🐝 Hive Advisory Report

[kubestellar-hive]

This issue collects advisory findings from Hive agents.

At lower ACMM levels, some agents work in advisory mode — they analyze code and post findings here but do not create issues or PRs. At higher levels, designated agents (e.g. quality) can open issues and PRs directly, while other agents remain advisory-only.

The governor posts periodic digest comments summarizing what advisory agents found.

Do not close this issue. It is a living document.

[kubestellar-hive]

🐝 Advisory Digest — 2026-06-13 14:27 EDT

Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

Findings: 891

Severity	Count
🔴 critical	90
🟠 high	325
🟡 medium	368
🔵 low	108

🔴 CRITICAL (90)

• [advisory] No unit tests for XSS sanitizer (sanitizeHtmlForMdx / stripUntilStable) src/app/docs/[...slug]/page.tsx quality
• [advisory] console: Playwright E2E broken on main (fixture destructuring) kubestellar/console:web/e2e/compliance/card-loading-compliance.spec.ts quality
• [advisory] transformMdx.ts XSS sanitization logic has no unit tests src/lib/transformMdx.ts quality
• [advisory] pkg/api/handlers build broken - missing auth_compat.go file pkg/api/handlers/auth_compat.go quality
• [advisory] Federation providers test broken — containsString redeclared in 3 files pkg/agent/federation/providers quality
• [advisory] pkg/mcp bridge_test.go broken — missing fmt import + Client type mismatch pkg/mcp/bridge_test.go quality
• [advisory] No 'go build ./...' pre-merge gate — 8 packages broken on main .github/workflows/go-test.yml quality
• [advisory] pkg/store build failure from missing imports in sqlite_dashboards_test.go pkg/store/sqlite_dashboards_test.go quality
• [advisory] solver_additional_test.go doesn't compile — AddClient undefined, blocks solver suite pkg/stellar/solver/solver_additional_test.go quality
• [advisory] pkg/api/handlers build failure blocks 169-file API test suite pkg/api/handlers quality
• [advisory] Critical: Import cycle in pkg/k8s breaks compilation on main pkg/k8s/gpu/client_gpu_cronjob.go quality
• [advisory] pkg/store/crypto.go at 19% coverage — encrypt/decrypt paths untested pkg/store/crypto.go quality
• [advisory] 4 packages fail go vet/test from redeclared test funcs pkg/k8s/rbac_probe_test.go,pkg/api/handlers/missions_test.go,pkg/compliance/hipaa/summary_test.go quality
• [advisory] pkg/k8s/client_clients.go untested with active nilaway violations pkg/k8s/client_clients.go quality
• [advisory] kubestellar-mcp: 3 pre-existing compilation errors block CI in pkg/mcp/server and pkg/deploy/mcp pkg/mcp/server/upgrades_test.go quality
• [advisory] Merged PR 🐛 fix: resolve all Go and TypeScript build failures on main #17920: fix main build (15 critical issues closed) gh-17920 scanner
• [advisory] PR [scanner] fix: resolve build break from PR #17996 #18016: resolve build break from PR 🌱 fix: resolve Playwright cross-browser nightly workflow failure #17996 gh-18010 scanner
• [advisory] MCPVersion re-exported via PR ✨ Lock demo mode on Netlify and show install guide on exit attempt #281 (already closed) gh-280 scanner
• [advisory] Node.js 20 EOL upgrade via PR Clicking on "nodes" stat block in stats overview on the My Clusters dashboard gives an error #5902 (already closed) gh-5900 scanner
• [advisory] Netlify edge function tests added via PR [quality] add unit tests for Netlify edge functions (robots, sitemap, seo-meta) #17598 (already closed) gh-17597 scanner
• [advisory] Build break 🐛 Build broken after merging PR #17598 #17610 dispatched to agent gh-17610 scanner
• [advisory] Build break 🐛 Build broken after merging PR #17595 #17612 dispatched to agent gh-17612 scanner
• [advisory] Build break 🐛 Build broken after merging PR #17589 #17613 dispatched to agent gh-17613 scanner
• [advisory] Build cascade: fix PRs [scanner] fix: resolve build breaks from PRs #17649, #17611, #17646, #17636, #17634, #17589 #17662→[scanner] fix: resolve build breaks from PRs #17664, #17661, #17663 #17684→[scanner] fix: resolve build breaks from PRs #17674, #17673, #17666, #17671 #17685 need ordered merge to unblock CI gh-17685 scanner
• [advisory] Critical: main build broken with 3 Go errors + TS type errors gh-17715 scanner
• [advisory] Critical: Go build broken on main — import cycles + missing types from extraction PRs gh-17715 scanner
• [advisory] Dispatched build-fix agent for 20 critical build issues gh-17715 scanner
• [advisory] PR [scanner] fix: resolve Go build import cycles and missing types #17744 opened: fix Go build import cycles (20 issues) gh-17744 scanner
• [advisory] Go build broken on main - import cycles and undefined symbols gh-17715 scanner
• [advisory] Go build fix too complex for single session - needs manual intervention gh-17742 scanner
• [advisory] Auth smoke test failure investigation dispatched gh-17748 scanner
• [advisory] Build fix: 34 TS errors from async getStoredAuthToken() gh-17750 scanner
• [advisory] Critical build breaks on main (🐛 Build broken after merging PR #17786 #17794, 🐛 Build broken after merging PR #17789 #17795, 🐛 Build broken after merging PR #17785 #17796) gh-17794 scanner
• [advisory] Build crisis: 9 issues (17750+17794-17801) from async getStoredAuthToken — agent dispatched gh-17750 scanner
• [advisory] Critical: main branch has multiple build failures — 9 issues grouped for single fix gh-17750 scanner
• [advisory] TS async errors (Build broken on main: 34 TS errors from sync use of async getStoredAuthToken() — blocks visual tests project-wide #17750) — dispatched fix agent, closes 9 build-broken issues gh-17750 scanner
• [advisory] Build broken on main: 17+ issues from accumulated PR merges gh-17750 scanner
• [advisory] 10 build-breakage issues on main — dispatched 2 fix agents gh-17848 scanner
• [advisory] Build breakages: 10 critical issues dispatched to 2 opus agents gh-17848 scanner
• [advisory] Main branch broken: 10+ build breakage issues from recent refactoring merges gh-17848 scanner
• [advisory] PR 🐛 fix: resolve build breakages on main #17887 opened: fix build breakages (Go import cycle + TS async errors) gh-17887 scanner
• [advisory] Go build broken on main — stellarK8sClient interface mismatch + syntax errors gh-17884 scanner
• [advisory] TypeScript build broken — 20+ type errors from async/rename migration gh-17885 scanner
• [advisory] Fix main build: import cycle + async migration + go.sum (15 issues) gh-17897 scanner
• [advisory] Greetings workflow fixed via PR [ci-maintainer] fix: move greetings workflow permissions to workflow level #17592 (already closed) gh-17590 scanner
• [advisory] Build broken on main: async getStoredAuthToken migration incomplete gh-17921 scanner
• [advisory] PR 🐛 fix: resolve TS build errors from async getStoredAuthToken migration #17926 opened: fix async getStoredAuthToken build breakage on main gh-17926 scanner
• [advisory] Build broken on main after PR 🐛 fix: resolve all Go and TypeScript build failures on main #17920 merge — TS async/await errors gh-17921 scanner
• [advisory] Go build broken: dispatched fix agent for [ci-maintainer] Go build broken: store.AuditEntry type mismatch in audit_export_integration_test.go #17949,[ci-maintainer] Go build broken: undefined symbols in 3 feedback test files block pkg/api/handlers compilation #17950,[ci-maintainer] Go build broken: undefined test helpers in pkg/api/handlers/workloads (setupTestEnv, injectDynamicClusterWithObjects) #17951 (test compile errors) gh-17949 scanner
• [advisory] PR [scanner] 🐛 fix: resolve Go build errors in test files (audit, feedback, workloads) #17962 opened: fix Go build errors in test files (audit, feedback, workloads) gh-17962 scanner
• [advisory] Build breakage fix PR [scanner] fix: resolve remaining TypeScript build breakage #17987 opened (TS errors from auth extraction) gh-17964 scanner
• [advisory] 7 critical build breaks from recent PR merges gh-17980 scanner
• [advisory] CodeQL conflict fixed via PR Add the remove-cluster button for offline clusters #5901 (already closed) gh-5899 scanner
• [advisory] PR [scanner] fix: resolve build breaks from PRs #17970 and #17971 #18017: resolve build breaks from PRs [strategist] planning: update risk register with June 12 findings #17970 and [architect] fix: resolve build breakage from auth sub-package extraction (#17925) #17971 gh-17980 scanner
• [advisory] PR [scanner] fix: resolve build breaks from PRs #17976-#17979 and #17987 #18019: resolve build breaks from PRs [scanner] fix: update gh-aw v0.79.4 → v0.79.6 #17976-🌱 fix: add DCO sign-off to automation workflows and create incident response playbook #17979 and [scanner] fix: resolve remaining TypeScript build breakage #17987 gh-17997 scanner
• [advisory] Build broken on main: undefined symbols after handler subpackage extraction gh-18135 scanner
• [advisory] Critical build break on main (PR [sec-check] fix: bound logCache and validate fetchJobLog redirect URL #18173) gh-18184 scanner
• [advisory] PR 🐛 fix: resolve undefined symbols breaking build after PR #18173 #18192 opened: fix build break from PR [sec-check] fix: bound logCache and validate fetchJobLog redirect URL #18173 gh-18192 scanner
• [advisory] PR fix: resolve remaining go vet errors after stellar extraction #18097 skipped: merge conflicts, owned by @clubanderson gh-18097 scanner
• [advisory] Build broken: missing Loader2 import in QuantumControlPanel.tsx gh-18211 scanner
• [advisory] Merged 5 PRs: [architect] refactor: extract WebSocket/SSE transport to pkg/api/transport #18217, 🐛 [scanner] fix: repair broken test builds across handler sub-packages #18216, 🐛 [scanner] fix: add missing Loader2 import to QuantumControlPanel #18215, 🌱 [quality] Add persistence and filter tests for workloads handlers (65% → 75%) #18213, 🐛 [scanner] fix: add missing async keywords to test functions using await #18209 gh-18215 scanner
• [advisory] 7 duplicate build-break issues (🐛 Build broken after merging PR #18242 #18252-Workflow failure: Build and Deploy KC #18259) already closed - same root cause gh-18259 scanner
• [advisory] Skipped 15 issues as too-large-for-one-session: [architect] pkg/agent is a 107-file monolith mixing HTTP server, AI providers, and k8s ops — extract sub-packages #17124,🐝 Hive Advisory Report #17528,[architect] pkg/k8s is a 45-file flat package mixing client ops, RBAC, GPU, dependencies, and gateway concerns #17576,[quality] 33 Go API handler files lack test coverage (feedback, missions, MCP) #17600,[architect] web/src/hooks is a 194-file flat directory — group into domain sub-packages #17882,[architect] web/src/lib has 83 top-level files (13.5K LOC) — consolidate analytics module and reduce root sprawl #17883,llm-d stack monitoring (EPP, model endpoint health, autoscaler dashboard) #18031-Accessibility audit (WCAG 2.1 AA compliance) #18037,[strategist] CNCF security audit Q2 2026 action item overdue — ROADMAP deadline passed #18207 gh-17124 scanner
• [advisory] closed: unit-test nightly regression was already fixed by PR [scanner] fix: resolve auth-contract test failures #18290 gh-18299 scanner
• [advisory] closed: 4 issues already resolved (build/workflow/TS errors from storybook fix) gh-18294 scanner
• [advisory] [Auto-QA] Components fetching data without loading/error states #18311 closed: false positive — cards already have error states gh-18311 scanner
• [advisory] [Auto-QA] Hardcoded colors instead of design tokens #18312 closed: duplicate of PR 🌱 [scanner] fix: replace hardcoded colors with design tokens and fix dark mode #18314 gh-18312 scanner
• [advisory] Feature issues llm-d stack monitoring (EPP, model endpoint health, autoscaler dashboard) #18031-18037 are large feature requests requiring design — not scanner-fixable gh-18031 scanner
• [advisory] Build break: server_ai_tokens.go int64 mismatch — dispatched fix gh-18343 scanner
• [advisory] Build bugs 🐛 Build broken after merging PR #18341 #18358-🐛 Build broken after merging PR #18351 #18362 already fixed by PR [scanner] fix: resolve int64 type mismatch in server_ai_tokens.go #18356 gh-18358 scanner
• [advisory] Merged PR [strategist] planning: ROADMAP pass 11 — community momentum, security posture #18375 (ROADMAP pass 11) gh-18375 scanner
• [advisory] [sec-check] SSRF: pkg/ssrf.IsBlockedIP missing IsMulticast; card_proxy duplicates validation logic #18372 already covered by PR [sec-check] fix: add IsMulticast to ssrf.IsBlockedIP; unify card_proxy with shared pkg #18374 gh-18372 scanner
• [advisory] [ci-maintainer] Go Tests: TestDiscover/escapes_namespace_and_agent_name — URL path not percent-encoded in kagentiprovider #18367 already fixed on main — closed as not planned gh-18367-closed scanner
• [advisory] pkg/store coverage raised to 42% via PR [scanner] fix: raise pkg/store coverage ratchet from 0% to 42% #17591 (already closed) gh-17581 scanner
• [advisory] GPU CronJob tests added via PR [scanner] fix: add unit tests for GPU CronJob Install/Uninstall #17596 (already closed) gh-17579 scanner
• [advisory] Advisory report 🐝 Hive Advisory Report #17528 is a living document — no action needed gh-17528 scanner
• [advisory] settings-migration-test build failure (transient, resolved on HEAD) gh-17518 scanner
• [advisory] auth-lifecycle-test build failure (transient, resolved on HEAD) gh-17517 scanner
• [advisory] console#17495: workloadQueries tests already exist — issue closed gh-17495 scanner
• [advisory] Credential revocation (console#17191) requires GCP admin action — not a code fix gh-17191 scanner
• [advisory] Exposed credential in console git history — requires GCP revocation (not code fix) gh-17191 scanner
• [advisory] console#17191 requires manual GCP credential revocation — not automatable gh-17191 scanner
• [advisory] Auth smoke test failed due to same build error gh-17465 scanner
• [advisory] Build broken: import shadowing in sqlite_migrations.go gh-17460 scanner
• [advisory] Build broken: migrations package shadowed by local variable in sqlite_migrations.go gh-17460 scanner
• [advisory] PR 🐛 fix: add nil guard in MCP client send to prevent panic #18378 opened for [ci-maintainer] Go Tests: pkg/mcp Client.send nil pointer panic at client.go:470 (recovered but causes test failures) #18370 (MCP nil pointer) gh-18378 scanner
• [advisory] PR [scanner] fix: add KC_INTEGRATION_TESTS skip guards for helm/git/kubectl tests #18379 opened for [ci-maintainer] Go Tests: pkg/agent helm/git/kubectl tests fail in CI — no skip guard for real system calls #18368 (test skip guards) gh-18379 scanner
• [advisory] PR 🐛 fix: resolve data race in SSE cache evictor stop #18380 opened for [ci-maintainer] Go Tests: pkg/api/transport data race in sse_cache.go:45 (TestStopSSECacheEvictor_DoubleCallSafe) #18369 (SSE cache data race) gh-18380 scanner
• [advisory] CNCF security audit Q2 action overdue: ROADMAP filing deadline was Q2 2026 gh-18207 strategist
• [advisory] scanner guardrails PR 🐛 [scanner] fix: add guardrails to prevent scanner merge loop #18329 advisory-only: 4 merges in 2min at 13:48-13:50 UTC prove policy files unenforced gh-18329 strategist

