[clubanderson]

Fixes #14578

Root causes

A — stale "Sentinel alert · needs human" pill (src/pkg/dashboard/stage_tracker.go, stageTrackerSentinel): any sentinel_findings in the head's verified review-evidence bundle returned alert=true unconditionally. The bundle never clears, so removing sentinel-alert could not clear the pill. Webhooks/polling were healthy — labels in /api/stage-tracker were live; only the derivation was wrong.

A2 — "(title unavailable)" / github.com/hive/issues/14567 (stageTrackerPRLinkedIssues): GraphQL closing refs carry hivecommons/hive, the configured repo is hive; the mismatch dropped the ref and the fallback URL used the short name.

B — needs-decision ignored the human decision: automerge_stage_human.go humanEvidence never passed obs.Detail.HumanApprover (already noted for an APPROVED review on the head) to stagelabels.Evidence; and stagelabels/human.go RouteHuman always produced 085 for CauseDecision && CauseReason != "", with no 090 route for a hard manual-merge rule (contributor-lane:workflow-path etc.) a trusted merger had approved.

Changes

• stageTrackerSentinel: alert follows the live label; bundle supplies findings/reason; only a notice-only finding (SentinelFinding.Notice, new optional schema field set by recordReviewEvidenceSentinel) raises the pill alone. Old bundles lack notice → treated as blocking → rows self-heal on deploy.
• stageTrackerPRLinkedIssues(pr, repoName, baseURL) + stageTrackerSameRepo: name match independent of owner qualification; URL from the fully-qualified repo.
• stagelabels.Evidence{HumanApprover, ManualMergeRule, LaneReason}; RouteHuman routes an approved manual-merge rule to ReadyForHumanMerge with reason <lane>:human-approved@login (HumanApprovedReason parses it back); ReadyComment/decisionActions say the only step left is Merge (or /lgtm + /approve). The workflow-path fence stays a hard rule — the hive still never merges .github/workflows/** on the contributor lane.
• Tracker payload: human_approver, manual_merge; caption "Awaiting human merge (workflow path) — approved by @login; the hive never merges this itself: click Merge (or /lgtm + /approve for tide)"; JS 090 detour word "Awaiting human merge · approved by @login".

Tests

Table-driven: TestStageTrackerSentinelLabelClearsBlockingBundle, TestStageTrackerPRLinkedIssues (hive#14568 case), TestStageTrackerSameRepo, TestStageTrackerManualMergeApproved, TestRouteHumanApproved, TestHumanApprovedReason, extended TestHumanizeStageReason, TestDecisionCommentNamesLaneAction, review-evidence notice case, node assertions for the 090 lane word. No time.Sleep.

[hivecommons-hive]

@clubanderson is auto-promoted for contributor-lane merging on this PR: the last 5 merged PRs by this author in this repository have no revert or sentinel-alert evidence. CI, reviewer verdict, diff fences, soak, holds and branch protection still apply.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#14582	✨ House-style section every kick opens with: repo HIVE_STYLE.md > hive default > built-in	same files	src/pkg/dashboard/static/index.html
#14573	✨ feat(dashboard): show a draft pill in the activity tracker	same files	src/pkg/dashboard/stage_tracker.go src/pkg/dashboard/stage_tracker_motion_test.go src/pkg/dashboard/stage_tracker_regressed_test.go src/pkg/dashboard/stage_tracker_repo_grouping_test.go src/pkg/dashboard/stage_tracker_ui_test.go src/pkg/dashboard/static/index.html

[hivecommons-hive]

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• test (dashboard 1/4)
• test (dashboard shuffle 2/3)
• test (rest 4/4)

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

[hivecommons-hive]

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• test (dashboard 3/4)
• test (dashboard shuffle 3/3)

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

[hivecommons-hive]

Read the three fixes against the tree at 17dd6f7 and the callers (automerge_stage_labels.go, sentinel_sweep.go, review_evidence.go). The routing and sentinel logic look correct to me; one low-severity, one-time migration wrinkle below that the body's "old bundles self-heal on deploy" line doesn't quite cover.

