[hivecommons-hive]

The ioscan classifier fail-open WARN (ioscan classifier failed open; text passes on unclassified) reached the selfreport classifier as an unclassified repeated error.

The log spam was already fixed on v5 by #14629 (the WARN is deduped per distinct error via warnOnce). What remained was that the message had no class, so any repeat still filed as unclassified_error_repeated.

Decision taken by hive: add the ioscan classifier failed open keyword to the existing ioscan_classifier_unavailable class (same root cause: no model endpoint), with test cases and a docs note. Fail-open semantics and config keys are unchanged.

Closes #14620

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 requested_by=@clubanderson

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#14670	🐛 fix(agent): keep the copilot transcript activity scan inside its interval	same files	src/pkg/fleetreport/runtime.go src/pkg/fleetreport/runtime_test.go

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me. Read src/pkg/scheduler/ioscan_enforce.go on v5: the fail-open branch logs exactly ioscan classifier failed open; text passes on unclassified through warnOnce at ioscan_enforce.go:305, so the new keyword at runtime.go:195 is a substring match on a real, already-deduped message, and both classifier tests gain the case. Same root cause as the fail-closed keyword (no model endpoint), so sharing ioscan_classifier_unavailable is the right call.

One operator-doc nit, not a defect: the amended row in src/docs/fleet-report.md:149 now reads "…or, under fail_mode: open, passed text on unclassified … — so untrusted text is withheld." For the fail-open branch the text is not withheld; it passes. Suggest splitting the consequence: "withheld (fail-closed) or passed unclassified (fail-open)".

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

[hivecommons-hive]

Evidence bundle `#14659166efa0` sha256:88ad64e9187538d3e1cb4c853c409af8275fcfe4c43d547eb5d44e3673a496af — download from the dashboard or `hivectl review evidence #14659`.