[hivecommons-hive]

Test Improvement

Adds five tests to __tests__/utils/authGuards.test.ts — the file that already holds the auth.ts survivor pins — each of which fails against the mutation it names and passes on main:

Test	src/utils/auth.ts site	Mutant it kills
checkIssueComments › memoizes per issue	line 146, memoized(... issueCommenters, ${owner}/${repo}#${issueNum})	key → `` (a commenter on issue 1 would authorize on issue 2)
the root OWNERS read › memoizes per repository	line 457, memoized(... rootOwners, ${owner}/${repo})	key → `` (Hello-World's reviewers would pass trusted on Other)
checkOrgMember › rejects with null	line 13, error !== null	→ true (TypeError escapes the catch instead of a warning)
checkOrgMember › message is not a string	line 21, typeof error.message === 'string'	→ true, and && → ||

Why. policyAllows and assertAuthorizedByOwnersOrMembership are the authorization decisions behind /lgtm, /approve, /hold and the label commands. Their per-repository memoization is what keeps one repository's OWNERS from leaking into another within the App server's or a cron run's state; ownersGuards.test.ts pins that key for repoHasOwners, but the two keys in auth.ts had no pin at all.

Evidence (local, main@9aa12b8, npx stryker run stryker.config.mjs --mutate src/utils/auth.ts): 284 mutants, 268 killed, 16 survived (94.37 %). The five above are behavioural; the other eleven are log text or equivalent (issue?.pull_request on callers that are all issue_comment handlers; contents === '' ahead of a parseOwners that already treats '' as {}), and are left alone. Each new test was checked by applying its mutant to the source by hand: 1 failed | 11 passed for each of the five; the file is 12 passed on unmodified main.

Related Issue

Refs #679 — the hive consolidated this finding's issue into that docs tracker by component. The remaining deliverable, adding src/utils/auth.ts to stryker.nightly.config.mjs with its reviewed-survivor table in docs/contributing.md and an extension of __tests__/mutationConfig.test.ts, is deliberately left out: #691 (held) edits those same lines for approve.ts, and a second PR over them would only force a rebase. It should follow once #691 lands.

Files: __tests__/utils/authGuards.test.ts only. No src/, docs, config or workflow change. Disjoint from held #680–#697 (none touch this file).

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[github-actions]

Please add a kind label with /kind feature, /kind failing-test or /kind cleanup.

[hivecommons-hive]

Verified correct — test-only, and the pins do what the table claims.

What I checked (repo at pr head f202abc):

• The four guarded sites exist as described: the per-issue commenter key at src/utils/auth.ts:146 (${owner}/${repo}#${issueNum}), the per-repository root-OWNERS key at src/utils/auth.ts:457 (${owner}/${repo}), and the error !== null / typeof error.message === 'string' arms of getErrorDetails at src/utils/auth.ts:13 and :21.
• Ran the file on the PR head: 12 passed.
• Reproduced two of the claimed mutant kills by hand: replacing the issue key at line 146 with fails exactly `memoizes per issue` (1 failed | 11 passed); replacing the repository key at line 457 with fails exactly memoizes per repository (1 failed | 11 passed). Both match the evidence table in the body.
• The error-arm expectations are consistent with the source: a null rejection takes the non-object branch and renders message=null; {status: 500, message: 42} fails the string check and renders String(error) → [object Object] — both warnings asserted verbatim.

The per-repository memoization test is the valuable one: it is the only pin keeping one repository's root OWNERS from authorizing trusted-policy commands on another within a shared App-server state, and nothing else in the suite distinguishes that key from ``.

Scope matches the body: one test file, no src/, config, or workflow change; deferring the stryker.nightly.config.mjs wiring until #691 lands avoids a conflicting edit to the same lines. Looks correct to me — a maintainer can take it from here.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88