Verified

• A (sentinel pill) — stage_tracker.go:600-629: alert now comes from the live label, the bundle only promotes it when a finding has Notice. The sentinelClearedByMaintainer branch at sentinel_sweep.go:427-436 returns acted=false, so a cleared blocking finding is never re-recorded as notice-only — the case I was worried about doesn't exist.
• A2 — stageTrackerSameRepo (stage_tracker.go:1519-1539): hive vs hivecommons/hive → same; a/hive vs b/hive → different. delegated_pr_context.go:29 updated for the new signature.
• B (human approval) — humanEvidence (automerge_stage_human.go:106-108) only takes Detail.HumanApprover when HumanApprovalHead == obs.HeadSHA, consistent with how automerge_stage_labels.go:285 populates it. RouteHuman's manualMergeApproved requires len(decide)==0, so holds / fork-guard / unavailable-verdict still park at 085. automerge_stage_labels.go:769-770 writes route.LaneReason (now …:human-approved@login) into obs.Reason; ReadyComment returns before trustCause's result is used, and HumanApprovedReason splits it back for the tracker caption. ReadyComment's reason[:1] is guarded by the non-empty trim.
• Body matches the diff throughout.

Low — pre-existing notice-only bundles get a duplicated finding on first sweep after deploy

• review_evidence.go:475 sets ef.Notice = !blocked on every record, and containsSentinelFinding (review_evidence.go:509-516) dedupes with reflect.DeepEqual, which now includes Notice.
• For a trusted author's PR whose notice comment is already posted and has no label, trySentinelPR still returns event, true (sentinel_sweep.go:460-474, the posted case skips the create but not the return), so sentinelEvaluatePR records again. Such PRs are normally skipped by sentinelHeads.isSeen (sentinel_sweep.go:294), but that map is in-memory and empty right after the restart this deploy causes.
• Result: an old bundle {Rule, Summary, Paths} plus a new {…, Notice:true} → SentinelFindings doubles and the tracker reason gains (+1 more) for the same finding. Alert does self-heal to true, so only the count/tooltip is off, and only once per pre-existing bundle.
• Cheap fix if you want it: have containsSentinelFinding match on Rule/Summary/Paths and upgrade Notice in place, so the existing "same finding flagged again is not duplicated" test still holds across the flag flip.

Not blocking from my side; flagging so the doubled counts right after rollout aren't mistaken for new findings.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the routing change end-to-end (stagelabels/human.go, automerge_stage_human.go, sentinel_sweep.go, review_evidence.go, stage_tracker.go) and traced where the new ManualMerge / HumanApprover values go. The design holds: Route.ManualMerge is consumed only by stage labels, ReadyComment, and the dashboard (stage_tracker.go:1130, human.go:470/494); the automerge lane still decides on obs.Reason, so a trusted approval moves a workflow-path / tests-removed / human-merge-path PR from 085 to a manual-merge 090 without ever letting the hive merge it. That matches the body.

Also verified: the approver is only honoured when HumanApprovalHead == obs.HeadSHA (automerge_stage_human.go:107), so an approval on an older head does not settle a new one.

One low-severity, transitional finding — duplicated sentinel entries for pre-existing notice-only PRs.

• review_evidence.go:475 now stamps ef.Notice = !blocked on every recorded finding.
• For a trusted-author PR whose notice comment is already posted and has no label, trySentinelPR still returns acted=true each sweep (sentinel_sweep.go:467-474), so recordReviewEvidenceSentinel re-runs for heads that already have a bundle on disk.
• The bundle merge de-dupes with reflect.DeepEqual (review_evidence.go:332-336, :505-512). An existing entry written before this PR has Notice=false; the new one has Notice=true, so they are not equal and the bundle grows a second copy of the same finding.
• Consequence: stageTrackerSentinel counts len(b.Sentinel) (stage_tracker.go:~607), so such PRs read (+1 more) in the tooltip until the head changes. Alert state itself is correct (the Notice=true copy promotes it). Cheap fix if you want it: compare Rule/Summary/Paths in containsSentinelFinding and let a later Notice win, or treat Notice as a per-bundle upgrade.

Everything else I checked looked correct to me. The schema addition (v1.json:191) is additive and optional, so older bundles still validate.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#1457917dd6f7` sha256:f8d20398f2332a18aa23a662a404a2b14566a212fc0af23bd7263d6f145f6ecb — download from the dashboard or `hivectl review evidence #14579`.

[hivecommons-hive]

merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at 17dd6f7.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback