[hivecommons-hive]

Supersedes #14304 (adopted in place, re-homed for DCO repair; original commits by @arteeh preserved).

Fixes #14301

This branch is #14304's head db659df6dc17 as pushed by @arteeh (fork arteeh/hive), unchanged. Last lane reason on the original: dco-missing.

Hive fix agent: rebase this branch on v5, fix the failing checks / review asks, and push to THIS branch. Keep the original author's commits and their Signed-off-by; add your own sign-off on your commits. Do not open another PR.

DCO repair required: this adoption has unsigned non-merge commits and the hive cannot repair them by amending the contributor branch. Re-home the work onto a hive-owned branch from v5: cherry-pick each original commit with git cherry-pick -s (or squash with git commit --author preserving the original author), ensure every replacement commit has Signed-off-by, push the DCO-clean branch, open/keep one superseding PR with the same title, then comment on and close #14304. Suggested replacement commit message:

🐛 fix: prevent contributor adoption of maintainer PRs

Supersedes #14304 (adopted; re-pushed with DCO sign-off, original authorship preserved).
Fixes #14301

Credit: original work by @arteeh.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubestellar-prow]

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.

📝 Please follow instructions in the contributing guide to update your commits with the DCO

Full details of the Developer Certificate of Origin can be found at developercertificate.org.

The list of commits missing DCO signoff:

• db659df fix: thread sweep clock into settleInPlaceAdoption

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

Reviewed (intent-alignment) — the diff satisfies #14301's acceptance criteria on v5: the permission gate fronts every takeover path — adoptContributorPR (src/pkg/github/automerge/automerge_contributor_adopt.go:567-570), supersedeAdoptedPR (:646-655), settleAdoption (:750-760), settleInPlaceAdoption (:1015-1027) and the stalled re-home in escapeStalledAdoption (:1286-1288); write-or-lower falls through unchanged (repoMaintainerLevel, :846-849); failed reads are not cached and defer (:866-870). Advisory, non-blocking:

1. Changelog wording vs. content — changelog.d/fixed-adoption-skips-repo-maintainers.md:1 calls this a "backport of #14305", but it diverges from the merged v6 change: TTL is 10 min here vs time.Hour in #14305, authorMaintainsRepo returns (bool, error) and defers releases on error, and it adds releaseMaintainerAdoption/closeMaintainerSuperseder (:884-935) which #14305 lacks. The v5→v6 forward-merge will conflict in automerge_contributor_adopt.go; whoever lands it should reconcile with #14305's version rather than assume a clean merge.
2. No note on the original PR — #14301 proposed "post one note per head saying the hive will not take over a maintainer's PR". The gate only logs (:568); the maintainer sees the PR stay at 072 with no explanation. Not in the acceptance criteria (and #14305 omits it too), so advisory. Same applies to an owner-delegate adopt-supersede label on a maintainer PR, which is now silently refused (:567 precedes the requested branch at :573).

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (correctness) — gate, fail-closed, cache and release paths check out at db659df; one advisory gap against #14301.

• automerge_contributor_adopt.go:567-570 refuses with a log line only. #14301 ("Proposed change") asks to "post one note per head saying the hive will not take over a maintainer's PR"; nothing in the diff posts it, and the maintainer sees no explanation why 072 never advances. Not in the acceptance-criteria list, so advisory.
• Same silent refusal reaches the delegated path: automerge_stage_labels.go:1013-1030 keeps LabelAdoptSupersede unless an attempt was recorded, and the maintainer refusal records nothing — so a human-applied adopt label on a maintainer's PR sticks for ever with no comment (TestDelegatedSupersedeCannotTakeOverMaintainer asserts the refusal, not the label/no-note outcome). A one-per-head note (or label removal) would close both.

Verified: read before any mutation in supersedeAdoptedPR (:646-655); error path never caches and defers everywhere (:869-873, 748-751, 1015-1018, 1283-1286); lock not held across the API call (:862-866, 875-884); release closes an open superseder before ClearAdoption (:908-935) and in-place release falls through to the lane stage via the re-read at automerge_stage_labels.go:866.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the diff against v5 plus the callers; this looks correct to me and matches #14301's acceptance criteria.

What I verified in the tree:

• automerge_contributor_adopt.go:567 — the gate sits before adoptionDiffRefusal, and authorMaintainsRepo (:858) returns (false, err) on a failed read with nothing cached, so a failed read defers (no adoption) exactly as #14301 asks ("fail closed"). The TTL-cache lock is released before the GetPermissionLevel call (:865-870), so the API round trip is not under the mutex.
• settleInPlaceAdoption is called on every pass for an in-place adoption (automerge_stage_labels.go:855-861), not only on head change, so the "release an already-live adoption on the next pass" path actually fires.
• escapeStalledAdoption (:1286) returns adoptionEscape{} for a maintainer / unreadable permission; the caller at automerge_stage_labels.go:878-889 only acts on esc.Escalated, so this is a clean no-op.
• releaseMaintainerAdoption → stagelabels.Store.ClearAdoption (src/pkg/stagelabels/store.go:1057) zeroes AdoptedBy, AdoptMode, AdoptReason and the escalation fields, so a released record cannot re-enter the supersede path on the next pass. If closing the superseder fails, the record is kept and retried — matches the comment at :893.
• repoMaintainerLevel mirrors the existing authorRepoPermission (automerge_sweep.go:2223) semantics for admin/maintain, so bot-login behaviour of the permission endpoint is already relied on by the trusted-author merge path; nothing new there.
• go build ./pkg/github/automerge/ passes at db659df.

One gap, informational: #14301's "Proposed change" says to "post one note per head saying the hive will not take over a maintainer's PR". The implementation only logs (automerge_contributor_adopt.go:568) and posts no comment on the maintainer's PR. The acceptance criteria don't require the note, so I'm not calling this a defect — but a maintainer whose PR stays at 072 will see the nudge and then silence.

Not in scope of my read: the no-dco label / cancelled "Sign-off survives the squash" check — that is the DCO re-home work the PR body already assigns to the fix lane.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (docs-currency) — head db659df6. Approve; one advisory.

The new sentence in the stage/074-adopted-by-hive row (src/docs/labels-and-control-signals.md:227) and the changelog fragment match the code: 10‑minute per (repo, author) cache (automerge_contributor_adopt.go:837 maintainerPermTTL), a failed read is not cached and defers in every caller (:567, :646, :750, :1015, :1286), and a still‑open superseder is closed with a note before the release (closeMaintainerSuperseder, :918–935).

Advisory (in‑scope, low): the rule is documented only in the 074 table row. The operator‑facing prose that enumerates the never‑adopt exceptions still lists only hold / do-not-merge (src/docs/labels-and-control-signals.md:888–889), the author‑kind table still reads unconditionally "yes — after the grace, the hive adopts" for author/clanker (:615), and the state diagram's s074 --> s072 edge (:306) does not list the new maintainer release. One sentence at :889 ("…nor is a PR whose author holds admin/maintain on the repository") plus a clause on :306 would keep those in step; the merged v6 original #14305 made the same row‑only choice, so this is a follow‑up for both branches rather than a blocker.

Note: #14301's proposed change asked for "one note per head saying the hive will not take over a maintainer's PR"; this PR logs (:568) but posts no comment on the original PR. The acceptance criteria don't require it and neither the row nor the fragment claims it, so docs are consistent — flagging only so nobody reads the 074 row as promising a comment.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Hive filed review findings that do not block this PR as backlog items:

• Review backlog (style): Permission cache mutex held across the GitHub API call #14313 (folded into an existing issue) — Review backlog (style): No per-head note on the maintainer's PR when adoption is skipped (Review backlog (style): Permission cache mutex held across the GitHub API call #14313)

Cap: 10 backlog item(s) per PR per day.

[hivecommons-hive]

Evidence bundle `#14320db659df` sha256:17abd0b232fade64951e9e12ecb8c439638ea50757ed66bae2324f5bd39f1fa9 — download from the dashboard or `hivectl review evidence #14320`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback