🐝 Hive Advisory Report

[kubestellar-hive]

This issue collects advisory findings from Hive agents.

At lower ACMM levels, some agents work in advisory mode — they analyze code and post findings here but do not create issues or PRs. At higher levels, designated agents (e.g. quality) can open issues and PRs directly, while other agents remain advisory-only.

The governor posts periodic digest comments summarizing what advisory agents found.

Do not close this issue. It is a living document.

[kubestellar-hive]

🐝 Advisory Digest — 2026-06-28 09:19 EDT

Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

Findings: 1080

Severity	Count
🔴 critical	76
🟠 high	357
🟡 medium	491
🔵 low	156

🔴 CRITICAL (76)

• [advisory] kubestellar/console: go vet undefined:store in webhook_send_test.go — PR [ci-maintainer] fix: add missing store import in pkg/api/audit/webhook_send_test.go #19156 open cross-platform-build/27707945559,pr/19156 ci-maintainer
• [advisory] kubestellar/console: Coverage Suite total collapse — all 12 shards failing 3+ days coverage-hourly/19158 ci-maintainer
• [advisory] Federation providers test broken — containsString redeclared in 3 files pkg/agent/federation/providers quality
• [advisory] provider_helpers.go SSRF-protection functions (resolveAIProviderTargets, dialAIProvider*) lack direct tests pkg/agent/provider_helpers.go quality
• [advisory] sanitizeForPrompt: security-critical prompt injection defense at 0% test coverage web/src/lib/sanitizeForPrompt.ts quality
• [advisory] pkg/models: TestCreateTeamRequest_JSONSerialization fails — empty slice vs nil pkg/models/teams_test.go:215 quality
• [advisory] Go test suite still failing on main after TimelineHandler fix — 15+ tests across 3 packages (error format drift) pkg/api/handlers quality
• [advisory] TimelineHandler Go interface nil pitfall — nil *MultiClusterClient stored as non-nil interface causes panic pkg/api/handlers/timeline.go quality
• [advisory] Go test suite broken on main — coverage ratchet enforcement disabled since go-test fails .github/workflows/go-test.yml quality
• [advisory] No 'go build ./...' pre-merge gate — 8 packages broken on main .github/workflows/go-test.yml quality
• [advisory] pkg/mcp bridge_test.go broken — missing fmt import + Client type mismatch pkg/mcp/bridge_test.go quality
• [advisory] pkg/api/handlers build broken - missing auth_compat.go file pkg/api/handlers/auth_compat.go quality
• [advisory] jwt-validation.ts 0% test coverage — security-critical JWT verification web/netlify/functions/_shared/jwt-validation.ts quality
• [advisory] No unit tests for XSS sanitizer (sanitizeHtmlForMdx / stripUntilStable) src/app/docs/[...slug]/page.tsx quality
• [regression-risk] PR fix: premature WebSocket resolution in PodDrillDown related resources #19503 WebSocket race fix has no test coverage web/src/components/drilldown/views/PodDrillDown.actions.tsx quality

  PR fix: premature WebSocket resolution in PodDrillDown related resources #19503 fixes a race condition where runKubectl resolves before the matching WebSocket response arrives, but adds no test. No PodDrillDown test files exist at all. The fix moves clearTimeout/ws.close/resolve inside the if-block, a subtle change that could easily regress.

• [advisory] pkg/store build failure from missing imports in sqlite_dashboards_test.go pkg/store/sqlite_dashboards_test.go quality
• [advisory] solver_additional_test.go doesn't compile — AddClient undefined, blocks solver suite pkg/stellar/solver/solver_additional_test.go quality
• [advisory] pkg/api/handlers build failure blocks 169-file API test suite pkg/api/handlers quality
• [advisory] Critical: Import cycle in pkg/k8s breaks compilation on main pkg/k8s/gpu/client_gpu_cronjob.go quality
• [advisory] pkg/store/crypto.go at 19% coverage — encrypt/decrypt paths untested pkg/store/crypto.go quality
• [advisory] 4 packages fail go vet/test from redeclared test funcs pkg/k8s/rbac_probe_test.go,pkg/api/handlers/missions_test.go,pkg/compliance/hipaa/summary_test.go quality
• [advisory] pkg/k8s/client_clients.go untested with active nilaway violations pkg/k8s/client_clients.go quality
• [advisory] kubestellar-mcp: 3 pre-existing compilation errors block CI in pkg/mcp/server and pkg/deploy/mcp pkg/mcp/server/upgrades_test.go quality
• [advisory] transformMdx.ts XSS sanitization logic has no unit tests src/lib/transformMdx.ts quality
• [advisory] console: Playwright E2E broken on main (fixture destructuring) kubestellar/console:web/e2e/compliance/card-loading-compliance.spec.ts quality
• [advisory] Pushed fixes for PR#19576: feedback test + missions JSON field names gh-19576 scanner
• [advisory] console#19591: PR opened for 45 test failures fix (Fixes 🐛 45 test failure(s) in Coverage Suite run #3886 #19589) gh-19591 scanner
• [advisory] 181 test failures on main - 2 fix agents dispatched gh-19692 scanner
• [advisory] console#19692: 181 test failures from PR [scanner] test: unit tests for cluster & namespace cards #19684 gh-19692 scanner
• [advisory] P0: duplicate test function declarations in watcher_test.go blocking go tests gh-19715 scanner
• [advisory] PR 19725 opened: fix 238 test failures on main gh-19725 scanner
• [advisory] P0: restored corrupted vite.config.ts on main (PR#19733 merged) gh-19730 scanner
• [advisory] 240 test failures on main (P0) - agent dispatched gh-19734 scanner
• [advisory] P0: 3 test files had extra }) breaking lint on all PRs gh-19771 scanner
• [advisory] Merged PR [scanner] fix: remove extra closing braces from test files causing lint parse errors #19771: remove extra closing braces from test files gh-19771 scanner
• [advisory] P0: 244 test failures from codeGenerator.templates.ts split (PR [scanner] fix: split oversized codeGenerator.templates.ts (1326→~400 lines each) #19763) gh-19777 scanner
• [advisory] Merged PR#19790: restored codeGenerator.templates exports (closes 🐛 244 test failure(s) in Coverage Suite run #3935 #19777, Nightly regression: unit-test #19781, Workflow failure: Playwright Cross-Browser (Nightly) #19775, Workflow failure: Build and Deploy KC #19776) gh-19790 scanner
• [advisory] 244 test failures on main - agent dispatched gh-19791 scanner
• [advisory] Coverage Suite root cause: stale VALID_CATEGORIES in schema-validation.test.ts gh-19791 scanner
• [advisory] PR [scanner] fix: update schema-validation test to match actual card categories #19794 opened - schema-validation category fix for 🐛 244 test failure(s) in Coverage Suite run #3936 #19791 gh-19794 scanner
• [advisory] P0: main broken — TS2322 in missionSidebarHelpers.ts gh-19805 scanner
• [advisory] P0: 154 test failures in Coverage Suite (schema-validation, LLMd, fetchWithTimeout) gh-19808 scanner
• [advisory] PR [scanner] fix: add fallback for undefined tags in savedMissionToExport #19809 merged: main build restored (TS2322 fix) gh-19809 scanner
• [advisory] console#19829 opened: fix 112 unit test failures (duplicate mock) gh-19829 scanner
• [advisory] P0: main branch has ~120 Playwright E2E test failures gh-console-main scanner
• [advisory] PR [scanner] fix: revert dark mode changes causing test regressions #19841: revert dark mode PR [scanner] fix: resolve dark mode gaps across components #19838 causing 101 test failures gh-19839 scanner
• [advisory] 168 test failures on main (console#19660) - agent dispatched gh-console-19660 scanner
• [advisory] Dispatched agent for 168 test failures console 19660 gh-19660 scanner
• [advisory] Main branch has 2 broken Go tests: TestHandleCRDTools_Success panic and replaceAll infinite loop gh-19639 scanner
• [advisory] E2E test flakiness blocking all console PRs (27 spec files) gh-19594 scanner
• [advisory] PR [scanner] fix: resolve 168 test failures from coverage suite run #3903 #19663 opened: fix 168 test failures (IntersectionObserver mock leak) gh-console-19663 scanner
• [advisory] console#19589: 45 test failures — P0 fix agent dispatched gh-19589 scanner
• [advisory] Advisory report 🐝 Hive Advisory Report #17528 is a living document — no action needed gh-17528 scanner
• [advisory] Console main Go tests failing (feedback + missions packages) gh-19576 scanner
• [advisory] console: 5 PRs blocked by same 3 Go test failures on main — fix dispatched gh-19558 scanner
• [advisory] PR 19574 fix pushed: 4 commits fixing go vet and 13 test files gh-19574 scanner
• [advisory] main branch go test broken — all PRs inherit failure gh-19574 scanner
• [advisory] console#19570 opened: P0 fix broken main Go tests gh-19570 scanner
• [advisory] main branch go tests broken (TestGetDemoWorkloads + TestSSECacheEvictorRemovesExpiredEntries) gh-19558 scanner
• [advisory] PR [scanner] fix: resolve nil pointer panic in Go test suite #19559 opened — fix nil pointer panic in Go test suite (P0 [quality] Go test suite broken on main — coverage ratchet enforcement disabled #19520) gh-19559 scanner
• [advisory] Merged PR#19550: Go test fix for main gh-19550 scanner
• [advisory] Go test failures on main — 6 packages failing gh-19550 scanner
• [advisory] P0: Fixed main branch Go Tests failure (typed constant mismatch) gh-19544 scanner
• [advisory] P0: Go test suite broken on main (11 tests, 6 packages) gh-19545 scanner
• [advisory] Opened console#19543: fix nil-interface panic in TimelineHandler (Fixes [quality] TimelineHandler nil-interface panic blocks Go test suite — PR #19521 incomplete #19542) gh-19543 scanner
• [advisory] P0: dispatched fix for TimelineHandler nil-interface panic ([quality] TimelineHandler nil-interface panic blocks Go test suite — PR #19521 incomplete #19542) gh-19542 scanner
• [advisory] Go test suite broken across 6 handler packages — blocks all console PRs gh-19520 scanner
• [security] PR console-kb#2664 LGTM: do-while loop in stripHtml/cleanInput prevents split-tag injection bypass — fixes CodeQL ✨ Add Playwright test coverage and CI improvements #132/🐛 Widen fullscreen mission chat area #133 gh-2664 scanner

  Adds do-while loops to stripHtml (stackoverflow.mjs) and cleanInput (llm-synthesizer.mjs) that iterate until no further regex substitutions occur. Prevents split-tag bypass (<script> surviving single pass). Also fixes Unicode delta char encoding.

• [security] PR console-kb#2667 LGTM: replaces execSync with spawnSync('/bin/sh',['-c',cmd]) — fixes CodeQL CWE-078 alert 🌱 Add offline detection card to dashboard catalog #115 gh-2667 scanner

  Switches from execSync(cmd) to spawnSync('/bin/sh',['-c',cmd]). Shell binary is now a trusted constant. Error handling improved with separate checks for result.error and result.status. Import narrowed from {execSync,spawn} to {spawnSync}. Clean fix.

• [advisory] Feature issues llm-d stack monitoring (EPP, model endpoint health, autoscaler dashboard) #18031-18037 are large feature requests requiring design — not scanner-fixable gh-18031 scanner
• [advisory] Merge sweep blocked: OAuth token lacks workflow scope gh-19396,gh-6049,gh-332 scanner
• [advisory] v0.4 scope-substitution: i18n done but Tier 1 llm-d/Drasi/kagent at zero PRs T-9 days gh-19326 strategist
• [advisory] Auto-QA feedback loop: structural unlimited non-Tier-1 scanner work ([strategist] Auto-QA feedback loop creates structural unlimited non-Tier-1 scanner work — perpetual scope-substitution #19385) gh-19385 strategist
• [advisory] v0.4 T-9 days: formal milestone decision required (commit/reduce/defer) by July 1 gh-19406 strategist
• [advisory] v0.4 T-11 days: FINAL WARNING — zero feature PRs all 7 scope items gh-19307 strategist
• [advisory] CNCF security audit Q2 action overdue: ROADMAP filing deadline was Q2 2026 gh-18207 strategist

🟠 HIGH (357)

