar finding after SVG acceptance repair #1764 was reopened only because an unrelated MDX grammar
finding had been folded into it. Its body now distinguishes completed SVG
work from the remaining scope/validity decision. No MDX export or structural
change was implemented or approved by the SVG repair.
DNS cutover to endusers.cncf.io: add Netlify custom domain and point DNS (external dependency) #1433 remains external DNS/Netlify work;
Launch blog post: review and commit the milestone-9 draft (LAUNCH.md milestone 11) #1778 needs the maintainer's draft and content approval;
a11y: search button accessible name does not contain its visible label (WCAG 2.5.3) #1618 retains the chosen upstream accessibility path.
Newly filed test: pin the type arm of the unescapeMdx guard #1782 and test: pin the userinfo and trim guards in profileImageUrl #1784 were outside this
designated maintenance batch. Their holds were not released.

Required external reconciliation

Retire or supersede the merged findings above in the backing state. The
digest must not continue calling them open implementation work merely
because an old reproduction or agent record remains.
Keep the existing mutation harness, accepted pilot, previously merged
MetricsDashboard repair and automation-PR policy tests recognized as
delivered. Keep the deliberately closed null-groups browser fixture closed.
Distinguish a digest refresh revision from the actual revision tested for
each finding. A footer naming current main does not re-verify old evidence.
Fix component folding by underlying cause and actual affected module, not
incidental filename mentions in a comparison table. The SVG issue mentioned
mdx-escape.mjs for comparison; that did not make it an MDX component tracker.
The resulting fold must not silently close unrelated work with a SVG PR.
Preserve intentional human/external decisions and item-specific hold
authorizations. This batch's approval is not permission to release new PR
holds, widen HIVE_REPOS or increase automation scope.

There is no Hive configuration or authorized-repository allowlist in this
repository. Apply backing-state, intake and project.repos changes in the
external orchestrator, then verify the next digest against these dispositions.

Reconciliation note: the surviving-mutant backlog that the quality agent was filing per file was cleared in bulk under #1788 (full tree 82.09% to 96.24%, run 39845001035). Per-file mutant findings opened before 2026-10-22 against src/ or scripts/lib/ are likely already resolved; please re-verify against main before re-filing.

quality lane, 2026-10-25 — two sub-remit observations, no issue and no PR

Filed here rather than as issues under ADR 0008 rule 2: neither names an effect
under rule 1, so neither is mine to open. Both are verified against main at
c20e9e4; the evidence is written out so a maintainer can act on either without
re-deriving it.

1. `scripts/collect-metrics.mjs` builds a cncf/landscape URL that 404s

scripts/collect-metrics.mjs sets the landscape source URL to
https://github.com/cncf/landscape/blob/main/landscape.yml. That repository's
default branch is master, not main:

$ gh api repos/cncf/landscape --jq .default_branch
master
$ curl -sS -o /dev/null -w '%{http_code}\n' -L https://github.com/cncf/landscape/blob/main/landscape.yml
404

The value is carried into data/metrics.json under sources.landscape.sourceUrl.

Why this is not a rule-1 broken link. Nothing renders it. The only reader of
a metrics sources block is src/components/MemberDirectory/DirectoryFreshness.js,
which takes metrics?.sources?.architectures from here and the landscape link
from data/members.json instead — and that one is revision-pinned
(blob/<sha>/landscape.yml, built by scripts/lib/enduser-collector.mjs) and
resolves. So this is a wrong string in a dataset, not a dead link a visitor can
click.

If a maintainer wants it corrected, the durable form is the revision-pinned one
scripts/lib/enduser-collector.mjs already uses, rather than swapping main for
master — a floating branch name is what went stale here. Note that
data/metrics.json is occupied ground: #1879 is open against it.

2. `onBrokenAnchors` is the one broken-link setting with neither a declaration nor a test

docusaurus.config.js declares onBrokenLinks: 'throw' and
onBrokenMarkdownLinks: 'warn', and both are pinned —
tests/site-config.test.mjs for the first, tests/site-config-broken-markdown-links.test.mjs
for the second, the latter resolving the value through Docusaurus's own
validateConfig rather than reading the literal. The third setting is declared
nowhere, and resolving the real config the way the build does gives the
Docusaurus 3.10.2 default:

declared onBrokenAnchors: undefined
resolved onBrokenAnchors: "warn"
resolved onBrokenLinks:   "throw"

So the anchor checker's reporting level is an upstream default, and lowering it
to 'ignore' is a one-token edit nothing in the suite would notice — the exact
hole the markdown-link test was written to close for its sibling.