🟠 HIGH (325)

• [advisory] pkg/k8s broken extraction reverted — proper DI-based decomposition still needed console#17741 architect
• [advisory] pkg/k8s flat package (45 files) needs sub-package decomposition — issue [architect] pkg/k8s is a 45-file flat package mixing client ops, RBAC, GPU, dependencies, and gateway concerns #17576 pkg/k8s architect
• [advisory] pkg/agent god struct Server has 30+ fields mixing 7+ concerns pkg/agent/server.go gh#17178 architect
• [advisory] Vision: GitHub-native E2E visual regression tool that tracks UI changes across merged PRs inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Constitution: TypeScript GitHub Action using Playwright for screenshot capture and gh CLI for issue management inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Requirement: Detect merged PRs since last run and compute visual diff per PR inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Requirement: Classify diffs as regression vs. advancement and open GitHub Issues only for regressions inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Constraint: Scoped to exactly one repository; no cross-repo or monorepo fan-out inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Stakeholder: Developers who need automated, low-noise UI regression detection after merges inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Acceptance: Regression issues are opened only for unintentional visual breakage, not for intentional UI changes inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Go Tests: pkg/mcp Bridge tests timeout 600s each run — no KC_INTEGRATION_TESTS skip guard go-tests-ci / issue-18338 ci-maintainer
• [advisory] Go Tests: widespread failures across 13 packages, including nil panic in pkg/api/handlers go-tests-27451940255 ci-maintainer
• [advisory] Go Tests: pkg/mcp Client.send nil panic at client.go:470 go-tests-ci / issue-18370 ci-maintainer
• [advisory] Go Tests: pkg/api/transport data race in sse_cache.go:45 go-tests-ci / issue-18369 ci-maintainer
• [advisory] Go Tests: TestDiscover URL path not percent-encoded in kagentiprovider go-tests-ci / issue-18367 ci-maintainer
• [advisory] Go Tests: pkg/agent helm/git/kubectl tests fail in CI — no skip guard go-tests-ci / issue-18368 ci-maintainer
• [advisory] kubestellar/docs: Critical test gap — 7 percent file coverage (6/90 source files) kubestellar/docs/src/ quality
• [advisory] Console repo: 137/462 Go source files lack test coverage pkg/api/handlers/ quality
• [advisory] pkg/api/handlers/mcp: 4499 LOC with zero test coverage (blocked by package conflict) pkg/api/handlers/mcp/handler.go quality
• [advisory] pkg/api/handlers/mcp/drasi_proxy.go declares wrong package (handlers vs mcp) pkg/api/handlers/mcp/drasi_proxy.go:27 quality
• [advisory] pkg/agent/kube ValidateKubectlArgs security-critical function at 72% coverage pkg/agent/kube/client.go quality
• [advisory] pkg/api/transport SSE cache and hub demo session functions at 0% coverage pkg/api/transport/sse_cache.go quality
• [advisory] pkg/api/handlers/missions untestable due to undefined symbols after refactor pkg/api/handlers/missions/handler.go quality
• [advisory] 4 packages have test build failures blocking all test execution pkg/mcp/client_test.go,pkg/watcher/watcher_test.go,pkg/services/stellar/service_test.go,pkg/settings/manager_validation_test.go quality
• [advisory] agent/kube context.go functions entirely untested (buildLiveClusterContext, appendClusterHealth, appendPodIssues) pkg/agent/kube/context.go quality
• [advisory] kagentiprovider client functions at 0% coverage (Invoke, Discover, Detect, Status, ListAgents) pkg/kagentiprovider/client.go quality
• [advisory] pkg/k8s/k8stest uses corev1 for authz types — SelfSubjectAccessReview undefined pkg/k8s/k8stest/mocks_test.go quality
• [advisory] pkg/store OAuth tests require CREDENTIAL_ENCRYPTION_KEY — not self-contained pkg/store/sqlite_oauth_credentials_test.go quality
• [advisory] pkg/api/audit tests broken by SSRF validation — same pattern as [quality] fix: SSRF validation breaks webhook tests and loopback allowance #17888 pkg/api/audit/destinations_test.go quality
• [advisory] Federation provider actions at 0% — 14 destructive cluster operations untested pkg/agent/federation/providers/capi_actions.go quality
• [advisory] pkg/stellar/solver at 49% — autonomous K8s decision loop pkg/stellar/solver/solver.go quality
• [advisory] pkg/services/stellar at 30.2% coverage — core AI runtime service pkg/services/stellar/service.go quality
• [advisory] SSRF validation breaks webhook tests — 7 tests failing pkg/notifications/webhook.go quality
• [advisory] 31 API handlers have no unit tests (MCP, Stellar, Feedback) pkg/api/handlers quality
• [advisory] 5 packages have test build failures blocking CI coverage pkg/watcher,pkg/mcp,pkg/stellar/observer,pkg/services/stellar,pkg/api/handlers quality
• [advisory] PR [scanner] refactor: extract DCGM types from pkg/agent to pkg/gpu #17772: pkg/gpu extraction has zero unit tests pkg/gpu/scraper.go quality
• [advisory] pkg/mcp: build failure on main (unused variable in test) pkg/mcp/client_test.go:523 quality
• [advisory] pkg/stellar/observer at 42% — event processing logic gaps pkg/stellar/observer/observer.go quality
• [advisory] pkg/api/middleware/auth.go 25% uncovered — auth error paths at risk pkg/api/middleware/auth.go quality
• [advisory] 21 packages with build/setup failures blocking coverage analysis pkg/agent,pkg/api,pkg/k8s,pkg/stellar quality
• [advisory] pkg/watcher core functions at 0% coverage (24% overall) pkg/watcher/watcher.go quality
• [advisory] pkg/ssrf ValidateHost DNS path at 40% coverage (security-critical) pkg/ssrf/ssrf.go quality
• [advisory] feedback GitHub integration: 1,519 LOC untested issue creation/linking pipeline pkg/api/handlers/feedback_github_issues.go quality
• [advisory] feedback GitHub integration: 1,519 LOC untested — tests written awaiting push pkg/api/handlers/feedback_github_issues.go quality
• [advisory] Feedback GitHub integration untested (1,519 LOC) pkg/api/handlers/feedback_github_issues.go quality
• [advisory] Stellar solver/watches handlers untested (1,574 LOC) pkg/api/handlers/stellar_solver.go quality
• [advisory] Go API handlers: 33 source files without test coverage (feedback, missions, MCP) pkg/api/handlers/feedback_github_issues.go quality
• [advisory] pkg/k8s/client_gpu_cronjob.go Install/Uninstall functions lack unit tests pkg/k8s/client_gpu_cronjob.go quality
• [advisory] pkg/agent: update_execute.go remains untested (366 LOC, needs refactor for mockability) github.com/kubestellar/console/issues/17565 quality
• [advisory] pkg/agent: config resource + kubeconfig handlers untested (669 LOC) pkg/agent/server_http_resources_config.go quality
• [advisory] SSE resource stream handlers at 0% coverage (170 LOC) pkg/agent/server_http_resources_stream.go quality
• [advisory] pkg/agent mutation handlers (namespace/SA/serviceexport) lack input validation tests pkg/agent/server_http_resources_workloads.go quality
• [advisory] pkg/agent has 23 untested files totaling ~2000+ LOC — server_http_resources_workloads.go (423), server_http_resources_config.go (359), server_http_kubeconfig.go (310) are largest pkg/agent/server_http_resources_workloads.go quality
• [advisory] pkg/agent server_health.go (178 LOC) has zero test coverage — HTTP health/status/metrics/provider-check handlers pkg/agent/server_health.go quality
• [advisory] pkg/k8s/client_gpu_health.go has zero test coverage (285 LOC) pkg/k8s/client_gpu_health.go quality
• [advisory] Pre-existing test redeclarations block pkg/k8s CI pkg/k8s/rbac_probe_test.go quality
• [advisory] PR [scanner] fix: pin react-hooks lint rules to unblock nightly release #17507 needs .lint-warning-baseline update to 2312 to pass CI web/.lint-warning-baseline quality
• [advisory] Pre-existing test redeclaration errors block all Go PRs pkg/compliance/hipaa/summary_test.go,pkg/k8s/rbac_probe_test.go,pkg/api/handlers/missions_test.go quality
• [advisory] client_clients.go: zero test coverage on critical multi-cluster connection logic pkg/k8s/client_clients.go quality
• [advisory] pkg/k8s/client_workloads.go has zero test coverage for deployment status logic pkg/k8s/client_workloads.go quality
• [advisory] clusterDisplayName test contradiction: shared-distribution.test.ts expects stale slice(0,22) web/src/hooks/mcp/__tests__/shared-distribution.test.ts quality
• [advisory] kubestellar-mcp: MCP tool registry files (684 LOC) lack dedicated unit tests pkg/mcp/server/tools_workloads_registry.go quality
• [advisory] 788 React Compiler lint warnings with no regression gate web/eslint.config.js quality
• [advisory] pkg/mcp/tools/upgrades has zero test coverage (1112 lines) pkg/mcp/tools/upgrades/upgrades.go quality
• [advisory] DeviceTracker parseDeviceCounts/checkForBoolDrop had <37% coverage pkg/agent/workers/workers_device_tracker.go quality
• [advisory] handleMixedModeChat 0% coverage - critical AI chat path pkg/agent/server_ai_mixed.go quality
• [advisory] workloadQueries/ directory (5 modules) has zero test coverage web/src/hooks/mcp/workloadQueries/ quality
• [advisory] kubestellar-mcp: RBAC tools missing tests for 5 of 11 functions (AnalyzeSubjectPermissions, DescribeRole, FindResourceOwners, AuditKubeconfig, subjectMatches) pkg/mcp/server/tools_rbac.go quality
• [advisory] safeLazy utility has zero unit tests despite being used by 16+ components web/src/lib/safeLazy.ts quality
• [advisory] console: pkg/stellar/scheduler has 27.6% test coverage — scheduling decisions untested pkg/stellar/scheduler quality
• [advisory] console: pkg/stellar/solver has 3.1% test coverage — AI scheduling logic nearly untested pkg/stellar/solver quality
• [advisory] console: pkg/stellar/observer has 2.6% test coverage — critical observability gap pkg/stellar/observer quality
• [advisory] tool_registry.go has zero dedicated unit tests pkg/mcp/server/tool_registry.go quality
• [advisory] pkg/api/handlers: 39 source files lack unit test coverage pkg/api/handlers/ quality
• [advisory] MCP server pkg/mcp/server at 40.5% coverage — 9 tool functions at 0% pkg/mcp/server/upgrades.go quality
• [advisory] pkg/mcp/server/upgrades.go test coverage critically low (10% ratio) pkg/mcp/server/upgrades.go quality
• [advisory] tools_kubectl.go handlers lack unit tests (handleDeleteResource, handleKubectlApply) pkg/deploy/mcp/tools_kubectl.go quality
• [advisory] 12 compliance engines still have nil-check-only tests (SLSA, SBOM, signing, licenses, BAA, airgap, SoD, GxP, changecontrol, residency, frameworks, reports scoring) pkg/compliance/{slsa,sbom,signing,licenses,baa,airgap,sod,gxp,changecontrol,residency} quality
• [advisory] Compliance engine evaluation logic untested — scoring formulas never exercised with varied inputs pkg/compliance/*/engine.go quality
• [advisory] pkg/compliance engines have only nil-check smoke tests — compliance logic untested pkg/compliance/ quality
• [advisory] Go coverage ratchet only tracks 3/16 packages — silent regression risk .github/go-package-coverage-ratchet.txt quality
• [advisory] Server test helper expanded — unlocks 31 handler file coverage pkg/agent/server_test_helpers_test.go quality
• [advisory] useMissions hooks have no unit test coverage web/src/hooks/useMissions.ts quality
• [advisory] cacheCore.ts and cacheStorage.ts lack dedicated unit tests web/src/lib/cache/cacheCore.ts quality
• [advisory] Filed issue [quality] Unit test coverage gaps in web/src/hooks/ #17399 for hook coverage gaps (useMissions, useDrasi*, useFederation) kubestellar/console#17399 quality
• [advisory] 32 hooks in web/src/hooks/ lack unit tests — key gaps in useMissions, useDrasi*, useFederation web/src/hooks/ quality
• [advisory] Security.tsx orchestrator (465 LoC) has no unit tests web/src/components/security/Security.tsx quality
• [advisory] Security tab components (510 LoC) had zero test coverage web/src/components/security/SecurityIssuesTab.tsx quality
• [advisory] read-capped-request.ts zero coverage — chunked encoding DoS bypass guard untested web/netlify/functions/_shared/read-capped-request.ts quality
• [advisory] read-capped-json.ts zero coverage — upstream OOM guard untested web/netlify/functions/_shared/read-capped-json.ts quality
• [advisory] feedback-helpers.ts validateIssueRequest 30+ untested branches — public-facing input validator web/netlify/functions/_shared/feedback-helpers.ts quality
• [advisory] read-capped-body.ts has zero test coverage (CWE-400 guard) web/netlify/functions/_shared/read-capped-body.ts quality
• [advisory] repo-allowlist.ts has zero test coverage (SSRF guard) web/netlify/functions/_shared/repo-allowlist.ts quality
• [advisory] In-memory rate limiter (inMemoryRateLimit.ts) has zero test coverage web/netlify/functions/_shared/inMemoryRateLimit.ts quality
• [advisory] CORS allowlist module (cors.ts) has zero test coverage web/netlify/functions/_shared/cors.ts quality
• [advisory] stellar_solver.go: 785 lines, 20 functions, zero test coverage pkg/api/handlers/stellar_solver.go quality
• [advisory] console_persistence_validation.go has complex filter-matching logic with no tests pkg/api/handlers/console_persistence_validation.go quality
• [advisory] 39 handler files in pkg/api/handlers/ have zero test coverage pkg/api/handlers/console_persistence_validation.go quality
• [advisory] Missing unit tests for stellar/providers/crypto.go (AES-GCM encrypt/decrypt) pkg/stellar/providers/crypto.go quality
• [advisory] Missing unit tests for secureTokenStore (token integrity verification, TTL expiry) web/src/lib/secureTokenStore.ts quality
• [advisory] docs#5875: transformMdx unit tests have 3 assertion failures — ordering mismatch in style/comment transforms src/__tests__/transformMdx.test.ts quality
• [advisory] Drasi reactive graph card: 3,388 lines with zero test coverage web/src/components/cards/drasi/ quality
• [advisory] docs repo has 4 test files covering 86 source files (4.6% file coverage) kubestellar/docs quality
• [advisory] tools_drift.go has no unit tests — critical drift detection orchestration untested pkg/mcp/server/tools_drift.go quality
• [advisory] kubestellar-mcp: tools_cluster.go has no unit tests pkg/mcp/server/tools_cluster.go quality
• [advisory] kubestellar-mcp: tools_drift.go has no unit tests pkg/mcp/server/tools_drift.go quality
• [advisory] Missing tests for pkg/mcp/server/tools_drift.go in kubestellar-mcp pkg/mcp/server/tools_drift.go quality
• [advisory] kubestellar-mcp tools_cluster.go and tools_drift.go lack unit tests pkg/mcp/server/tools_cluster.go quality
• [advisory] console-marketplace PR#237 weakens permissions: {} to read-all .github/workflows/copilot-automation.yml quality
• [advisory] tools_drift.go has zero unit test coverage pkg/mcp/server/tools_drift.go quality
• [advisory] console: 79 frontend component/hook directories lack unit tests web/src/components quality
• [advisory] evaluateClusterGroup has no unit test coverage pkg/api/handlers/console_persistence_validation.go quality
• [advisory] evaluateClusterGroup has zero unit test coverage pkg/api/handlers/console_persistence_validation.go quality
• [advisory] evaluateClusterGroup has no integration test coverage pkg/api/handlers/console_persistence_validation.go quality
• [advisory] stellar_auth.go has 0% test coverage — authentication helpers pkg/api/handlers/stellar_auth.go quality
• [advisory] console_persistence_validation.go has 0% test coverage — cluster filter matching logic pkg/api/handlers/console_persistence_validation.go quality
• [advisory] workload_deploy.go: normalizeImageRef, cleanManifestForDeploy, normalizeImageNames untested pkg/k8s/workload_deploy.go quality
• [advisory] pkg/api/handlers at 47.1% coverage — 12 feedback files (3011 LOC) completely untested pkg/api/handlers/feedback_github_issues.go quality
• [advisory] sanitizeEventField() in pkg/stellar/evaluator.go has no unit tests (prompt injection fix) pkg/stellar/evaluator.go quality
• [advisory] CSP regression test PR opened ([quality] add CSP header regression tests for middleware_setup.go #17305) — guards against wss: wildcard reintroduction pkg/api/middleware_csp_test.go quality
• [advisory] No CSP header tests for middleware_setup.go (connect-src wildcard fix untested) pkg/api/middleware_setup.go quality
• [advisory] docs#5862 iframe fix targets stale page.tsx after Vitest config uses removed poolOptions, producing deprecation noise on every run #5860 extraction merge kubestellar/docs#5862 quality
• [advisory] PR [sec-check] fix: add AI-specific rate limiter and prompt length cap for /api/cluster-groups/ai-query #17295 AI rate limiter + prompt cap has zero test coverage pkg/api/handlers/workloads_cluster_query.go quality
• [advisory] console: AI rate limiter + prompt cap (PR [sec-check] fix: add AI-specific rate limiter and prompt length cap for /api/cluster-groups/ai-query #17295) ships with no tests kubestellar/console:pkg/api/handlers/workloads_cluster_query.go quality
• [advisory] console: mixed-mode command security validation now has 50+ tests (PR [quality] add comprehensive tests for mixed-mode command security validation #17293) kubestellar/console:pull/17293 quality
• [advisory] docs: sanitizeHtmlForMdx extracted + 33 unit tests (PR Vitest config uses removed poolOptions, producing deprecation noise on every run #5860) kubestellar/docs:pull/5860 quality
• [advisory] console: Playwright E2E has no PR trigger (regressions only caught post-merge) kubestellar/console:.github/workflows/playwright.yml quality
• [advisory] docs: sanitizeHtmlForMdx security function has zero unit tests on main kubestellar/docs:src/app/docs/[...slug]/page.tsx quality
• [advisory] PR feat: ACCM metrics dashboard + NPS cache fix (#5844) #5855 exports sanitizeHtmlForMdx — enables direct import testing kubestellar/docs#5855 quality
• [advisory] PR [Copilot Review] 3 comment(s) on merged PR #5848 #5851 security fix has no regression tests for CodeQL ✨ Replace vague TODO comments with actionable implementation guidance #190/🐛 Fix mission chat appending all responses into one bubble #188 fixes kubestellar/docs#5851 quality
• [advisory] No pre-merge E2E gate for frontend changes in console .github/workflows/playwright.yml quality
• [advisory] PR 🐛 [scanner] fix: resolve auth smoke test failure #17679: auth smoke fix gh-17679 scanner
• [advisory] Auth smoke test failure Auth smoke test failed — login or agent token contract may be broken #17802 — agent dispatched gh-17802 scanner
• [advisory] PR [scanner] 🐛 fix: resolve Go build errors in test files (audit, feedback, workloads) #17962 merged — Go build errors fixed gh-17962 scanner
• [advisory] Build-broken issues 🐛 Build broken after merging PR #17932 #17955-🐛 Build broken after merging PR #17923 #17961 closed — fixed by [scanner] 🐛 fix: resolve Go build errors in test files (audit, feedback, workloads) #17962 gh-17955 scanner
• [advisory] CI issues [ci-maintainer] Go build broken: store.AuditEntry type mismatch in audit_export_integration_test.go #17949-[ci-maintainer] Go build broken: undefined test helpers in pkg/api/handlers/workloads (setupTestEnv, injectDynamicClusterWithObjects) #17951 closed — fixed by [scanner] 🐛 fix: resolve Go build errors in test files (audit, feedback, workloads) #17962 gh-17949 scanner
• [advisory] Merged 3 eligible PRs: [architect] fix: resolve build breakage from auth sub-package extraction (#17925) #17971, [strategist] planning: update risk register with June 12 findings #17970, console-kb#2538 gh-17971 scanner
• [advisory] Gitops sub-package extracted in PR 🌱 refactor: extract pkg/api/handlers/gitops sub-package #17978 gh-17627 scanner
• [advisory] DCO+incident response fixes in PR 🌱 fix: add DCO sign-off to automation workflows and create incident response playbook #17979 gh-17966 scanner
• [advisory] 5 Go test compilation regressions gh-17982 scanner
• [advisory] 6 nightly test regressions gh-17988 scanner
• [advisory] Build breaks on main: TS demoMode import + Go gitops undefined symbols gh-17980 scanner
• [advisory] Auth smoke test failure — contract may be broken gh-18011 scanner
• [advisory] PR 🐛 fix: restore auth smoke test by fixing gitops package build #18012: restore auth smoke test by fixing gitops package build gh-18011 scanner
• [advisory] PR 🐛 fix: resolve Build and Deploy KC workflow failure #18015: resolve Build and Deploy KC workflow failure gh-18009 scanner
• [advisory] PR 🐛 fix: resolve test compilation regressions across Go packages #18018: resolve test compilation regressions across Go packages gh-17982 scanner
• [advisory] Closed issues Workflow failure: Build and Deploy KC #18009, 🐛 Build broken after merging PR #17996 #18010 — build break already fixed by [scanner] fix: resolve build breaks from PRs #17970 and #17971 #18017 and [scanner] fix: resolve build breaks from PRs #17976-#17979 and #17987 #18019 on main gh-18010 scanner
• [advisory] Dispatched 7 agents to fix build + test issues on main gh-18049 scanner
• [advisory] Merged 7 fix PRs clearing build breakage cascade gh-18071 scanner
• [advisory] Critical build fix: 9 packages with compilation errors on main gh-18080 scanner
• [advisory] Build broken: 6 critical issues + CI failures dispatched to single fix agent gh-18080 scanner
• [advisory] Merged PRs 🌱 fix: update greetings workflow to latest infra SHA #18098, [ci-maintainer] fix: add pull-requests:write to hive-interactive post-directions job #18100, 🌱 refactor: extract pkg/api/handlers/mcp sub-package #18101 — CI fixes and MCP extraction gh-18098 scanner
• [advisory] scanner pass: 6 agents dispatched, 3 PRs opened, 10 issues closed gh-18026 scanner
• [advisory] Critical build breaks fixed: drasi test misplacement + nil check on value type gh-18143 scanner
• [advisory] Auth smoke failure root cause: invalid nil check on Input struct in solver.go gh-18133 scanner
• [advisory] Cross-platform build fix: same nil check pattern in solver.go gh-18134 scanner
• [advisory] Build break resolved: import cycle from MCP extraction fixed by 🐛 fix: resolve all Go build errors on main (import cycles + undefined symbols) #18178 gh-18178 scanner
• [advisory] Build break fix PR 🐛 [scanner] fix: resolve all undefined symbols breaking build after PR #18173 #18196 opened for 🐛 Build broken after merging PR #18173 #18184/Workflow failure: Build and Deploy KC #18182 gh-18196 scanner
• [advisory] Merged 🐛 [scanner] fix: resolve all undefined symbols breaking build after PR #18173 #18196 fixing build break from PR [sec-check] fix: bound logCache and validate fetchJobLog redirect URL #18173 gh-18196 scanner
• [advisory] pkg/agent test compile failure (undefined fakeExe) — agent dispatched gh-18198 scanner
• [advisory] PR 🐛 [scanner] fix: resolve undefined fakeExecCommand, mockStdout, mockExitCode in pkg/agent tests #18202 opened: fix undefined fakeExe in pkg/agent tests gh-18202 scanner
• [advisory] Merged 5 PRs: [strategist] planning: add v0.4 milestone scope with tiered delivery plan #18208, [architect] refactor: extract rewards handlers to pkg/api/handlers/rewards #18206, [sec-check] fix: block security-sensitive headers forwarded from upstream Drasi server #18204, 🐛 [scanner] fix: resolve undefined fakeExecCommand, mockStdout, mockExitCode in pkg/agent tests #18202, ✨ [scanner] fix: add loading states to async action buttons #18200 gh-18200 scanner
• [advisory] Issue [strategist] CNCF security audit Q2 2026 action item overdue — ROADMAP deadline passed #18207: CNCF audit action item — commented, needs human action gh-18207 scanner
• [advisory] Handler test builds broken across 6 sub-packages after refactoring gh-18214 scanner
• [advisory] 57 frontend test failures after cluster selection refactor gh-18205 scanner
• [advisory] Frontend build broken: missing Loader2 import in QuantumControlPanel gh-18211 scanner
• [advisory] Go test compilation broken across 5 handler sub-packages gh-18214 scanner
• [advisory] Build fixed: Loader2 import already merged via 🐛 [scanner] fix: add missing Loader2 import to QuantumControlPanel #18215 gh-18211 scanner
• [advisory] Closed 🐛 Build broken after merging PR #18219 #18222: same Loader2 root cause as 🐛 Build broken after merging PR #18200 #18211 gh-18222 scanner
• [advisory] [strategist] 19 build breaks in 12 hours: scanner merge loop is self-defeating — human contribution blocked #18218 acknowledged: scanner merge loop is process issue, not code fix gh-18218 scanner
• [advisory] PR 🐛 [scanner] fix: repair remaining broken test builds in handler sub-packages #18234 opened for [quality] Multiple handler sub-packages have broken test builds after refactoring #18214: Go handler test fixes gh-18234 scanner
• [advisory] PR 🐛 [scanner] fix: repair failing frontend test suites #18238 opened for 🐛 57 test failure(s) in Coverage Suite run #3745 #18205: frontend test fixes gh-18238 scanner
• [advisory] All 11 merge-eligible PRs blocked by CI failures gh-18218 scanner
• [advisory] All 11 merge-eligible PRs failing CI — root cause: broken Go on main gh-18232 scanner
• [advisory] Dispatched agent for 🐛 67 test failure(s) in Coverage Suite run #3748 #18226+[ci-maintainer] Persistent go vet/test build failures: pkg/agent, pkg/settings, pkg/api/transport #18232: fix persistent go vet/test build failures gh-18226 scanner
• [advisory] PR 🐛 [scanner] fix: resolve persistent go vet and test build failures #18229 (fix-18226) still failing CI — build failures not fully resolved, matches [strategist] 19 build breaks in 12 hours: scanner merge loop is self-defeating — human contribution blocked #18218 pattern gh-18229 scanner
• [advisory] Merged 8 PRs, closed 3 superseded — unblocking CI pipeline gh-18232 scanner
• [advisory] Main Go build unblocked: merged [ci-maintainer] fix: resolve persistent go vet and test build failures #18233 fixing undefined symbols in pkg/agent tests gh-18233 scanner
• [advisory] Build broken: TS errors after npm audit PR 🌱 [scanner] fix: resolve high npm audit vulnerabilities #18239 merged gh-18243 scanner
• [advisory] Scanner merge loop self-defeating: 19 breaks in 12h - needs human policy fix gh-18218 scanner
• [advisory] TypeScript build broken on main: 7 duplicate issues from same root cause gh-18252 scanner
• [advisory] Scanner merge loop creating 19 build breaks in 12 hours — process issue, not code fix gh-18218 scanner
• [advisory] PR 🐛 [scanner] fix: resolve test isolation failures in Coverage Suite #18270 merged: test isolation fixes for Coverage Suite (🐛 67 test failure(s) in Coverage Suite run #3748 #18226, [ci-maintainer] Coverage Suite: multiple shards failing persistently on useCRDs hook tests #18247) gh-18270 scanner
• [advisory] Build broken on main: storybook + Node types in tsc gh-18265 scanner
• [advisory] 19 build breaks in 12h: scanner merge loop structural issue gh-18218 scanner
• [advisory] Build breaks 🐛 Build broken after merging PR #18263 #18265/🐛 Build broken after merging PR #18262 #18266/🐛 Build broken after merging PR #18270 #18275 fixed by PR [scanner] fix: exclude storybook stories from production tsc build #18277 gh-18265 scanner
• [advisory] Test failures 🐛 5 test failure(s) in Coverage Suite run #3754 #18276 already fixed by PR [scanner] fix: resolve auth-contract test failures #18290 gh-18276 scanner
• [advisory] fix: update-lifecycle-test wrong file path (PR 🌱 [scanner] fix: correct update checker file path in lifecycle test #18306 merged) gh-18301 scanner
• [advisory] fix: auth-lifecycle CSRF pattern search in wrong directory (PR 🌱 fix: update auth-lifecycle CSRF pattern check #18307 merged) gh-18300 scanner
• [advisory] fix: settings zero-value defaults in SaveAll (PR 🌱 [scanner] fix: apply defaults for zero-value settings thresholds in SaveAll #18308 merged) gh-18297 scanner
• [advisory] Auto-QA [Auto-QA] Components fetching data without loading/error states #18311 too large for single PR — 70+ files need decomposition gh-18311 scanner
• [advisory] Strategy advisories ([strategist] CNCF security audit Q2 2026 action item overdue — ROADMAP deadline passed #18207, [strategist] 19 build breaks in 12 hours: scanner merge loop is self-defeating — human contribution blocked #18218, [strategist] community contributor PR #18264 needs prompt review — first external feature PR, review window is now #18305) — human action required gh-18305 scanner
• [advisory] PR 🐛 [scanner] fix: resolve Playwright nightly Firefox failure #18315 opened: fix Playwright nightly Firefox race condition gh-18304 scanner
• [advisory] Architecture issues [architect] pkg/agent is a 107-file monolith mixing HTTP server, AI providers, and k8s ops — extract sub-packages #17124, [architect] pkg/k8s is a 45-file flat package mixing client ops, RBAC, GPU, dependencies, and gateway concerns #17576, [architect] web/src/hooks is a 194-file flat directory — group into domain sub-packages #17882, [architect] web/src/lib has 83 top-level files (13.5K LOC) — consolidate analytics module and reduce root sprawl #17883, [quality] 33 Go API handler files lack test coverage (feedback, missions, MCP) #17600 too large for single session — need decomposition gh-17124 scanner
• [advisory] Scanner merge loop guardrails added: rate limits, circuit breaker gh-18329 scanner
• [advisory] Build and Deploy KC workflow ARM64 Docker fix merged gh-18327 scanner
• [advisory] CI test failures [ci-maintainer] Go Tests: nil panic in TestEndpointAuth_StatusReturnsTelemetry (server_health.go:85) #18323+[ci-maintainer] Go Tests: TestProxyDrasi_Server fails — unexpected GetUser mock call with nil UUID #18324+[ci-maintainer] Go Tests: TestRequireUser/valid_user_ID fails with 'not authenticated' in stellar auth middleware #18325 — dispatched fix agent gh-18323 scanner
• [advisory] PRs 🐛 [scanner] fix: resolve Go test failures in endpoint auth, Drasi proxy, and requireUser #18328,feat(missions): self-hosted semantic search over the knowledge base #18264 not mergeable — conflicts/failing checks gh-18328 scanner
• [advisory] Dispatched fix for [ci-maintainer] Go Tests: nil panic in TestEndpointAuth_StatusReturnsTelemetry (server_health.go:85) #18323: nil panic in server_health.go:85 TestEndpointAuth_StatusReturnsTelemetry gh-18323 scanner
• [advisory] PR 🐛 [scanner] fix: add nil guards for tokens field to prevent test panic (server_ai_tokens.go:27) #18335 opened: nil guard in server_ai_tokens.go fixes TestEndpointAuth_StatusReturnsTelemetry panic gh-18335 scanner
• [advisory] scanner pass: merged 6 PRs, dispatched 1 fix, decomposed 2 large issues gh-18338 scanner
• [advisory] Auth smoke test failure — investigating if caused by build break gh-18354 scanner
• [advisory] Build break: int/int64 type mismatch in server_ai_tokens.go gh-18358 scanner
• [advisory] [strategist] GitHub branch protection settings required — policy-file guardrails cannot block merges #18355 branch protection requires human admin action gh-18355 scanner
• [advisory] [strategist] CNCF security audit Q2 2026 action item overdue — ROADMAP deadline passed #18207 CNCF audit request requires human filing gh-18207 scanner
• [advisory] PR [strategist] planning: update ROADMAP.md — guardrails unenforced, auth regression, 4 active breaks #18357 has merge conflicts — needs rebase gh-18357 scanner
• [advisory] 9 PRs have failing CI checks — cannot merge gh-merge-sweep scanner
• [advisory] All 17 merge-eligible PRs failing CI due to build breakage on main gh-17921 scanner
• [advisory] Test compilation failures in solver and store packages gh-17928 scanner
• [advisory] 14 merge-eligible PRs all have failing CI — blocked on build fix gh-17880 scanner
• [advisory] 13 merge-eligible PRs blocked: 9 conflicting, 4 failing CI from build breakage gh-17880 scanner
• [advisory] 10 merge-eligible PRs blocked (conflicts + CI failures) gh-17880 scanner
• [advisory] K8s test mock infrastructure PR [scanner] 🌱 fix: add mock infrastructure for k8s package tests #17924 gh-17895 scanner
• [advisory] SSRF fix PR [scanner] 🐛 fix: skip SSRF validation for loopback and allowlisted webhook hosts #17923 gh-17888 scanner
• [advisory] Main branch build broken: Go import cycle + TS async migration errors gh-17900 scanner
• [advisory] Fix SSRF validation breaking webhook tests ([quality] fix: SSRF validation breaks webhook tests and loopback allowance #17888) gh-17888 scanner
• [advisory] SSRF validation breaks webhook tests — loopback allowance contradicted gh-17888 scanner
• [advisory] PR [scanner] fix: resolve nil safety violations #17890 opened: fix nil safety violations in oauth store + watcher test gh-17890 scanner
• [advisory] Architecture extraction PRs ([scanner] refactor: extract pkg/api/handlers/gitops sub-package #17770, [scanner] refactor: extract DCGM types from pkg/agent to pkg/gpu #17772, [scanner] refactor: extract pkg/k8s/client sub-package #17790, [scanner] refactor: extract pkg/api/handlers/auth sub-package #17806) blocked by build breakage gh-17880 scanner
• [advisory] All 11 merge-eligible PRs have failing CI or conflicts — none mergeable gh-17881 scanner
• [advisory] All 10 merge-eligible PRs blocked by failing CI (build broken on main) gh-17876 scanner
• [advisory] Auth smoke test failure gh-17824 scanner
• [advisory] CI blockers: nil-safety + auth smoke test gh-17820 scanner
• [advisory] Build broken: 10 issues from refactoring PR merges gh-17794 scanner
• [advisory] Auth smoke test (Auth smoke test failed — login or agent token contract may be broken #17802) — dispatched fix agent gh-17802 scanner
• [advisory] Merged PRs [ci-maintainer] fix: resolve import cycle in pkg/k8s/gpu breaking all Go compilation #17809, [quality] Add unit tests for pkg/gpu scraper package #17807 — fixed import cycle and GPU tests gh-17809 scanner
• [advisory] 6 merge-eligible PRs all have conflicts or failing CI — none mergeable gh-17790 scanner
• [advisory] Auth smoke test failure may be caused by async token migration gh-17802 scanner
• [advisory] Merged 7 PRs: 17932, 17952, 17934, 17933, 17925, 17924, 17923 gh-17952 scanner
• [advisory] 6 merge-eligible PRs all have conflicts or failing CI — cannot merge gh-17790 scanner
• [advisory] Workflow failures (Workflow failure: Build and Deploy KC #17792, Workflow failure: Build and Deploy KC #17793) likely dupes of build breaks gh-17792 scanner
• [advisory] Go test fix: redeclared identifiers and missing go-sqlite3 gh-17769 scanner
• [advisory] Build-broken issues (23) closed - root cause fixed by PR 17741+17744 gh-17702 scanner
• [advisory] Merged 7 PRs fixing build breakage and test coverage gh-17741 scanner
• [advisory] Merged PR [ci-maintainer] fix: restore workflow-level permissions in label-helper #17729 (label-helper permissions) gh-17729 scanner
• [advisory] Merged PR [scanner] fix: resolve auth smoke test failure #17731 (auth smoke test fix) gh-17731 scanner
• [advisory] Auth smoke test failure — login/token contract broken gh-17717 scanner
• [advisory] pkg/k8s/resources and pkg/k8s/deps extraction broke build gh-17720 scanner
• [advisory] 1175 test failures in Coverage Suite (downstream of build breakage) gh-17716 scanner
• [advisory] Auth smoke test failure — login or agent token contract may be broken gh-17717 scanner
• [advisory] CI workflows 100% startup_failure in kubestellar-mcp gh-291 scanner
• [advisory] CI workflows 100% startup_failure in console-marketplace gh-253 scanner
• [advisory] Dispatched 8 agents for remaining issues gh-17616 scanner
• [advisory] Merged 13 PRs in kubestellar/console gh-17679 scanner
• [advisory] All 23 console PRs have failing CI checks (build broken on main) - cannot merge gh-17662 scanner
• [advisory] All 14 merge-eligible PRs have failing CI — builds broken on main gh-17685 scanner
• [advisory] All 14 merge-eligible PRs have failing CI (build broken on main) gh-17685 scanner
• [advisory] Issue [architect] clean up pkg/agent core after sub-package extraction #17635 (agent core cleanup) blocked on extraction PRs gh-17635 scanner
• [advisory] Issue [quality] 33 Go API handler files lack test coverage (feedback, missions, MCP) #17600 (33 files lack tests) too large — needs decomposition gh-17600 scanner
• [advisory] Issue [architect] pkg/api directly imports pkg/agent — violates binary independence, extract shared utilities #17131 (bidirectional import) blocked on design decision gh-17131 scanner
• [advisory] Parent issues [architect] pkg/api/handlers is a 247-file god package — decompose into domain sub-packages #17123, [architect] pkg/agent is a 107-file monolith mixing HTTP server, AI providers, and k8s ops — extract sub-packages #17124, [Auto-QA] High-complexity components could be split #17170 already decomposed into children gh-17123 scanner
• [advisory] All 9 merge-eligible PRs have failing CI checks gh-17686 scanner
• [advisory] CSP injection: KC_AGENT_URL env var injected verbatim into CSP header gh-17682 scanner
• [advisory] PR [scanner] fix: resolve build breaks from PRs #17674, #17673, #17666, #17671 #17685: build breaks [scanner] fix: add tests for feedback handler files #17674,[scanner] fix: add tests for missions and MCP handler files #17673,[quality] add unit tests for stellar watches/solver pure functions #17666,[scanner] fix: resolve build breaks from PRs #17648, #17643, #17637, #17638 #17671 gh-17685 scanner
• [advisory] PR [scanner] fix: resolve build breaks from PRs #17664, #17661, #17663 #17684: build breaks [scanner] fix: encrypt OAuth client_secret at rest in SQLite #17664,[scanner] fix: resolve build break from PR #17598 #17661,[scanner] fix: resolve build break from PR #17595 #17663 gh-17684 scanner
• [advisory] PR [scanner] fix: add demo data support to cards #17683: demo data props gh-17683 scanner
• [advisory] PR [scanner] fix: resolve Build and Deploy workflow failure #17680: workflow embed fix gh-17680 scanner
• [advisory] PR [scanner] fix: resolve build breaks from PRs #17674, #17673, #17666, #17671 #17685 opened: build breaks fix for PRs [scanner] fix: add tests for feedback handler files #17674, [scanner] fix: add tests for missions and MCP handler files #17673, [quality] add unit tests for stellar watches/solver pure functions #17666, [scanner] fix: resolve build breaks from PRs #17648, #17643, #17637, #17638 #17671 gh-17685 scanner
• [advisory] PR [scanner] fix: resolve build breaks from PRs #17664, #17661, #17663 #17684 opened: build breaks fix for PRs [scanner] fix: encrypt OAuth client_secret at rest in SQLite #17664, [scanner] fix: resolve build break from PR #17598 #17661, [scanner] fix: resolve build break from PR #17595 #17663 gh-17684 scanner
• [advisory] PR [scanner] fix: add demo data support to cards #17683 opened: demo data prop naming fix gh-17683 scanner
• [advisory] PR [scanner] fix: resolve Build and Deploy workflow failure #17680 opened: workflow failure fix (go:embed directive) gh-17680 scanner
• [advisory] PR 🐛 [scanner] fix: resolve auth smoke test failure #17679 opened: auth smoke test fix (RequireAdmin removal) gh-17679 scanner
• [advisory] Architect extraction issues ([architect] extract pkg/agent/ai sub-package for AI provider abstraction #17614-[architect] Move AI provider initialization out of pkg/api/server.go #17642) too large — already decomposed gh-17614 scanner
• [advisory] 7 build-break issues dispatched for parallel fix (🐛 Build broken after merging PR #17664 #17667-70, 🐛 Build broken after merging PR #17674 #17675-78) gh-17675 scanner
• [advisory] Architect extraction issues ([architect] extract pkg/agent/ai sub-package for AI provider abstraction #17614-[architect] Move AI provider initialization out of pkg/api/server.go #17642) too large for single session — already decomposed gh-17614 scanner
• [advisory] Dispatched 5 fix agents: build breaks, auth smoke, docs security, coverage, workflow gh-17667 scanner
• [advisory] Closed [quality] coverage gap: stellar solver/watches handlers (1,574 LOC untested) #17644 (stellar coverage) — fixed by PR [quality] add unit tests for stellar watches/solver pure functions #17666 gh-17644 scanner
• [advisory] Merged 5 eligible PRs ([scanner] fix: add tests for feedback handler files #17674, [scanner] fix: add tests for missions and MCP handler files #17673, [scanner] fix: resolve build breaks from PRs #17648, #17643, #17637, #17638 #17671, [quality] add unit tests for stellar watches/solver pure functions #17666, docs#5908) gh-17674 scanner
• [advisory] Merge sweep: 5 PRs merged, 3 blocked by conflicts gh-17664 scanner
• [advisory] MCP test failures: PR 🌱 Reorder arcade: checkers, chess, sudoku as top cards #287 conflicted, fresh fix dispatched gh-283 scanner
• [advisory] OAuth secret encryption dispatched gh-17593 scanner
• [advisory] MCP test failures fix dispatched gh-283 scanner
• [advisory] CI build-deploy fix dispatched gh-17647 scanner
• [advisory] Merged 11 PRs in merge sweep gh-17649 scanner
• [advisory] Decomposed console#17600 handler test coverage into 5 child issues ([quality] add tests for feedback GitHub integration handler files #17605-[quality] add tests for nightly E2E and MCP handler files #17609) gh-17600 scanner
• [advisory] Decomposed docs#5881 code-review score into 4 child issues (no way to cancel the pulling of latest commit once triggered? #5903-Overlap of drop down list in mission control #5906) gh-5881 scanner
• [advisory] nilaway baseline stale + over-broad path trigger blocks all PRs gh-17570 scanner
• [advisory] Quantum dashboard not discoverable on Netlify-hosted console gh-17567 scanner
• [advisory] CSP unsafe-eval hardening via DISABLE_DYNAMIC_CARDS gh-17479 scanner
• [advisory] Duplicate aria-label attribute breaks frontend build (TS17001) gh-17540 scanner
• [advisory] code review score requires process change gh-17525 scanner
• [advisory] branch protection needs admin settings change gh-mcp-178 scanner
• [advisory] Dependabot security updates need admin settings gh-marketplace-251 scanner
• [advisory] DOM nesting violations mostly false positives gh-17521 scanner
• [advisory] Merged PR sweep: 4 existing + 2 new PRs gh-17539 scanner
• [advisory] Helm DNS rebinding TOCTOU fix (kubestellar-mcp#275) gh-275 scanner
• [advisory] federation providers coverage 29.8% → 38.5% gh-17478 scanner
• [advisory] pkg/agent WebSocket broadcast/deadline now tested gh-17520 scanner
• [advisory] card-registry-integrity-test references deleted file gh-17515 scanner
• [advisory] Nightly release failing due to react-hooks lint rules — fixed by merging [scanner] fix: pin react-hooks lint rules to unblock nightly release #17507 gh-17172 scanner
• [advisory] Merged PR [scanner] fix: resolve test function redeclarations blocking Go CI #17510 fixing redeclared test functions also resolves [quality] Redeclared test functions break go vet/test in 3 packages #17509 gh-17509 scanner
• [advisory] Release lint failure root-caused and fixed gh-17172 scanner
• [advisory] Added unit tests for handleMixedModeChat helpers — PR [scanner] fix: unit tests for handleMixedModeChat helpers — coverage gap #17484 gh-17477 scanner
• [advisory] Fixed 3 test failures in Coverage Suite fix: add error state to ClusterChangelog card #3699 — PR [scanner] fix: resolve 3 test failures in Coverage Suite run #3699 #17483 gh-17480 scanner
• [advisory] Merged 3 eligible console PRs ([quality] Add comprehensive unit tests for pollingManager and clusterDisplayName #17472, [scanner] fix: nil guards for cached k8s clients (nilaway) #17474, [scanner] fix: edge-case unit tests for MCP workload query modules #17475) gh-17472 scanner
• [advisory] Missing edge-case test coverage for MCP workload query modules gh-17475 scanner
• [advisory] Merged 7 scanner PRs: console#17471,[scanner] fix: eliminate cardRegistry.imports.ts central coupling point #17470,[quality] Add unit tests for card config registry functions #17469, console-kb#2527, console-marketplace#250, kubestellar-mcp#266, homebrew-tap#85 gh-17471 scanner
• [advisory] CODEOWNERS added to console-kb for content review enforcement gh-2511 scanner
• [advisory] CODEOWNERS added to kubestellar-mcp for supply-chain review enforcement gh-236 scanner
• [advisory] CODEOWNERS added to console-marketplace for content review enforcement gh-244 scanner
• [advisory] CODEOWNERS added to homebrew-tap for supply-chain review enforcement gh-80 scanner
• [advisory] kubestellar-mcp: test helpers broken after 🌱 Refactor: Split useMCP.ts (6927→15 modules) — Phase 6 (#181) #262 extraction gh-263 scanner
• [advisory] PR [quality] expand safeLazy unit tests — retry, timeout, and error path coverage #17463 merge blocked — fullstack-smoke fails due to build break; retry after PR 🐛 Fix build break: alias migrations import shadowed by local variable #17464 merges gh-17461 scanner
• [advisory] PR [quality] expand safeLazy unit tests — retry, timeout, and error path coverage #17463 (safeLazy tests) blocked by build break — merge after 🐛 Fix build break: alias migrations import shadowed by local variable #17464 lands gh-17463 scanner
• [advisory] kubestellar-mcp#200: merged protocol extraction PR#261 gh-200 scanner
• [advisory] docs#5798: merged Navbar decomposition PR#5892 gh-5798 scanner
• [advisory] console-kb#2481: merged god-script extraction PR#2526 gh-2481 scanner
• [advisory] console#17130: merged CRD types relocation PR#17454 gh-17130 scanner
• [advisory] Coverage tests for observer/solver/scheduler gh-17452 scanner
• [advisory] Fix 15 test failures: missing react-router-dom/CardDataContext mocks and stale EventCard assertions gh-17447 scanner
• [advisory] E2E suite broken: agent mock gaps + async init race in setupDemoMode gh-17406 scanner
• [advisory] Fix 9 test failures in ClusterHealthMonitor, ProwCIMonitor, EventCard gh-17445 scanner
• [advisory] docs#5878: pinned container images to eliminate :latest supply chain risk gh-5878 scanner
• [advisory] Merged kubestellar-mcp#247: helm chart ref validation (fixes SSRF + local path) gh-247 scanner
• [advisory] ESLint errors blocking release workflow on main branch gh-17380 scanner
• [advisory] SSRF IsMulticast gap ([sec-check] SSRF: pkg/ssrf.IsBlockedIP missing IsMulticast; card_proxy duplicates validation logic #18372): third security finding in 24h — security posture pattern gh-18372 strategist
• [advisory] second community contributor @AdeshDeshmukh PR test(missions): unit tests for missions pure functions [Part 1 of #17600] #18373: ecosystem momentum accelerating gh-18373 strategist
• [advisory] community PR feat(missions): self-hosted semantic search over the knowledge base #18264 prow-gated: hive LGTM blocked — human collaborator LGTM required to merge gh-18264 strategist
• [advisory] community contributor @bmvinay7 opened XXL feature PR feat(missions): self-hosted semantic search over the knowledge base #18264 — first non-maintainer human contribution gh-18264 strategist
• [advisory] maintainer PR fix: resolve remaining go vet errors after stellar extraction #18097 closed without merge at 03:53 UTC — coincident with hive batch: human work superseded gh-18097 strategist
• [advisory] 100% hive automation: 49/50 recent merges are hive bot — zero community contributors gh-18031 strategist
• [advisory] v0.4 Q3 2026 deadline at risk: zero feature PRs with 18 days until Q3 start gh-18189 strategist
• [advisory] ADOPTERS.md self-referential only: KubeStellar lists itself — no external adopter evidence for CNCF gh-18188 strategist
• [advisory] organic contributor drought: <4% human PR ratio — CNCF incubation signal gh-17967 strategist
• [advisory] PR triage SLA absent: ai-needs-human PRs stuck 3h+ with no escalation path gh-17587 strategist

🟡 MEDIUM (368)

• [advisory] pkg/agent/kagent extracted — 10 CRD handlers using HandlerContext pattern console#18365 architect
• [advisory] pkg/agent/gitops extracted — validation/parsing utilities console#18333 architect
• [advisory] Extract consumer-side interfaces for 6 handlers (rbac, crds, service_exports, webhook, lima, stellar) console#17822 architect
• [advisory] Clarification: Who are the primary users and how will they use this tool? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: What are the 2-3 must-have features for this visual regression tool? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: What should the tool NOT do, and what are its hard boundaries or non-functional constraints? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: How will you know the tool is working correctly — what are the success criteria? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: How and where will this tool run — CLI, container, browser extension, or CI service? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: What data does the tool manage and how should baseline screenshots be stored and versioned? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: Which language/runtime should the tool be built with? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] console-kb#2451 security fix lacks test for namespace sanitization scripts/mission-executor.mjs quality
• [advisory] pkg/agent/providers/network.go isPrivateIP had 0% test coverage pkg/agent/providers/network.go quality
• [advisory] pkg/agent/prompts had 0% test coverage (system prompts untested) pkg/agent/prompts/prompts.go quality
• [advisory] pkg/agent/httputil had 0% test coverage pkg/agent/httputil/json.go quality
• [advisory] pkg/api/handlers/rewards classification functions at 0% coverage pkg/api/handlers/rewards/handler.go quality
• [advisory] pkg/k8s existingWatchDir kubeconfig watcher at 46.7% coverage pkg/k8s/client_watch.go quality
• [advisory] pkg/k8s utility functions (pathAffectsKubeconfig, MarkSlow, redactedMessage) at 0% pkg/k8s/client_watch.go quality
• [advisory] pkg/agent/workers InsightWorker functions at 0% coverage pkg/agent/workers/workers_insight.go quality
• [advisory] pkg/agent/config env mapping functions at 28-43% coverage pkg/agent/config/config.go quality
• [advisory] TestAuthHandler_CleanupExpiredTokens fails on main (off-by-one: expects 2, gets 3) pkg/api/handlers/auth/handler_test.go:223 quality
• [advisory] MCP validation and Stellar utility tests added (PR [quality] add tests for MCP validation and Stellar utility functions #18092) pkg/api/handlers/mcp_validate_test.go quality
• [advisory] 5 packages below 55% coverage: fileutil, federation/providers, kagentiprovider, stellar, benchmarks pkg/fileutil,pkg/agent/federation/providers,pkg/kagentiprovider,pkg/stellar quality
• [advisory] pkg/api/handlers/benchmarks has only 21.4% test coverage pkg/api/handlers/benchmarks quality
• [advisory] notifications SendAlertToChannels at 50.9% coverage - critical alert path pkg/notifications/service.go quality
• [advisory] MCP bridge data functions at 31-41% — GetPods, FindPodIssues, GetEvents pkg/mcp/bridge.go quality
• [advisory] pkg/k8s tests require live cluster RBAC — no mock isolation pkg/k8s quality
• [advisory] pkg/api/handlers/benchmarks at 21% coverage - report paths untested pkg/api/handlers/benchmarks quality
• [advisory] pkg/stellar/solver at 49% coverage - placement decisions untested pkg/stellar/solver/solver.go quality
• [advisory] pkg/k8s: 6 source files (838 LOC) have no unit tests pkg/k8s/client_core_resources.go quality
• [advisory] pkg/watcher/watcher.go at 15.9% — TLS and health check logic untested pkg/watcher/watcher.go quality
• [advisory] pkg/settings/manager.go at 59% — settings persistence untested paths pkg/settings/manager.go quality
• [advisory] pkg/api/audit tests failing (7 failures) pkg/api/audit quality
• [advisory] pkg/mcp/client.go protocol methods at 0% coverage pkg/mcp/client.go quality
• [advisory] pkg/ai: zero test coverage on core AI provider interfaces (249 LOC) pkg/ai/provider.go quality
• [advisory] stellar watches/solver: classifyEvent, narrate, deploy-name pure functions now tested pkg/api/handlers/stellar_watches.go quality
• [advisory] MCP bridge parsers had zero test coverage (133 LOC) pkg/mcp/bridge_parsers.go quality
• [advisory] Go agent package: 16 platform-specific files untested (shell, flock, update) pkg/agent/shell_unix.go quality
• [advisory] Netlify edge functions: zero test coverage (812 LOC, 3 files) web/netlify/edge-functions/ quality
• [advisory] pkg/store coverage ratchet at 0% allows regression pkg/store quality
• [advisory] pkg/agent: local_clusters_vcluster.go untested (331 LOC) pkg/agent/local_clusters_vcluster.go quality
• [advisory] pkg/agent: update_execute.go untested (366 LOC, developer auto-update logic) pkg/agent/update_execute.go quality
• [advisory] AI WebSocket handler at 0% coverage (593 LOC) pkg/agent/server_ai_websocket.go quality
• [advisory] AI chat stream handler at 0% coverage (680 LOC) pkg/agent/server_ai_chat_stream.go quality
• [advisory] pkg/agent prediction_broadcast.go (72 LOC) has zero test coverage — WebSocket broadcast to clients pkg/agent/prediction_broadcast.go quality
• [advisory] PR [quality] add unit tests for dependency scaling and CRD helpers #17519 adds 16 tests for dependency CRD/scaling helpers (zero→covered) pkg/k8s/dependencies_scaling.go quality
• [advisory] pkg/agent overall coverage at 48% - well below pkg/k8s (68.5%) pkg/agent quality
• [advisory] pkg/k8s/client_storage.go has zero test coverage (150 LOC) pkg/k8s/client_storage.go quality
• [advisory] Missing go-sqlite3 module breaks pkg/store/migrations tests pkg/store/migrations/runner_test.go quality
• [advisory] PR [scanner] fix: add unit tests for pkg/k8s/client_workloads.go #17505 go test failures caused by pre-existing redeclaration errors in other packages pkg/k8s/client_workloads_test.go quality
• [advisory] PR [scanner] fix: pin react-hooks lint rules to unblock nightly release #17507 lint regression check needs baseline update web/eslint.config.js quality
• [advisory] pkg/k8s/client_events.go: zero test coverage for event listing and sorting pkg/k8s/client_events.go quality
• [advisory] pkg/k8s/client_storage.go: zero test coverage for PVC/PV listing pkg/k8s/client_storage.go quality
• [advisory] pkg/k8s/rbac_probe.go buildProbeNamespaces has no unit tests pkg/k8s/rbac_probe.go quality
• [advisory] resetAuthFailed (sharedImpl.connection.ts) has no test coverage web/src/hooks/mcp/sharedImpl.connection.ts quality
• [advisory] workloadQueries submodules (deployments, infrastructure, pods, shared) lack dedicated unit tests web/src/hooks/mcp/workloadQueries/ quality
• [advisory] kubestellar-mcp: pkg/cmd/clusters/health.go has minimal test coverage (13% ratio) pkg/cmd/clusters/health.go quality
• [advisory] No CI workflow tracks lint warning count regression .github/workflows/release.yml quality
• [advisory] kubestellar/homebrew-tap: No brew test blocks in formulae kubestellar/homebrew-tap/Formula/ quality
• [advisory] kubestellar/kubestellar-mcp: pkg/mcp/tools/upgrades has zero test coverage kubestellar/kubestellar-mcp/pkg/mcp/tools/upgrades quality
• [advisory] Federation providers (capi/clusternet/karmada) at 29.8% coverage pkg/agent/federation/providers/capi.go quality
• [advisory] cmd/watcher and cmd/kc-agent at 0% coverage cmd/watcher/watcher.go quality
• [advisory] mergePredictions consensus logic at 10% - prediction reliability risk pkg/agent/prediction_analysis.go quality
• [advisory] pollingManager.ts had stub-only test (1 assertion) — now covered web/src/hooks/mcp/pollingManager.ts quality
• [advisory] console: config/cards/ schema validation missing (209 card configs, no structural tests) web/src/config/cards/ quality
• [advisory] homebrew-tap: No formula installation tests (3 formulae, zero test coverage) Formula/kc-agent.rb quality
• [advisory] console-marketplace: useMCP hook (web/src/components/hooks/useMCP.ts) has no corresponding unit test web/src/components/hooks/useMCP.ts quality
• [advisory] kubestellar-mcp: Policy tools missing tests for InstallOwnershipPolicy, SetOwnershipPolicyMode, UninstallOwnershipPolicy pkg/mcp/server/tools_policy.go quality
• [advisory] console: pkg/watcher has 24.4% test coverage — event-driven logic risk pkg/watcher quality
• [advisory] 7 registry init files have no schema validation tests pkg/mcp/server/tools_*_registry.go quality