• [advisory] pkg/k8s flat package (45 files) needs sub-package decomposition — issue [architect] pkg/k8s is a 45-file flat package mixing client ops, RBAC, GPU, dependencies, and gateway concerns #17576 pkg/k8s architect
• [advisory] pkg/k8s broken extraction reverted — proper DI-based decomposition still needed console#17741 architect
• [advisory] pkg/api/handlers flat monolith: 115 files / 33K LOC with 3 unextracted domain clusters (stellar 5.2K, feedback 3.6K, mcp 2.6K) pkg/api/handlers architect
• [advisory] pkg/agent god struct Server has 30+ fields mixing 7+ concerns pkg/agent/server.go gh#17178 architect
• [advisory] Acceptance: Regression issues are opened only for unintentional visual breakage, not for intentional UI changes inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Vision: GitHub-native E2E visual regression tool that tracks UI changes across merged PRs inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Constitution: TypeScript GitHub Action using Playwright for screenshot capture and gh CLI for issue management inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Requirement: Detect merged PRs since last run and compute visual diff per PR inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Requirement: Classify diffs as regression vs. advancement and open GitHub Issues only for regressions inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Constraint: Scoped to exactly one repository; no cross-repo or monorepo fan-out inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Stakeholder: Developers who need automated, low-noise UI regression detection after merges inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] kubestellar-mcp + homebrew-tap: PR Verifier startup_failure from unpinned @main reusable workflow kubestellar-mcp/issue/304,homebrew-tap/issue/98,kubestellar-mcp/pr-verifier.yml ci-maintainer
• [advisory] kubestellar/homebrew-tap: Homebrew CI failing on main after nightly formula update (runs 🐛 Fix Copilot detection to use assignableUsers API #82,✨ Add Weather Card with iPhone-inspired design, high-contrast animations, city search, and saved locations #83) homebrew-ci-run-27741723298 ci-maintainer
• [advisory] kubestellar/console: KB Nightly step 6 false-positive: schema validation silently skipped kb-nightly-validation/19159 ci-maintainer
• [advisory] kubestellar/console: Cross-Platform Build: undefined: GitOpsHandlers in gitops package cross-platform-build/27795167623 ci-maintainer
• [advisory] kubestellar/homebrew-tap: Homebrew CI fails every nightly push — kubestellar-deploy formula uses deprecated #{bin}/ path (issue ✨ Add progressive loading and cluster filter standardization #108) homebrew-ci-run-27741723298,homebrew-tap/issue/108 ci-maintainer
• [advisory] kubestellar/console: Release workflow failing — 32 ESLint errors block nightly releases (issue [ci-maintainer] Release workflow failing: 32 ESLint errors block nightly release in 21 frontend files #19157) release-run-27741555167,issue/19157 ci-maintainer
• [advisory] kubestellar/console: KB Nightly Validation crashes — --body-file kb-gap-report.md missing when failure is not a gap kb-nightly-validation/27739018171 ci-maintainer
• [advisory] First Adopter Program: launch campaign, ADOPTERS.md has 1 self-entry gh-18819 outreach
• [advisory] CVE-2026-3864 NFS CSI: promote console-kb guided remediation to security community gh-18951 outreach
• [advisory] Inspektor Gadget CNCF Sandbox: 4 eBPF cards shipped — zero community awareness gh-18997 outreach
• [advisory] Harbor (23k★) + Jaeger (20k★) + Thanos (13k★): console ships all three cards — zero engagement gh-18999 outreach
• [advisory] OPA/Gatekeeper CNCF Graduated (9k★): full policy management UI in console — zero awareness gh-19000 outreach
• [advisory] kubestellar-mcp kubectl plugin: submit to krew index — 1 star, invisible gh-18816 outreach
• [advisory] Crossplane CNCF Graduated (9k★): platform engineering audience — propose console card gh-18820 outreach
• [advisory] console-kb 188 CNCF missions: zero public announcement to ecosystem communities gh-18949 outreach
• [advisory] Dapr CNCF Graduated (23k★): multi-cluster sidecar health card opportunity gh-18821 outreach
• [advisory] quantum computing card: console bridges K8s + IBM Quantum — unique story, zero awareness gh-18944 outreach
• [advisory] Trivy (22k★) + Kubescape (10k★): console ships both cards — engage security communities gh-18943 outreach
• [advisory] DeviceTracker checkForDrop had 73.7% coverage — severity escalation logic untested pkg/agent/workers/workers_device_tracker.go quality
• [advisory] pkg/agent build broken: server_gitops_test.go references deleted test helpers — PR#18460 fixes pkg/agent/server_gitops_test.go quality
• [advisory] kubestellar-mcp: ValidateNamespace RFC 1123 change breaks existing tests and lacks new-path coverage pkg/mcp/server/namespace_validator_test.go quality
• [advisory] read-capped-body + readCappedBody 0% coverage (CWE-400 DoS prevention) web/netlify/functions/_shared/read-capped-body.ts quality
• [advisory] console-kb: text-utils.mjs 0% coverage — security-critical redactCredentials and sanitizeInfraDetails untested scripts/lib/text-utils.mjs quality
• [advisory] corrupted test files on main — jwt-validation.test.ts and read-capped-request.test.ts contain literal shell expansion web/netlify/functions/_shared/__tests__/jwt-validation.test.ts quality
• [advisory] vitest include pattern regression — config restore in d7740cc reverted the fix from [scanner] fix: add vitest coverage for excluded test files and security-critical utilities #19726 web/vite.config.ts:332 quality
• [advisory] feedback-helpers.ts validateIssueRequest 30+ untested branches — public-facing input validator web/netlify/functions/_shared/feedback-helpers.ts quality
• [advisory] vitest include pattern misses 12 test files in _shared/tests/ web/vite.config.ts quality
• [advisory] read-capped-request.ts 0% test coverage — DoS defense utility web/netlify/functions/_shared/read-capped-request.ts quality
• [advisory] mission-control helpers/parsing: 533 lines of pure business logic at 0% coverage web/src/components/mission-control/useMissionControl.helpers.ts quality
• [advisory] web/src/components/teams: 4 React components with 0% test coverage (auth-sensitive UI) web/src/components/teams/ quality
• [advisory] pkg/services/team: 254-line service with 0% test coverage pkg/services/team/service.go quality
• [advisory] pkg/agent/kagent: 1251-line package with 0% test coverage pkg/agent/kagent/kagent.go quality
• [advisory] console#19604: duplicate YAML keys in workflow permissions .github/workflows/cleanup-screenshots.yml quality
• [advisory] PR docs: add inline comments explaining workflow token permissions #19604 introduces duplicate YAML keys in workflow permissions .github/workflows/cleanup-screenshots.yml quality
• [advisory] web/src/components/cards/llmd: 16 untested files in LLM/AI card components web/src/components/cards/llmd quality
• [coverage-gap] card configs lack deep schema validation (width enum, dataSource union, stats fields, column defs) web/src/config/cards/ quality

  Existing registerCardConfigTest only validates 5 top-level fields. 209 card configs are untested for: CardWidth enum (3|4|5|6|8|12), dataSource union consistency (hook needs hook name, api needs endpoint), content list columns (field property required), stats array required fields and uniqueness, emptyState variant enum.

• [advisory] missions deep-link scoring logic untested (missionBrowserDeepLink.ts) web/src/components/missions/missionBrowserDeepLink.ts quality
• [advisory] github-pipelines/helpers.ts: isValidRepo/isAllowedRepo repo allowlist validators untested web/netlify/functions/github-pipelines/helpers.ts quality
• [advisory] main branch Go test failure fixed by PR [quality] fix CreateTeamRequest.MemberIDs JSON serialization for empty slices #19632 (teams JSON serialization) pkg/models/teams.go quality
• [advisory] web/src/components/missions: 44 source files with zero tests web/src/components/missions quality
• [advisory] web/src/config/cards: 209 source files with zero test coverage web/src/config/cards quality
• [advisory] docs: only 8 test files covering 1 of 35 source dirs kubestellar/docs/src/__tests__ quality
• [advisory] console: 29 CNCF card components have zero unit tests web/src/components/cards/*_status quality
• [advisory] Coverage Suite run Scheduled workflow failure: Release #3893 failed — run ValidateJWT skips token revocation check — revoked tokens accepted on WebSocket and exec sessions #3894 in progress — potential test instability console:.github/workflows/coverage-hourly.yml quality
• [advisory] 8 Go packages have 0% ratchet thresholds despite having test files .github/go-package-coverage-ratchet.txt quality
• [advisory] console: coverage ratchet thresholds stale — 8 packages at 0% have test files .github/go-package-coverage-ratchet.txt quality
• [advisory] console: coverage ratchet thresholds are stale — 8 packages show 0% but have extensive test files .github/go-package-coverage-ratchet.txt quality
• [advisory] kubestellar-mcp#354: post-publish validation implementation provided on PR#332 .github/workflows/publish-mcp-registry.yml quality
• [advisory] docs src/config/versions.ts — 11 routing-critical functions had zero test coverage src/config/versions.ts quality
• [advisory] pkg/kb/rag: zero unit-level coverage for BM25, tokenizer, embedder, intent detection pkg/kb/rag/ quality
• [advisory] 6+ Go tests still failing after PR#19521 — handlers/gateway, k8sError, validateCatalog, kagentiProvider pkg/api/handlers quality
• [advisory] pkg/notifications has 10+ test files (incl. integration tests) but 0% ratchet floor — regression undetected pkg/notifications/webhook.go quality
• [advisory] pkg/sanitize coverage ratchet at 0% — security-critical prompt injection prevention untested by CI floor pkg/sanitize/prompt.go quality
• [advisory] pkg/services/team has zero test coverage pkg/services/team/service.go quality
• [advisory] pkg/services/team has no test file pkg/services/team/service.go quality
• [coverage-gap] Missing unit tests for web/src/lib/constants/time.ts web/src/lib/constants/time.ts quality

  time.ts defines 13 fundamental constants (MS_PER_SECOND, MS_PER_MINUTE, etc.) used in 70+ locations. Every other module in constants/ has a test file except time.ts. PR fix: name alert threshold constants #19497 introduces new usages of MS_PER_SECOND for alert timing. A wrong derivation would silently break timeouts across the app.

• [advisory] workloads/cluster_groups.go 0% coverage — 10 CRUD+cache handlers untested (issue [quality] workloads/cluster_groups.go at 0% coverage — 10 CRUD+cache handlers untested #19118) pkg/api/handlers/workloads/cluster_groups.go quality
• [advisory] Federation provider action execution at 0% coverage pkg/agent/federation/providers/*_actions.go quality
• [advisory] feedback/github_prs.go handlePREvent business logic untested — PR lifecycle linking pkg/api/handlers/feedback/github_prs.go quality
• [advisory] feedback/requests_sync.go at 0% coverage — auth boundary tests for CloseRequest/ReopenRequest/SubmitFeedback pkg/api/handlers/feedback/requests_sync.go quality
• [advisory] pkg/services/team service layer at 0% coverage — permission boundary tests pkg/services/team/service.go quality
• [advisory] feedback/github_app_auth.go at 0% — JWT signing, token caching, credential loading all untested pkg/api/handlers/feedback/github_app_auth.go quality
• [advisory] feedback/github_app_auth.go at 0% — GitHub App JWT+installation token auth untested (security-critical) pkg/api/handlers/feedback/github_app_auth.go quality
• [advisory] teams.go handler at 0% — 10 authorization-critical functions (CRUD + members + roles) untested pkg/api/handlers/teams.go quality
• [advisory] audit SIEM tests broken — SSRF blocks 127.0.0.1 loopback (7 tests) pkg/api/audit/splunk_test.go quality
• [advisory] notifications webhook tests broken — SSRF blocks 127.0.0.1 loopback (7 tests) pkg/notifications/webhook_test.go quality
• [advisory] audit WebhookDestination.Send at 0% — SIEM delivery path untested pkg/api/audit/export.go:153 quality
• [advisory] ValidateWebSocketOrigin and isWSOriginAllowed at 0% — CSWSH protection untested pkg/api/middleware/auth.go:769 quality
• [advisory] StoreOAuthState timezone mismatch: stores local time.Now() but cleanup uses time.Now().UTC() pkg/store/sqlite_auth.go:52 quality
• [advisory] 10 pkg/k8s tests fail in-cluster due to KUBERNETES_SERVICE_HOST pkg/k8s/client_clients_test.go quality
• [advisory] Observer node condition filter misses DiskPressure=True (production bug) pkg/stellar/observer/observer.go:746 quality
• [advisory] Stellar handler layer has zero test coverage (1,780 lines across 4 files) pkg/api/handlers/stellar_handler.go quality
• [advisory] SSE transport session registry and console persistence helpers untested (1,203 lines) pkg/api/handlers/sse_transport.go quality
• [advisory] missions handler_test.go 2 panicking tests — PR#18482 fixes pkg/api/handlers/missions/handler_test.go quality
• [advisory] Console persistence handlers 783 lines 0% coverage pkg/api/handlers/console_persistence_store.go quality
• [advisory] MCP handlers 4,499 lines 0% coverage pkg/api/handlers/mcp/ quality
• [advisory] pkg/api/handlers: stellar_handler.go + stellar_solver.go 0% coverage (1748 LOC) pkg/api/handlers/stellar_handler.go quality
• [advisory] pkg/api/handlers: github_pipelines family 0% coverage (1635 LOC) pkg/api/handlers/github_pipelines.go quality
• [advisory] DeviceTracker parseDeviceCounts/checkForBoolDrop had <37% coverage pkg/agent/workers/workers_device_tracker.go quality
