[hivecommons-hive]

Why

#14645 found that in 4 hours on one hive, 110 of 111 shadow fence would have denied external mutation warnings said repo hivecommons/hive writers exhausted (max 1). Most were label-only writes: 85 label_mutation, 11 issue_comment, and a handful of other kinds. The cause is DefaultMaxWritersPerRepo = 1 together with activeWritersLocked(repo). That gives each repository one writer slot shared by every issue, PR and mutation kind, so a single in-flight review or merge on any PR blocks every label write on every other item. These writes all still ran because the boundary is in shadow mode. Once it moves to enforce, they would be denied.

Decision taken by hive

The writer slot is now scoped per target (owner/repo#N) instead of per repository. Mutations with no issue or PR number (branch_push, issue_create, pull_request_create, digest/branch targets) fall back to one shared pool per repo. The default stays max 1 per scope, and the limit can be set with the new key convergence.mutation.max_writers_per_target. We picked per-target over per-(repo, kind) because it is the simplest change that fully separates unrelated items. Writes to the same item still go one at a time, which keeps label, review and merge ordering on one PR serialized.

The change adds code and renames nothing:

• mutation.OpenLedger and DefaultMaxWritersPerRepo behave as before (per-repo scope).
• New: WriterScope, RepoWriterScope, TargetWriterScope, OpenLedgerScoped, DefaultMaxWritersPerTarget.
• cmd/hive now opens the boundary ledger with OpenLedgerScoped(..., cfg.MutationMaxWritersPerTarget(), TargetWriterScope).
• The capacity error keeps its existing shape. Repo-scoped claims still read repo X writers exhausted (max N), and target-scoped claims read target X#N writers exhausted (max N). The boundary.go comment now describes both.
• The new key is added to the settings-parity allowlist as yaml-only.

Tests (each fails without the change)

• Two writers on different PRs in the same repo both acquire under target scope, and the per-repo ledger still refuses the second.
• A second writer on the same repo#number is refused with target … writers exhausted (max 1).
• Mutations with no number share the repo slot and do not block numbered targets.
• max_writers_per_target: 2 lets two writers onto one target and refuses the third.
• Ask 3: at enforce, label_mutation on ✨ Multi-agent KubeStellar deployment: supervisor + 4 executors #5 and docs: update supervisor CLAUDE.md with EXECUTOR MODE and dispatcher protocol #6 are admitted while a review_submit on ✨ Add macOS/launchd support, hybrid scanner pattern, and KubeStellar case study #3 is in flight, and a label on ✨ Add macOS/launchd support, hybrid scanner pattern, and KubeStellar case study #3 itself is still denied.
• The config accessor reads the knob from YAML and treats an unset or non-positive value as the default.

All tests use injected clocks and contain no time.Sleep.

Closes #14645

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88 requested_by=@clubanderson

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#14687	🐛 fix(agent): log a repeated hub project-config refusal once per distinct misconfiguration	same files	src/cmd/hive/main.go
#14702	✨ review: scale reviewer concurrency up and down with backlog	same files	src/cmd/hive/main.go
#14688	🐛 fix(adoption): re-sign inherited commits when re-homing a dco-missing contributor PR	same files	src/cmd/hive/main.go
#14524	✨ feat(hub,agent): Hub-coordinated live CLI session pool for multi-tenant runner capacity	same files	src/cmd/hive/main.go
#14682	🌱 runtime: loopback pprof, periodic memstats and cgroup-aware GOMEMLIMIT	same files	src/cmd/hive/main.go src/pkg/dashboard/settings_parity_allowlist.txt
#14695	✨ review: reviewer lane scales concurrency with backlog	same files	src/cmd/hive/main.go

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me. Read against the v5 tree, not just the diff:

• TargetWriterScope parses the subject the boundary actually mints: claimSubject at src/pkg/convergence/mutation/boundary.go:300 builds repo#kind/target, and every numbered caller I surveyed in src/pkg/github/** passes Target: strconv.Itoa(number); branch/push/create callers pass a ref, which is non-decimal and falls back to the repo pool as intended. No effects.Kind* constant contains /, so stripping to the first / cannot mis-split.
• Repo-wide safety is unchanged: Overlaps (claim.go:128-130) still makes a ClaimTypeRepo claim conflict with every task claim in the repo via ErrClaimHeld, so narrowing only the capacity bucket does not let a repo claim run alongside an in-flight per-target mutation.
• main.go:2027 is the only production OpenLedger caller, so the scope switch is complete; OpenLedger keeps its per-repo behaviour for existing tests/callers.
• settings_parity_allowlist.txt entry included, which is why test (dashboard …) is green here (contrast #14677, same day, which missed it).

One suggestion, not a defect: convergence.mutation.max_writers_per_target is named in the changelog but documented nowhere an operator reads — src/hive.yaml.example has no convergence: block and src/docs/env-vars.md is the only place convergence.mode appears. A two-line example under a convergence: stanza would make the knob discoverable. Fine to do in a follow-up.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/check-report (head 932034f): the only red check, build (linux/arm64, true, true, 75), is infrastructure, not this diff — buildx could not fetch a cached image layer from the registry (failed to compute cache key … could not fetch content descriptor sha256:9787421b… not found). All test shards, coverage and the gates are green; merge relay refused at this head because it moved past the reviewed SHA b99a49d. Deferring to the next sweep.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: bcad0c9b5

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

CI triage for 932034f: the red build (linux/arm64, true, true, 75) job is an infrastructure failure, not a code failure.

• arm64 job 122449392089 failed inside buildx while resolving the remote build cache: failed to compute cache key: ... could not fetch content descriptor sha256:9787421b… from remote: not found (a cache layer vanished from the registry).
• amd64 job 122449392083 was only cancelled by fail-fast as a result; it was still mid-apt-get with no errors of its own.

This PR touches only Go sources, a test, a changelog fragment, and the settings-parity allowlist — nothing in the Dockerfile or build-cache configuration — so there is no code fix to push. The build should pass on a re-run once the cache is warm/repopulated.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read ledger.go, boundary.go and claim.go at this head. Looks correct to me, and it is the per-target option #14645 asked for first.

What I checked, since TargetWriterScope depends on the subject shape rather than a structured field:

• boundary.go:302-304 builds the subject as repo#<kind>/<target>; every kind in src/crux/effects/effects.go:19-30 is a plain snake_case token with no /, so ledger.go:79-87 strips exactly the kind and keys on the target. A numeric target (strconv.Itoa(number), the normal case) buckets as repo#N; a branch-named target (automerge_contributor_adopt.go:677, :703 — hive/adopt-7) is left with adopt-7 after the first /, fails isDecimal, and falls back to the repo bucket as the doc comment promises.
• claim.go:116-129 — Overlaps is untouched, so the repo-claim-vs-task-claim exclusion still holds across buckets; only the capacity count changed.
• OpenLedger keeps RepoWriterScope (ledger.go:155), so existing callers and the cross-process tests keep today's semantics; only bootAdvisoryWith opts into the target scope.
• MutationMaxWritersPerTarget() returns 0 for nil/unset/non-positive and OpenLedgerScoped maps 0 to the default of 1, so an absent convergence.mutation block behaves as the changelog states.

One remark, not a finding: the error-string branch at ledger.go:313-317 picks the "repo … exhausted" wording by scope == c.Repo, which is also what a target-scoped ledger emits for branch pushes/creates — accurate, since those are counted per repo.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#14671932034f` sha256:e997e395208236b9415e2a2cdae80eeb4660bb12f3ddb8f289f8cee50cadb246 — download from the dashboard or `hivectl review evidence #14671`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback