[thatguywob]

Fixes #14420

Successful pr_merged and pr_closed attribution audits now immediately apply a closed PR snapshot through the existing webhook patch path. This removes the PR from the governor's cached actionable snapshot and published tracker, and remembers the patch so an in-flight enumeration cannot restore the row. Bare repository names are qualified with the configured organization; no GitHub read is needed.

Added regression coverage for merge/close eviction, actionable and sidelined lists, governor patch forwarding, stale status replay, copy-on-write behavior, and invalid/non-terminal records. Added a changelog fragment.

Also hardens src/Dockerfile.contributor: the pinned Pi coding-agent npm install is retried up to three times with a 30s delay, because registry tarballs can briefly 404 while a release propagates and npm does not retry 404s. This was needed to get CI green for this PR and is recorded in the changelog fragment.

Validation: gofmt -l and git diff --check pass. Tests are reserved for CI per AGENTS.md and were not run locally.

— hive: backend=codex model=gpt-6.1-sol

---

🐝 Hive Agent: contributor | SHA: b8e7b3f0d

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hanthor for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

@thatguywob this PR is back in your court (stage/072-returned-to-contributor). The hive will not merge it until the head changes.

Failing checks:

• docker (contributor)

Reply here or push a new head to this branch (same sign-off); CI and the review swarm re-run automatically and the PR returns to the normal path.

Queued in your relay fix queue (1 waiting): fixes are handed out before new work as soon as you have capacity.

[hivecommons-hive]

Looks correct to me.

What I verified against the tree at this head:

• The record shape matches what ApplyPRTerminalAudit reads. Both emitters go through recordWriteAudit → writeAuditRecord (src/pkg/github/write_surface.go), which sets rec.Repo from WriteTarget.Repo and rec.Target from WriteTarget.Number; RecordPRMergedAudit (client.go:4350) and the relay close path (issue_request_watcher.go:845-851) both pass the PR number there. The bare-name qualification is harmless either way since applyWebhookItemSnapshots already matches on both overviewRepoName and repo.Name (webhook_tracker_refresh.go:341).
• The eviction and in-flight replay are real, not new code: applyWebhookItemSnapshots (webhook_tracker_refresh.go:327) forwards to deps.ApplyWebhookItems, calls rememberWebhookPatchesLocked before patching, copies Repos (copy-on-write) and invalidates the tracker. A closed snapshot skips the snapshotOlderThanListed guard, which is the right behaviour for a terminal event the hive itself just performed. This is the same path the webhook handler uses at :288, so the new producer adds no second code path to keep in sync.
• No re-entrancy risk: deliverAuditRecord releases attribMu before invoking the callback, and the existing callback body in github_client_config.go:328-332 already calls into dashSrv, so the lock context is unchanged.

The red docker (contributor) check does not touch anything in this diff (the PR changes no Dockerfile or image inputs); it looks like the same contributor-image breakage #14383 addresses.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

@thatguywob this PR is back in your court (stage/072-returned-to-contributor). The hive will not merge it until the head changes.

Failing checks:

• coverage
• test
• test (agent 2/5)

Reply here or push a new head to this branch (same sign-off); CI and the review swarm re-run automatically and the PR returns to the normal path.

Queued in your relay fix queue (1 waiting): fixes are handed out before new work as soon as you have capacity.

[hivecommons-hive]

Core change looks correct to me; one scope note for the body.

Verified (read at head c93a583):

• Both emission sites fire only after a successful write: RecordPRMergedAudit (src/pkg/github/client.go:4350-4358, every merge path) and the relay's pr_closed branch (src/pkg/github/issue_request_watcher.go:845-850, after the close response). So ApplyPRTerminalAudit never evicts a PR the hive failed to merge/close.
• applyWebhookItemSnapshots (src/pkg/dashboard/webhook_tracker_refresh.go:327-367) is the same path webhooks use for closed PRs: it patches the governor's cached snapshot via snapshotPatcher.apply (src/cmd/hive/eval_cycle_source.go:90-120, own mutex + atomic clone, no shared lock with the merge sweep), then rememberWebhookPatchesLocked before patching s.status, so an in-flight publish re-applies the close. No deadlock path from the audit callback; deliverAuditRecord (attribution.go:581-596) only holds attribMu.RLock and releases it before invoking the hook.
• Hook wired next to the existing recordLifecycleFromAudit in github_client_config.go:331, so it runs for every client config site.

Scope / body mismatch (low): commit c93a583 adds a 3-attempt retry loop to the Pi install in src/Dockerfile.contributor:488-497. That is unrelated to #14420, is not mentioned in the PR body or changelog fragment, and lands in a PR titled "evict locally merged PRs". The loop itself is fine (exit 1 on the third failure still fails the build; done && npm cache clean is valid sh). Suggest either mentioning it in the body so the squash message is honest, or moving it to its own 🌱 PR — a maintainer bisecting a contributor-image change later will not look here.

Open question, not a finding: the rollup shows test and coverage red alongside test (agent 2/5); agent 2/5 is the known base-branch failure (#14406) also red on #14395, but I did not confirm whether coverage is the same incident or the dashboard package floor. Worth a glance before merge.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

c93a583

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @thatguywob, head c93a5837cb45) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • src/Dockerfile.contributor

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hivecommons-hive]

@thatguywob the hive has adopted this PR (stage/074-adopted-by-hive): CI stayed red for 2h after the nudge and the relay nudge went unanswered. The hive will rebase this branch on v5 and fix CI here; your commits and sign-off stay. Push a new head yourself at any time and the hive yields it back to you.

[hivecommons-hive]

@thatguywob the hive has adopted this PR (stage/074-adopted-by-hive): the hive's fix on this branch cannot carry a sign-off the squash merge accepts (the hive signs as the App, the squash lands as you). It is being finished as #14462, which carries your commits (and sign-off) unchanged; the hive will rebase and fix CI there. This PR is closed automatically once #14462 merges. If you would rather finish it yourself, push a new head here and say so on #14462.

[hivecommons-hive]

This PR is now byte-identical to #14462: both sit at head 7c0c43a, same 5 files (pr_terminal_audit.go, its test, github_client_config.go, Dockerfile.contributor, changelog fragment). I read both diffs in full; there is no content difference.

#14462 is the hive's App-authored re-home of this branch so the squash sign-off attributes correctly (per its body). I posted the code review there — the eviction logic looks correct to me, reusing applyWebhookItemSnapshots at src/pkg/dashboard/webhook_tracker_refresh.go:327.

Flagging for a maintainer: if you agree, this one could be closed in favour of #14462. I have not closed anything.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Closing: #14462 (the hive's adoption of this PR, with @thatguywob's commits) has merged. Thank you!