[hivecommons-hive]

Test Improvement

Files: __tests__/issueCommentTest/assign.test.ts, __tests__/issueCommentTest/cc.test.ts (one it added to each). No src/, dist/, docs/ or config change. Disjoint from every open held PR (#510–#544): the only one touching __tests__/issueCommentTest/ is #524 (trigger.test.ts); none touches assign.ts / cc.ts or their tests.

A single-operator mutation probe over src/issueComment/{assign,unassign,cc,uncc}.ts on main @ 88241f4 — 24 mutants, each run against npx vitest related <file> --run (576 tests) — left two survivors, the same shape in both files:

file	mutant	related tests
src/issueComment/assign.ts	assignees: authUsers → assignees: commentArgs	576 passed
src/issueComment/cc.ts	reviewers: authUsers → reviewers: commentArgs	576 passed

The other 22 (the length === 0 dispatch, case 0, every isAuthorized / isCollaborator / isAuthUser guard, and each self-target body in all four files) were killed. They survive because every unit case either authorizes every argument user (/assign @some-user @other-user, both org members) or none, so the write body never differs from the raw argument list. getOrgCollabCommentUsers' filter is pinned in __tests__/utils/auth.test.ts:284; nothing at the command level pinned that assign/cc send the filtered list.

This adds, to each file, a case where /assign @some-user @stranger (resp. /cc) has some-user an org member and stranger 404 on all three checks, asserting the POST body is exactly { assignees: ['some-user'] } / { reviewers: ['some-user'] }.

Coverage evidence. Unit (npm run test:coverage, 88241f4, local): both files already 100 % lines/branches — this is a mutation gap, not a line gap. End-to-end (npm run test:coverage:e2e, same revision, local): the mixed case is exercised through dist/index.js by __tests__/bundle/bundle.test.ts:846 (/assign @octocat @stranger) and __tests__/bundle/collaborationCommands.test.ts:61 (/cc, "dropping the rest"), but those only see a regression after npm run pack and vitest related cannot select them. e2e-covered, unit-unpinned: priority 3 (low).

Verification (this branch, local)

• npx vitest run __tests__/issueCommentTest/assign.test.ts __tests__/issueCommentTest/cc.test.ts: 21 passed
• Same vitest related set with the assign.ts mutant applied: 1 failed / 577 passed; with the cc.ts mutant applied: 1 failed / 577 passed (mutants reverted, not committed)
• npx eslint on both files: clean

Related Issue

Refs #507 — the hive consolidated this finding onto that tracker (already_existed: true, consolidated: true) when filed; #507's own subject (auth.ts:24, the getErrorDetails fallback) is #510's and stays with it. This PR is the complete fix for the assign/cc authorized-subset finding it names.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[github-actions]

Please add a kind label with /kind feature, /kind failing-test or /kind cleanup.

[mrbobbytables]

Copilot review performed under the maintainer's explicit authorization to update, review, release reviewed holds, and merge eligible PRs in this cleanup.

The mixed authorized/unauthorized argument fixtures assert the exact filtered write body independently for /assign and /cc; no production authorization behavior changes.

Verified successful build-test, e2e-coverage and DCO results on head aaa2a9f. Any folded issue findings remain assigned to the canonical destinations in the updated scope tables.