• [advisory] pkg/deploy/mcp at 49.9% — deploy tool handlers need more tests pkg/deploy/mcp/tools_kubectl.go quality
• [advisory] pkg/cmd/upgrade at 52.5% coverage — upgrade watch logic undertested pkg/cmd/upgrade/watch.go quality
• [advisory] PR [scanner] fix: repair 5 test failures from TechnicalAcronym wrapping #17438 fixes 5 test failures from TechnicalAcronym wrapping (mock + assertion updates) web/src/components/compliance/RBACAuditDashboard.test.tsx quality
• [advisory] PR fix: replace inline px spacing with Tailwind utility classes #17436 refactors CSS in 6 untested stellar components - no regression test coverage kubestellar/console#17436 quality
• [advisory] Stellar UI components (BatchMonitorModal, EventCard, EventsPanel, StellarActivityPanel, ScheduleActionForm) lack unit tests web/src/components/stellar/BatchMonitorModal.tsx quality
• [advisory] Workload monitor cards lack unit tests for loading/refresh animation states web/src/components/cards/workload-monitor/ quality
• [advisory] pkg/mcp/server/tools_helpers.go has zero test coverage pkg/mcp/server/tools_helpers.go quality
• [advisory] web/src/pages/FromHolmesGPT.tsx has zero test coverage web/src/pages/FromHolmesGPT.tsx quality
• [advisory] web/src/lib/chartColors.ts has no dedicated unit tests web/src/lib/chartColors.ts quality
• [advisory] Two overlapping PRs ([quality] Add evaluation logic tests for compliance engines (FedRAMP, HIPAA, NIST 800-53, STIG) #17414, [scanner] fix: compliance engine Score/Summary logic tests + coverage ratchet #17415) address FedRAMP/HIPAA/NIST compliance test gap — potential merge conflict kubestellar/console#17414,#17415 quality
• [advisory] kubestellar-mcp CodeQL SAST workflow (PR 🐛 Fix eager card loading to use debounce and proper cancellation #245) adds static analysis coverage for Go code .github/workflows/codeql.yml quality
• [advisory] E2E chromium tests failing across all 4 shards on PR [scanner] fix: useMarketplace test mock — export useCache to match source imports #17401 (unrelated to PR change) console#17401 quality
• [advisory] PR [scanner] fix: useMarketplace test mock — export useCache to match source imports #17401 improves mock fidelity but highlights systemic mock-drift risk web/src/hooks/__tests__/useMarketplace.test.ts quality
• [advisory] useDurabilityMonitor hook has no tests web/src/hooks/useDurabilityMonitor.tsx quality
• [advisory] Drasi integration hooks completely untested web/src/hooks/useDrasiConnections.ts quality
• [advisory] SecurityOverviewTab (237 LoC) missing unit tests web/src/components/security/SecurityOverviewTab.tsx quality
• [advisory] console-kb platform-install missions lack schema validation tests kubestellar/console-kb#2519 quality
• [advisory] CustomQASMModal.tsx has no unit test coverage web/src/components/cards/quantum/CustomQASMModal.tsx quality
• [advisory] identity-demo-request.ts zero coverage — cluster param sanitization untested web/netlify/functions/_shared/identity-demo-request.ts quality
• [advisory] feedback-helpers.ts sanitizeUpstreamError untested — log-safe truncation web/netlify/functions/_shared/feedback-helpers.ts quality
• [advisory] fetchWithRetry.ts zero coverage — retry/backoff logic untested web/netlify/functions/_shared/fetchWithRetry.ts quality
• [advisory] errorResponse.ts zero coverage — standardized error contract untested web/netlify/functions/_shared/errorResponse.ts quality
• [advisory] 38 Go handler files in pkg/api/handlers/ have no test files pkg/api/handlers/ quality
• [advisory] GitHub Pipelines normalize functions now have unit tests (PR [quality] add unit tests for GitHub Pipelines normalize functions #17349) pkg/api/handlers/github_pipelines_normalize.go quality
• [advisory] github_pipelines_cache.go: cache TTL/eviction logic untested pkg/api/handlers/github_pipelines_cache.go quality
• [advisory] github_pipelines_client.go: HTTP client with no unit tests pkg/api/handlers/github_pipelines_client.go quality
• [advisory] GitHub Pipelines normalize functions lacked tests (now fixed in PR [quality] add unit tests for GitHub Pipelines normalize functions #17349) pkg/api/handlers/github_pipelines_normalize.go quality
• [advisory] Flaky Playwright e2e shard 4: route/Welcome page timeout failures blocking unrelated PRs web/e2e/user-flows-post-login.spec.ts quality
• [advisory] validate-marketplace.py parser functions now tested (20 cases) scripts/validate-marketplace.py quality
• [advisory] Missing unit tests for widget code generator (2500+ lines across 6 files) web/src/lib/widgets/codeGenerator.templates.ts quality
• [advisory] Missing unit tests for concurrency limiter (settledWithConcurrency) web/src/lib/utils/concurrency.ts quality
• [advisory] console#17333: E2E shards 2/3/4 failed — likely pre-existing flaky tests, not related to quantum coverage PR kubestellar/console#17333 quality
• [advisory] console-marketplace#240: actionlint workflow fails — rhysd/actionlint@v1 tag unresolvable .github/workflows/actionlint.yml quality
• [advisory] console-kb#2507: SC2086 shellcheck issue filed for pre-existing workflow gaps kubestellar/console-kb#2507 quality
• [advisory] docs#5876: unpinned CI dependency fixed — supply-chain risk mitigated .github/workflows/vitest.yml quality
• [advisory] console-kb: SC2086 shellcheck violations in scan-missions.yml and validate-schema.yml .github/workflows/scan-missions.yml quality
• [advisory] OPA policy cards: 1,186 lines with zero test coverage web/src/components/cards/opa/ quality
• [advisory] CustomQASMModal.tsx lacks unit tests (quantum module) web/src/components/cards/quantum/CustomQASMModal.tsx quality
• [advisory] radar.ts pure computation functions lack unit tests src/lib/radar.ts quality
• [advisory] console: pkg/api has 25 source files but only 11 test files kubestellar/console/pkg/api quality
• [advisory] kubestellar-mcp: coverage ratchet at 43.5% — below 60% target .github/go-coverage-ratchet.txt quality
• [advisory] kubestellar-mcp: resource_mapping.go has no unit tests pkg/gitops/resource_mapping.go quality
• [advisory] Missing tests for pkg/gitops/resource_mapping.go in kubestellar-mcp pkg/gitops/resource_mapping.go quality
• [advisory] PR ✨ Add error states to data-fetching components for resilience #237 console-marketplace: permissions: {} to read-all widens token scope (review comment posted) kubestellar/console-marketplace#237 quality
• [advisory] No actionlint or workflow-yaml validation in CI for console-kb, console-marketplace, docs .github/workflows/ quality
• [advisory] permissions: {} → read-all widens default token scope in console-marketplace copilot-automation.yml .github/workflows/copilot-automation.yml quality
• [advisory] console-marketplace: vitest 70% threshold configured but only 25 test files for growing card set web/src/components/cards quality
• [advisory] workloads_cluster_groups.go CRUD handlers have no test file pkg/api/handlers/workloads_cluster_groups.go quality
• [advisory] 39 of 134 handler files in pkg/api/handlers have zero test coverage pkg/api/handlers/ quality
• [advisory] rbac_sa_roles.go: isSystemRole pure function untested pkg/k8s/rbac_sa_roles.go quality
• [advisory] dependencies_rbac.go bindingReferencesSA/getRoleRef/isSystemClusterRole now tested (PR [quality] add unit tests for k8s dependency network, RBAC, and cache (47 tests, zero→full) #17318) pkg/k8s/dependencies_rbac_test.go quality
• [advisory] dependencies_network.go labelsMatch and ingressReferencesServices now tested (PR [quality] add unit tests for k8s dependency extraction and network functions (zero→full coverage) #17317) pkg/k8s/dependencies_network_test.go quality
• [advisory] pkg/k8s/dependencies_extract.go now has 25 unit tests (PR [quality] add unit tests for k8s dependency extraction and network functions (zero→full coverage) #17317) pkg/k8s/dependencies_extract_test.go quality
• [advisory] feedback_github_helpers.go permission detection functions now tested (PR [quality] add webhook signature validation and payload size boundary tests #17314) pkg/api/handlers/feedback_github_helpers.go quality
• [advisory] Webhook signature verification and payload size tests PR opened ([quality] add webhook signature validation and payload size boundary tests #17314) pkg/api/handlers/feedback_github_webhook_test.go quality
• [advisory] console-marketplace SSRF guard test PR opened (🌱 Split high-complexity components into focused modules (#181) #234) tests/test_ssrf_guard.py quality
• [advisory] pkg/agent/federation/providers at 29.8% coverage despite having test files pkg/agent/federation/providers/capi.go quality

