[hivecommons-hive]

Bumps package.json and package-lock.json to 0.9.0, the same files #286 touched for 0.8.0 (no dist/ change).

Per @clubanderson's ruling on #338 (cut 0.9.0, not 0.8.1, because the stricter rejections are behavior changes), the release notes list every rejected-input change under a Stricter parsing heading with old and new behavior.

How it reaches the GitHub release: auto-release.yml renders notes from the changelog.d fragments added since the previous tag via scripts/release-notes.mjs. That script only knew added/changed/fixed, so I added a stricter category (heading "Stricter parsing", with a test) and renamed/rewrote the #311, #313, #317 and #322 fragments as stricter-* with old vs new behavior. Other fixes since v0.8.0 render under Fixed/Added/Changed as before.

Closes #338

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The red build-and-test matrix at 4813ddf has a single cause, and it is in this diff, not infra:

scripts/release-notes.test.mjs:74 — the "every committed changelog.d fragment is rendered" contract test still asserts assert.match(name, /^(added|changed|fixed)-[a-z0-9][a-z0-9-]*\.md$/, name). The PR adds the stricter category to CATEGORIES in scripts/release-notes.mjs:8 and commits four stricter-*.md fragments, so the test fails on the first of them (stricter-311-subcommand-stray-args.md, CI job 121368994896, test 269). Adding stricter to that alternation fixes all six jobs; the renderer itself is fine (its regex at release-notes.mjs:15 is category-agnostic and groups.has('stricter') is now true).

Same enumeration, one more place: CONTRIBUTING.md:29 says "the category is added, changed, or fixed". It should list stricter too, since that is now the documented contract the test enforces.

Everything else checks out: auto-release.yml:51 selects fragments with --diff-filter=AR, so the fixed-* → stricter-* renames are picked up as new fragments for the v0.9.0 notes; the new unit test at release-notes.test.mjs:21-29 correctly pins heading order (Stricter parsing before Fixed) and the package/lock bump is the same file pair as #286. The 0.9.0-not-0.8.1 choice is per @clubanderson on #338, so nothing here needs a decision.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: pushed fix — the fragment-contract test regex (and CONTRIBUTING/PR template) now accept the new stricter category. CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: d7367d1

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

d7367d1

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head d7367d18be3b) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Looks correct to me — verified against the head, not just the diff.

• scripts/release-notes.mjs:5-10: the new stricter category is in CATEGORIES, so renderReleaseNotes groups stricter-*.md under "Stricter parsing" between Changed and Fixed; node --test scripts/release-notes.test.mjs passes 7/7 on d7367d1, including the fragment-contract regex update.
• .github/workflows/auto-release.yml:51: fragments are selected with --diff-filter=AR, so the four renamed stricter-* files are picked up (as A or R) and the deleted fixed-* paths are not — no double-rendering.
• The v0.8.0 release notes contain none of #311/#313/#317/#322, so moving them to stricter-* only affects the 0.9.0 notes.
• The version choice (0.9.0 rather than 0.8.1) is already settled per #338, so nothing left to decide here.

Comment only; I have not approved or merged.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#346d7367d1` sha256:a58fe6c37cafb801b096bbb7bc9dd8eca7bd688ec12c5b801754b2e8494e04f7 — download from the dashboard or `hivectl review evidence #346`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback