[Danathar]

Summary

Contributor adoption (stage 074, and its supersede and DCO re-home) stands in for a contributor relay that went quiet. It also took over a PR whose author is a repository admin, treated them as "offline", and then shut their PR in favour of a hive copy.

Evidence: projectbluefin/utah-packages#619

The author is hanthor. GET /repos/projectbluefin/utah-packages/collaborators/hanthor/permission returns permission=admin role=admin. All times are 2026-10-25 UTC.

Time	Event
17:15Z	Labelled author/clanker, role/trusted
17:37Z	072 nudge
17:53Z	hive:adopted … reason=contributor-offline mode=in-place: "your hive has been offline since the nudge" (16 minutes later)
18:10Z	hive:adopted … reason=dco-rehome mode=supersede superseded_by=621; the original was shut
19:11Z	hanthor merged the original PR themselves
19:15Z	The hive copy, projectbluefin/utah-packages#621, was shut

Cause

Adoption is gated on author kind (labels and relay registration), presence, grace, hold labels and the diff fence (adoptContributorPR in automerge_contributor_adopt.go). Nothing asks whether the author maintains the repository.

Change

• New authorMaintainsRepo. It reads GET /repos/{owner}/{repo}/collaborators/{author}/permission and treats permission=admin, or role_name admin or maintain, as a maintainer.
  • The answer is cached per (repo, author) for an hour, so it costs one call per author per repo per hour, not one per PR per sweep.
  • A failed read is not cached and counts as a maintainer, so adoption fails closed.
• Where it gates:
  • adoptContributorPR: a maintainer's PR is never adopted, and it stays at 071/072 as today.
  • settleInPlaceAdoption: an in-place adoption taken before this rule, or before the author's permission was raised, is released on the next pass.
  • supersedeAdoptedPR: a backstop for every re-home path (grace, offline, dco-rehome, in-place-stalled).
• Docs and changelog: the stage/074 row in labels-and-control-signals.md, and a changelog fragment.

Testing

go test ./pkg/github/automerge/... ./pkg/stagelabels/... ./pkg/stageengine/... ./pkg/github/ ./cmd/hive/... -count=1 (run from src/): all ok. That covers pkg/github/automerge 2.8s, pkg/stagelabels, pkg/stageengine (with prstage and stageenginetest), pkg/github 50.1s and cmd/hive 10.5s.

New tests in automerge_adopt_maintainer_test.go:

Test	Covers
TestRepoMaintainerLevel	admin, maintain (served as permission=write plus role_name=maintain, as GitHub does), case, and write/triage/read/none
TestAdoptionSkipsRepositoryMaintainer	For admin and maintain: past the grace, across several sweeps, no adoption comment, branch or superseding PR; the PR stays at 072; the permission is read once (cached)
TestAdoptionFailsClosedOnPermissionError	A 500 on the permission read does not adopt; once the read works, a write author is adopted as before (the error was not cached)
TestInPlaceAdoptionOfMaintainerIsReleased	An in-place adoption whose author is now admin is released after the cache expires and is not re-homed

The adoption fake API serves the permission route, defaulting to write, so every existing adoption test still runs its original path and passes unchanged.

Real data: the live API answer for hanthor on utah-packages (permission=admin role=admin) is what repoMaintainerLevel treats as a maintainer.

Guards and checks: BASE_REF=v6 bash src/scripts/check-changelog-fragment.sh is OK, go vet is clean, and gofmt is clean.

Contributor checklist

• Changelog: changelog.d/fixed-adoption-skips-repo-maintainers.md.
• Targets v6.
• The title uses the emoji convention.
• Commits include DCO sign-off.
• Docs updated.
• No secrets, credentials or local runtime state are committed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BQYnPGFJx81c8JXR3o1sg1

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hanthor for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v6

Conflicts are checked with every PR merged onto the current tip of v6, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#14306	🔒 fix(adoption): never move a fork PR's code into a base-repo branch (re-home ran fork code as trusted)	same files	src/docs/labels-and-control-signals.md src/pkg/github/automerge/automerge_contributor_adopt.go src/pkg/github/automerge/automerge_contributor_adopt_test.go

[hivecommons-hive]

Evidence bundle `#14305ce778a6` sha256:e725673feacf4dee91f47eaabd0aa7ebae272df237a791abadacc7afb4f570f4 — download from the dashboard or `hivectl review evidence #14305`.

[hivecommons-hive]

merged by Hive trusted-author auto-merge: author @Danathar holds role owner and GitHub permission maintain on repo; CI green at ce778a6.

[hivecommons-hive]

Decision needed: @Danathar should decide which of #14304 and #14305 lands for #14301 — they implement the same maintainer-author guard and conflict in Engine and supersedeAdoptedPR, so only one can merge.

Conclusion: this is the same fix as #14304 (opened 33 s earlier, Fixes #14301), and the two conflict rather than stack. One real correctness gap here: the fail-closed error path also fires on the non-collaborator answer, which would disable adoption for exactly the authors it serves.

Read the PR head ce778a6 against v6 merge-base becce0a, plus authorRepoPermission in automerge_sweep.go, reporterHasWriteAccess/label_approval.go, and the test harness.

Overlap with #14304

Both PRs: read GET /repos/{o}/{r}/collaborators/{author}/permission, treat admin/maintain (via role_name) as maintainer, cache per repo/author, guard adoptContributorPR, supersedeAdoptedPR and the in-place settle path, and fail closed on a read error. Both add a new field pair to Engine and insert a guard at the top of supersedeAdoptedPR — a textual conflict, so they cannot both merge. Differences I verified:

• #14304 posts one maintainer note per head (AdoptionMaintainerNotedHead) and uses a 10-minute cache; #14305 logs only, 1-hour cache, and updates labels-and-control-signals.md.
• #14304 carries a hive changes_requested for a transient read error clearing AdoptedBy after the copy exists. #14305's supersede guard (automerge_contributor_adopt.go:615-620) runs before the copy is opened (callers at :611, :730), so it does not orphan a superseding PR — a point in its favour.
• #14305 does not reference #14301 at all; it should Closes #14301 if it is the survivor.

I have not closed anything; flagging for a maintainer to pick one.

Finding (medium) — a 404 is treated as "maintainer"

• src/pkg/github/automerge/automerge_contributor_adopt.go:798-802 — any error from GetPermissionLevel returns true.
• src/pkg/github/label_approval.go:239-240 — the same call elsewhere in this repo special-cases http.StatusNotFound as "not a collaborator", i.e. the codebase already expects this endpoint to 404 for a non-collaborator (a fork contributor with no role on the repo — the population adoption exists for).
• Consequence if that holds: adoptContributorPR:565 never adopts such a PR, and settleInPlaceAdoption:876-882 releases any in-place adoption already taken, every sweep (errors are not cached, so it never settles).
• The harness only scripts a 500 and answers write for every login (automerge_contributor_adopt_test.go:68-80); there is no non-collaborator/404 case, so the tests cannot catch this.

Fix is small: branch on githubStatusError(err, http.StatusNotFound) → false the way label_approval.go does, and add a 404 fake to the harness. (Same applies to #14304's adoptionAuthorPermission.)

Minor

• automerge_sweep.go:2406 already has authorRepoPermission doing the same GET and normalisation; authorMaintainsRepo could wrap it instead of duplicating the parsing.
• settleInPlaceAdoption:876 releases an in-place adoption on a transient error too (5xx / rate-limit). Low stakes — nothing is closed — but it will flap between adopted and released until the read recovers.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88