[thatguywob]

Closes #377

Prepare 0.11.0 per the maintainer decision: bump package.json and package-lock.json, roll all 52 pending fragments into CHANGELOG.md, and remove the consumed fragments. The release notes include Breaking: stricter CLI parsing, covering the four exit-2 rejections in #338/#342/#346/#348.

The release includes omp support and the gemini/aider/goose dangerous mappings already documented by the README, so no temporary main-only README note is needed when these ship together.

Hold for maintainer merge. Before lifting do-not-merge/hold, the owner must confirm the npm Trusted Publisher entry for @hivecommons/pluk points to hivecommons/pluk / publish.yml / environment npm. Merging to main triggers auto-release.yml to tag v0.11.0 and dispatch publish.yml via OIDC. If publication fails, follow runbooks/publish-failure.md. This PR does not itself tag or publish.

Validation: npm ci; npm test passed on Node 24 (coverage: lines 99.71%, branches 97.83%, functions 99.43%); git diff --check; verified every rolled fragment body is preserved verbatim.

— hive: backend=codex model=gpt-6.1-sol

---

🐝 Hive Agent: contributor | SHA: a5c0e47

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kellyaa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[thatguywob]

/hold

Release preparation for #377 is ready. Keep this PR held until a maintainer confirms the npm Trusted Publisher entry for @hivecommons/pluk → hivecommons/pluk / publish.yml / environment npm, then explicitly allows the merge that triggers tagging and publication.

— hive: backend=codex model=gpt-6.1-sol

---

🐝 Hive Agent: contributor | SHA: unknown

[hivecommons-hive]

Decision needed: @clubanderson should confirm the npm Trusted Publisher entry for @hivecommons/pluk points at hivecommons/pluk / publish.yml / environment npm, then lift do-not-merge/hold — merging this to main triggers auto-release.yml to tag v0.11.0 and publish via OIDC.

The release prep itself looks correct to me; the one remaining step is a human one (npm-side Trusted Publisher config), which this PR already asks for via do-not-merge/hold.

What I verified against main @ 305fde0 (the PR's merge-base, so it is current):

• changelog.d/ on base holds 52 fragments; the PR removes all 52 and leaves only .gitkeep. I checked every non-empty line of every fragment against the new ## 0.11.0 - 2026-10-26 section with an exact-line match — nothing missing, nothing reworded.
• package.json and both version fields in package-lock.json go 0.10.0 → 0.11.0; no other lockfile churn.
• .github/workflows/auto-release.yml:49 extracts notes with index($0, "## 0.11.0 ")==1, which matches the new heading, so the tag step will find a non-empty section rather than hitting the No nonempty CHANGELOG section no-op at line 52. publish.yml:41 applies the same gate.
• The "Breaking: stricter CLI parsing" summary cites #338/#342/#346/#348; each of those appears as a rolled fixed-* entry below it, so the headline is consistent with the body.

Open point for the approver (not a code defect): per #377, this is the first publish through OIDC Trusted Publishing and the npm-side entry is not visible to the hive. Once that is confirmed, lifting the hold should be all that's needed. I have not approved or merged anything.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Decision needed: @clubanderson should confirm the npm Trusted Publisher entry for @hivecommons/pluk (hivecommons/pluk / publish.yml / environment npm) exists, then lift do-not-merge/hold — merging this PR tags v0.11.0 and publishes to npm irreversibly.

The release prep looks correct to me; the only open item is the owner-side npm check before merge.

What I verified against the tree at a5c0e47 (merge-base 305fde0):

• All 52 changelog.d/*.md fragments on main are deleted and every fragment line appears verbatim in the new ## 0.11.0 - 2026-10-26 section of CHANGELOG.md (scripted line-by-line check; zero misses). Only changelog.d/.gitkeep remains.
• package.json:3 and package-lock.json:3,9 move 0.10.0 → 0.11.0; no other 0.10.0 literals exist outside CHANGELOG.md. src/version.ts:8 reads the version from package.json at runtime, so the pluk version gate in publish.yml:81-83 (test "$out" = "@hivecommons/pluk ${GITHUB_REF_NAME#v}") will pass.
• auto-release.yml:49-55 and publish.yml:36-41 extract the ## 0.11.0 section with the same awk; the heading format matches and the section is nonempty, so tagging and publishing will not be skipped.
• The "Breaking: stricter CLI parsing" section names the four exit-2 rejections (#338/#342/#346/#348) exactly as the maintainer decision on #377 asked.
• Per #377 (decision comment): "remove it in the release PR itself if both land together" — so the PR body's choice to omit a main-only README note for omp / gemini / aider / goose mappings is consistent with that decision, and README.md:128,133 already document them.

Nothing in the diff is defective. The hold is right: auto-release.yml:57-72 tags and dispatches publish.yml on merge to main, which is an npm publish through OIDC that cannot be undone (runbooks/release-rollback.md). The Trusted Publisher entry is npm-side account configuration not visible from the repo. I have not approved or merged anything.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

a5c0e47

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @thatguywob, head a5c0e47fa9bf) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hivecommons-hive]

Needs a decision, not a merge:

• the reviewer swarm returned requires_human @a5c0e47
• reviewer question: @clubanderson should confirm the npm Trusted Publisher entry for @hivecommons/pluk (hivecommons/pluk / publish.yml / environment npm) exists, then lift do-not-merge/hold — merging this PR tags v0.11.0 and publishes to npm irreversibly.
• a sentinel alert is open on this PR
• the do-not-merge/hold label is set
• the automerge lane will not merge this unattended

Head: verdict requires_human @a5c0e47, 4/4 checks green, DCO yes, sentinel alert, soak 29m0s of 30m0s, labels: do-not-merge/hold.

What to do: approve this head (a5c0e47) to merge as-is, or leave a changes requested review (or reply /hive decision <what to change>) and the hive will push the fix.

How to release it:

• After reading the verdict, a trusted merger can submit a GitHub Approve review for the current head and the lane clears the hold on its next pass; /hive approve replies on a PR are acknowledged but not consumed.
• Resolve the sentinel alert and have a maintainer clear its label.
• Resolve the reason for do-not-merge/hold, then have a maintainer remove that label; /hive approve does not remove it.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[hivecommons-hive]

Needs a decision, not a merge:

• the reviewer swarm returned requires_human @a5c0e47
• reviewer question: @clubanderson should confirm the npm Trusted Publisher entry for @hivecommons/pluk (hivecommons/pluk / publish.yml / environment npm) exists, then lift do-not-merge/hold — merging this PR tags v0.11.0 and publishes to npm irreversibly.
• a sentinel alert is open on this PR
• the do-not-merge/hold label is set
• the automerge lane will not merge this unattended

Head: verdict requires_human @a5c0e47, 4/4 checks green, DCO yes, sentinel alert, soak 30m0s elapsed, labels: do-not-merge/hold.

What to do: approve this head (a5c0e47) to merge as-is, or leave a changes requested review (or reply /hive decision <what to change>) and the hive will push the fix.

How to release it:

• After reading the verdict, a trusted merger can submit a GitHub Approve review for the current head and the lane clears the hold on its next pass; /hive approve replies on a PR are acknowledged but not consumed.
• Resolve the sentinel alert and have a maintainer clear its label.
• Resolve the reason for do-not-merge/hold, then have a maintainer remove that label; /hive approve does not remove it.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[clubanderson]

Checked downstream compatibility for the stricter CLI parsing before merge: hive v5 invokes pluk only as watch <session> --cli=<backend> --include-raw (src/crux/agent/pluk_dirs.go) and send <session> --text=... --enter (src/pkg/dashboard/inception_handlers.go). All of those flags are in the per-subcommand allowlists in src/cli-args.ts, so 0.11.0 does not break hive.

Hold stays on. The remaining step is npm-side: the package owner (clubanderson on npm) confirms the Trusted Publisher entry at npmjs.com/package/@hivecommons/pluk/access points at hivecommons/pluk / publish.yml / environment npm, then removes do-not-merge/hold and sentinel-alert and approves. Merging tags v0.11.0 and publishes irreversibly.