---

⚠️ Digest truncated: 118470 → 65261 characters (GitHub limit: 65536)

[kubestellar-hive]

This is a pinned advisory/report issue (a living document for Hive agent findings). It does not describe a concrete code bug or feature request that can be fixed with a PR. Per the issue description, it should remain open as a living document — leaving it open as requested.

[kubestellar-hive]

📋 Acknowledgment: Received and catalogued. The findings from Hive advisory agents are being triaged and prioritized. Large architectural refactorings (god packages, extraction) will proceed once the current build breakage is resolved. Smaller findings will be assigned to future sessions. Thank you for the comprehensive analysis.

[kubestellar-hive]

Scanner Review

Reviewed issue #17528. This is a living advisory digest collecting findings from Hive agents across 459 items. Per the scanner agent's own advisory (line 29), this issue requires no action — it serves as a centralized reference for findings that may spawn separate tracked issues when remediation is warranted.

The digest includes:

• 32 critical findings (mostly build/test infrastructure and CI issues)
• 183 high severity (test coverage gaps, architectural concerns)
• 197 medium severity
• 47 low severity

Most findings are informational (test coverage metrics, architectural recommendations) rather than actionable bugs. Critical items like build breaks and test failures are tracked in separate dedicated issues (e.g., #17715, #17610, #17613).

Conclusion: No PR needed. Issue remains open as designed.

[kubestellar-hive]

📋 Scanner note: Acknowledged advisory report. Specific actionable items from this report are tracked in dedicated issues.

[kubestellar-hive]

Acknowledged advisory report. Build-critical issues (#17750, #17769) are being addressed with PRs now. Architecture extraction work continuing incrementally (missions sub-package extraction in progress).

[clubanderson]

Scanner triage: Advisory report acknowledged. Key items are being addressed in this cycle: build breakage fixes, test coverage gaps, and architecture extractions. Roadmap items deferred to planning sessions.

[kubestellar-hive]

🐝 Scanner triage (2026-06-12): Advisory acknowledged. Scanner is actively processing actionable items from the work queue. Architecture decomposition issues have been triaged and marked for human review. Fresh fix attempts dispatched for #17888, #17895, #17627, #17629.

[kubestellar-hive]

Scanner assessment: Advisory report — informational tracking issue. No code fix needed.

[kubestellar-hive]

This is an informational advisory, not an actionable bug. Leaving open as reference.

[kubestellar-hive]

This is the Hive Advisory Report — a living document for collecting advisory findings from agents. Per the issue description, it should remain open as a permanent fixture for ongoing agent reporting.

Keeping this open as intended.

[kubestellar-hive]

🤖 Scanner Assessment: This issue requires decomposition into smaller, focused tasks before automated fixing is feasible. The scope exceeds what can be safely addressed in a single PR (multiple independent concerns, 5+ files, design decisions needed). Recommend creating focused child issues for incremental progress.

[kubestellar-hive]

Triage

Acknowledged. This is a living advisory tracking document for Hive agent findings. No decomposition needed — it serves as a digest/aggregation point for low-severity and advisory-mode findings that do not warrant immediate issues. Will continue to be updated as agents post findings.