Why this is not a rule-1 finding. It would catch nothing today. Scanning
docs/, blog/, src/ and the root markdown for site-root links carrying a
fragment returns zero matches, so there are no broken anchors for the checker to
report at any level. A test pinning the level would move no rule-1 effect, which
puts it squarely in rule 2.

Lane state

Everything else I checked on main is green and needs nothing: check:audit
passes, validate:all passes (one pre-existing foreignObject warning on the
Swisscom SVG), test:unit:coverage:check passes at 100.00% source lines and
100.00% source regions, and all 360 distinct outbound URLs in the non-member
datasets resolve except https://www.alolitasharma.com (ECONNRESET), which
#1869 is already open for.

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: c20e9e4

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

ADR 0008 follow-up: rule 2 pull requests in the 48 hours after merge

ADR 0008 merged on 2026-10-23 (#1848). Between 2026-10-24 and 2026-10-25 the fleet opened four pull requests whose only effect is a repository metric or a new gate no rule 1 effect depends on, all now closed as not planned:

test: gate the outbound links data/members.json renders for link rot #1863 (quality) — data/*.json link-rot gate; re-file of test: resolve the outbound links the member directory renders #1857, closed under rule 2 the same day
test: answer whether the member directory still matches cncf/landscape #1888 (quality) — check:landscape-drift script no CI job runs
test: pin the DOM, element-tree and fixture-store harness contracts #1895 (quality) — mutation-score pins in tests/tools/, the series the ADR records as ended with test: consolidate the tests/tools mutant premise pins #1846
fix: cross-check the lockfile against OSV in the supply-chain gate #1885 (sec-check) — OSV arm in audit-gate.mjs with no maintainer-filed issue

Two patterns worth recording for the 30-day review (2026-11-23):

Three of the four were titled test: / "Test Improvement" and attached to a real in-remit issue with Refs #N ([quality] Member profile Sources renders a dead link (www.walmartlabs.com); data-rendered URLs have no link-rot gate #1856 twice), so they read as rule 1 work while the file set is entirely new tooling and tests. Rule 1 is about the effect of the change, not the issue it cites.
The dedupe pass triage: duplicate and overlapping open issues/PRs to consolidate #1883 reported zero duplicates while test: gate the outbound links data/members.json renders for link rot #1863 was a re-file of a PR closed 46 minutes earlier; folding also attached unrelated findings to [quality] Edit this page link on /resources/changelog/ 404s: the generated changelog has no source file on main #1872, [quality] /resources/metrics publishes 0 open reference-architecture submissions and a 26-day-old project count #1878, [quality] Community profile Website link for Alolita Sharma fails TLS validation (www.alolitasharma.com) #1866 and [quality] Member profile Sources renders a dead link (www.walmartlabs.com); data-rendered URLs have no link-rot gate #1856 by shared filename.

The remaining open PRs (#1865, #1869, #1871, #1875, #1876, #1877, #1879, #1881, #1884, #1887, #1889, #1893, #1894) all name a user-observable defect and are being merged.

quality lane, 2026-10-28 — full gate sweep clean, one sub-remit observation

Filed here rather than as an issue under ADR 0008 rule 2: nothing below names an
effect under rule 1.

Sweep at origin/main 1f4a7f4. Every gate reproducible outside CI passes:

gate	result
`test:unit:coverage:check`	pass — src 100.00% lines / 100.00% regions, all files 99.71% / 96.82%
`check:format`, `check:lint`, `check:unused`	pass
`check:duplication`	pass — 35 clones against the 35 ceiling
`validate:all`	pass — only the pre-existing `foreignObject` warning on the Swisscom telco SVG
`_check:links-data`	pass — 463 URLs, 0 broken, 13 unverifiable (403 bot blocks / DNS)
`build:production` + `test:e2e`	381 passed, 34 skipped, 1 sandbox-only failure (below)

Observation (harness shape, rule 2). tests/e2e/focus-trap-trigger-unmounted.spec.js
is the suite's slowest spec and carries no test.slow(). On this host it finishes
in 33.7s, i.e. just past Playwright's 30s default, and fails as
Tearing down "context" exceeded the test timeout on every attempt at the default
timeout; its sibling member-directory specs run 22–30s on the same host and pass.
The spec's own steps are not what is slow — scripted against the same build
outside the runner, goto through context close totals under 1s — so this is host
speed, not the test.

It is not failing upstream and needs no change: the last 40 ci.yml runs are
merge-queue green, and no recent run uploaded a flaky-specs.json artifact, so
retries: 1 is not masking a flake either. Recording it only so the next agent
that sees this spec red on a slow host recognises it as the environment and does
not file it.

Checked and not re-filed. The label-content-name-mismatch baseline in
tests/e2e/accessibility.spec.js is accurate as written:
docusaurus-plugin-search-local's SearchBar.jsx renders <SearchButton> with no
translations prop, so neither buttonText nor buttonAriaLabel is reachable
from docusaurus.config.js. Decided question, no new information, no issue.

No issue and no pull request opened this run.

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 1f4a7f1

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

Re-verified 2026-10-29 aacacc1: ADR 0008 still binding, no in-remit strategic finding. Actionable queue is empty (0 open issues); the two open PRs (#1995, #1976) are maintainer-authored, not agent work. Milestones 1-5 all show 0 open issues (fully closed). Since the prior strategist sweep (Oct 26), PR #1841 (merged, this sweep) deleted ROADMAP.md, MILESTONES.md, data/milestones.json, and the milestone-creation workflow/tests outright — a maintainer decision to retire planning-doc infrastructure, not a gap to fill. Per ADR 0008 'decided questions stay decided,' strategist should not recreate ROADMAP.md or milestone docs for this repo. gh-1841,adr-0008

🐝 Hive Agent: strategist | Instance: hosted-available-lke648397-260827-5n31 | SHA: aacacc1

— hive: agent=strategist backend=copilot model=claude-sonnet-4-6 copilot=1.0.88

Re-verified 2026-10-30 99eb7b9: no in-remit strategic finding this sweep.

ADR 0008 still binding; #1841 (merged 2026-10-23) was the maintainer's explicit
decision to delete ROADMAP.md, MILESTONES.md, data/milestones.json and
every reference to them. Per "decided questions stay decided," strategist does
not recreate planning-doc infrastructure for this repo.

All five milestones (Phase 0 through Launch) still show 0 open issues via
gh api repos/cncf/endusers/milestones. The two PRs open as of the prior
sweep are resolved: #1995 merged, #1976 remains open and maintainer-authored
(not agent work). 17 commits landed on main since the last strategist sweep
(Oct 29), all routine content/metrics/CI work with no roadmap-shaped gap or
adoption blocker surfaced.

No issue and no pull request opened this run.

🐝 Hive Agent: strategist | Instance: hosted-available-lke648397-260827-5n31 | SHA: 99eb7b9

— hive: agent=strategist backend=copilot model=claude-sonnet-4-6 copilot=1.0.88

quality lane, 2026-10-30 — production sweep clean, one sub-remit observation

Swept main at 5b83c01. Filed here rather than as an issue or PR under
ADR 0008:
the one thing found is a consistency gap with no reachable user-visible effect today.

What was checked (all clean)

npm run validate:all — all 13 validators pass (102 members, 155 landscape records, 83 talk links, 5 born projects, 4 theme backgrounds).
Production probe of https://endusers.cncf.io: every one of the 47 sitemap.xml URLs answers 200.
Every /img/cncf-projects/... and /img/architectures/... path referenced from docs/ and data/ resolves to a committed asset.
Every architectures[].id on a member profile (MemberProfile's /architectures/<id> links) has a page under docs/architectures/.
main workflow health: refresh-members, refresh-metrics, refresh-community-people, refresh-radar-reports, audit-schedule and check-links all green on their latest runs; no required check red on main.
Near-duplicate scan of every catalog and member filter dimension. The only hit is the Argo / ArgoCD / Argo Workflows triple in the project select, which is already covered by held PR 🐛 fix(architectures): list the Argo project once in the project filter #2022 — confirmed still live in the server-rendered /architectures/ HTML.

Sub-remit observation: the tag select is the one filter comparator left unpinned

#2016 pinned English collation at the eight filter-option builders
(compareLabels, a.localeCompare(b, 'en')). The ninth list in the same
function was not changed — useArchitectureFilterOptions still sorts the tag
select with a bare tagKey(a).localeCompare(tagKey(b))
(src/components/ArchitectureFilters/index.js), which uses the runtime's
default locale rather than the pinned one.

This is not the defect #2016 fixed: tagKey lowercases, so the lowercase
block that motivated that PR cannot occur here. The only residual difference is
that the build host and the visitor's browser could collate the list
differently. Every current tag is [a-z0-9 ] after tagKey, and no locale
orders that alphabet differently from en (the usual divergences — Danish/
Norwegian aa, Swedish ö, German phonebook — need characters or digraphs no
tag has), so there is nothing a visitor can observe today. Recording it only so
the next reader of that function knows the omission was looked at rather than
missed; worth a line if a non-ASCII tag ever arrives from upstream.

— hive: agent=quality

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 5b83c01

[quality] Latent: /metrics numbers are formatted in the visitor's locale, not a pinned one

Advisory only — this is not observable on the production site today, so per
ADR 0008
it gets this comment rather than an issue or PR. Recording it because the trigger
is a data value crossing a threshold, not a code change, so it will arrive without
anything in src/ being touched.

What

src/components/MetricsDashboard/index.js formats three user-visible numbers with
no locale argument, so Intl resolves the host default:

:72 — `${card.value.toLocaleString()} ${card.suffix || ''}` (lifecycle cards)
:119 — {metric.value.toLocaleString()} (metric cards)
:165 — {series.values.at(-1)?.value.toLocaleString()} (chart range)

The page is server-rendered once at build time (Node, en-US) and hydrated in the
visitor's browser, where the host default is whatever the visitor's OS/browser is.

Why it is latent, and what makes it live

Grouping separators only appear at |value| >= 1000. Every value in
data/metrics.json is currently below that:

metrics: cncf-projects=259, reference-architectures=10
series endUserMembers last={ date: '2026-10-29', value: 649 }
series referenceArchitectures last={ date: '2026-10', value: 10 }
lifecycle cards: (none)

Below 1000 every locale renders the same digits, so there is nothing to see. Once a
value reaches 1000 the two sides disagree:

en-US -> 12,345    de-DE -> 12.345    fr-FR -> 12 345

endUserMembers is the one that will get there (649 and rising). At that point a
non-en visitor gets markup that differs from the SSR HTML, which React 18 treats
as a hydration mismatch for that subtree.

Why the suites will not catch it

tests/metrics-dashboard.test.mjs:120,263,352,375 and
tests/e2e/metrics-dashboard.spec.js:101,238,314 build their expected strings with
the same unpinned value.toLocaleString(), so expectation and subject move together
in any locale. A guard would have to assert the pinned output literally.

The repo already decided this question for dates

src/components/shared/formatDate.js pins 'en-US' and writes down the same
reasoning ("the site is built once (in UTC) and hydrated in the visitor's browser
... would ... mismatch the server-rendered text"), and src/components/shared/compareLabels.js:14
pins 'en' after d760cde. These three calls are the remaining unpinned sites in
src/. The fix is toLocaleString('en-US') at each; whether that is worth doing
before a value crosses 1000 is the maintainers' call.

Verified at 01ceee8 (npm run test:unit:coverage:check green, src 100% lines/regions).

— hive: agent=quality

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 01ceee8

quality lane, 2026-11-01 — production sweep clean, one sub-remit observation

Swept main at e726a1f. Filed here rather than as an issue because nothing
below meets ADR 0008 rule 1.

Sweep result

Check	Result
`check:audit`	ok — 0 high/critical
`validate:all`	green (101 members, 155 landscape records, 214 case studies, 327 talk links, 186 architecture assets, …)
`check-data-links`	943 URLs in 14 files — 748 ok, 195 unverifiable (bot-blocked 403/429), 0 broken
`markdown-link-check`	60 files, 0 dead links
`npm run build`	succeeds, 0 Docusaurus broken-link errors
built HTML (55 pages)	0 missing local asset refs, 0 broken internal page links, 0 duplicate `id`s, 0 `<img>` without `alt`, no `Invalid Date` / `[object Object]` / `NaN` / `undefined` leaks

Supply chain: an OSV querybatch over all 1764 distinct name@version
pairs in package-lock.json — not npm audit, which has the registry
bulk-endpoint blind spot that hid GHSA-g84c-rxfj-3j2c — returns exactly three
vulnerable packages, and all three are already adjudicated:

minimatch 3.1.5 and 10.2.6 — GHSA-g3hv-75wg-m249, moderate, accepted in
[ci-maintainer] Dependabot cannot fix minimatch advisories: only patched in v11, which breaks eslint-plugin-jsx-a11y #2036; the ^11.0.1 floor is deliberately refused there because it crashes
eslint-plugin-jsx-a11y.
deepmerge 4.3.1 — GHSA-gcqx-w48m-w2h4, low. OSV gives it
last_affected: 4.3.1 with no fixed event, so no patched release exists to
floor to.

The one validate:architecture-assets warning (foreignObject in
swisscom-cloud-native-telco-automation-layers.svg) is not a defect: each
<foreignObject> sits inside a <switch> with a sibling <text> carrying the
same label, which is the fallback the warning asks you to confirm.

Sub-remit observation: `onBrokenMarkdownLinks` is declared where Docusaurus v4 will stop reading it

Every build prints, twice:

[WARNING] The `siteConfig.onBrokenMarkdownLinks` config option is deprecated and
will be removed in Docusaurus v4. Please migrate and move this option to
`siteConfig.markdown.hooks.onBrokenMarkdownLinks` instead.

This is out of remit today — the option still works, so no user can observe
anything — but it is worth recording because of where the setting is pinned.
tests/site-config-broken-markdown-links.test.mjs resolves the value through
Docusaurus's own validateConfig rather than reading the literal (noted in the
onBrokenAnchors comment above). On the v4 upgrade the top-level key stops
being read; whether that test then fails loudly or silently resolves the new
default decides whether the upgrade tells you the markdown-link policy was
dropped. Worth a look at upgrade time, not before.

Filed by quality agent (hold-gated mode).

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: e726a1f

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

strategist lane, 2026-11-02 — no in-remit finding

Re-verified at d147ff9 (same commit as last pass). Per ADR 0008 rule 6, planning checklists are retired from this repo (#1841) and the strategist lane does not file tracking issues for them. Checked this pass:

CI on main: green.
Pre-filtered actionable queue: 0 unclaimed issues, 0 unattributed PRs — the only open items ([quality] Accessibility gate cannot report axe heading-order; 8 published pages skip a heading level #2069, [quality] Architectures catalog ships the Swisscom logo at 6993x2895 twice (836 KB of a 1.86 MB page) for 135x56 thumbnails #2074) are already claimed by quality/scanner PRs (fix(a11y): repair skipped heading levels and retire the heading-order baseline #2072, perf: reduce the Swisscom architecture logo size #2075).
No new security/supply-chain, maintainer-labelled, or generated-data-refresh signal in scope for this lane.

No issue or PR opened this pass.

🐝 Hive Agent: strategist | Instance: hosted-available-lke648397-260827-5n31 | SHA: d147ff9

— hive: agent=strategist backend=copilot model=claude-sonnet-4-6 copilot=1.0.88

🐝 Hive Advisory Report #23

Description

Activity

hivecommons-hive commented on Aug 7, 2026

🐝 Advisory Digest — 2026-11-06 08:55 EST

Advice

🟠 HIGH (10)

☑️ Recently Closed — Fix Not Verified (10)

mrbobbytables commented on Oct 21, 2026

Maintainer-approved queue reconciliation: 2026-10-21

Resolved or deliberately closed

Correct the remaining coverage interpretation

Additional merged fixes, not new findings to file

External blockers remain open

mrbobbytables commented on Oct 21, 2026

P2 handoff: external Hive intake and reconciliation

mrbobbytables commented on Oct 22, 2026

Maintainer-approved P2/P3 reconciliation: 2026-10-22

Merged fixes and completed tracking

Separately scoped work and retained decisions

Required external reconciliation

mrbobbytables commented on Oct 22, 2026

hivecommons-hive commented on Oct 25, 2026

quality lane, 2026-10-25 — two sub-remit observations, no issue and no PR

1. scripts/collect-metrics.mjs builds a cncf/landscape URL that 404s

2. onBrokenAnchors is the one broken-link setting with neither a declaration nor a test

Lane state

mrbobbytables commented on Oct 25, 2026

ADR 0008 follow-up: rule 2 pull requests in the 48 hours after merge

hivecommons-hive commented on Oct 28, 2026

quality lane, 2026-10-28 — full gate sweep clean, one sub-remit observation

hivecommons-hive commented on Oct 29, 2026

hivecommons-hive commented on Oct 30, 2026

hivecommons-hive commented on Oct 30, 2026

quality lane, 2026-10-30 — production sweep clean, one sub-remit observation

What was checked (all clean)

Sub-remit observation: the tag select is the one filter comparator left unpinned

hivecommons-hive commented on Oct 31, 2026

What

Why it is latent, and what makes it live

Why the suites will not catch it

The repo already decided this question for dates

hivecommons-hive commented on Nov 1, 2026

quality lane, 2026-11-01 — production sweep clean, one sub-remit observation

Sweep result

Sub-remit observation: onBrokenMarkdownLinks is declared where Docusaurus v4 will stop reading it

hivecommons-hive commented on Nov 2, 2026

strategist lane, 2026-11-02 — no in-remit finding

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

1. `scripts/collect-metrics.mjs` builds a cncf/landscape URL that 404s

2. `onBrokenAnchors` is the one broken-link setting with neither a declaration nor a test

Sub-remit observation: `onBrokenMarkdownLinks` is declared where Docusaurus v4 will stop reading it