• [advisory] pkg/api/transport SSE cache and hub demo session functions at 0% coverage pkg/api/transport/sse_cache.go quality
• [advisory] pkg/agent/kube ValidateKubectlArgs security-critical function at 72% coverage pkg/agent/kube/client.go quality
• [advisory] pkg/api/handlers/mcp/drasi_proxy.go declares wrong package (handlers vs mcp) pkg/api/handlers/mcp/drasi_proxy.go:27 quality
• [advisory] pkg/api/handlers/mcp: 4499 LOC with zero test coverage (blocked by package conflict) pkg/api/handlers/mcp/handler.go quality
• [advisory] pkg/api/handlers: 39 source files lack unit test coverage pkg/api/handlers/ quality
• [advisory] pkg/api/handlers/missions untestable due to undefined symbols after refactor pkg/api/handlers/missions/handler.go quality
• [advisory] 4 packages have test build failures blocking all test execution pkg/mcp/client_test.go,pkg/watcher/watcher_test.go,pkg/services/stellar/service_test.go,pkg/settings/manager_validation_test.go quality
• [advisory] agent/kube context.go functions entirely untested (buildLiveClusterContext, appendClusterHealth, appendPodIssues) pkg/agent/kube/context.go quality
• [advisory] kagentiprovider client functions at 0% coverage (Invoke, Discover, Detect, Status, ListAgents) pkg/kagentiprovider/client.go quality
• [advisory] pkg/k8s/k8stest uses corev1 for authz types — SelfSubjectAccessReview undefined pkg/k8s/k8stest/mocks_test.go quality
• [advisory] pkg/store OAuth tests require CREDENTIAL_ENCRYPTION_KEY — not self-contained pkg/store/sqlite_oauth_credentials_test.go quality
• [advisory] pkg/api/audit tests broken by SSRF validation — same pattern as [quality] fix: SSRF validation breaks webhook tests and loopback allowance #17888 pkg/api/audit/destinations_test.go quality
• [advisory] Federation provider actions at 0% — 14 destructive cluster operations untested pkg/agent/federation/providers/capi_actions.go quality
• [advisory] pkg/stellar/solver at 49% — autonomous K8s decision loop pkg/stellar/solver/solver.go quality
• [advisory] pkg/services/stellar at 30.2% coverage — core AI runtime service pkg/services/stellar/service.go quality
• [advisory] SSRF validation breaks webhook tests — 7 tests failing pkg/notifications/webhook.go quality
• [advisory] 31 API handlers have no unit tests (MCP, Stellar, Feedback) pkg/api/handlers quality
• [advisory] 5 packages have test build failures blocking CI coverage pkg/watcher,pkg/mcp,pkg/stellar/observer,pkg/services/stellar,pkg/api/handlers quality
• [advisory] PR [scanner] refactor: extract DCGM types from pkg/agent to pkg/gpu #17772: pkg/gpu extraction has zero unit tests pkg/gpu/scraper.go quality
• [advisory] pkg/mcp: build failure on main (unused variable in test) pkg/mcp/client_test.go:523 quality
• [advisory] pkg/stellar/observer at 42% — event processing logic gaps pkg/stellar/observer/observer.go quality
• [advisory] pkg/api/middleware/auth.go 25% uncovered — auth error paths at risk pkg/api/middleware/auth.go quality
• [advisory] 21 packages with build/setup failures blocking coverage analysis pkg/agent,pkg/api,pkg/k8s,pkg/stellar quality
• [advisory] pkg/watcher core functions at 0% coverage (24% overall) pkg/watcher/watcher.go quality
• [advisory] pkg/ssrf ValidateHost DNS path at 40% coverage (security-critical) pkg/ssrf/ssrf.go quality
• [advisory] feedback GitHub integration: 1,519 LOC untested issue creation/linking pipeline pkg/api/handlers/feedback_github_issues.go quality
• [advisory] feedback GitHub integration: 1,519 LOC untested — tests written awaiting push pkg/api/handlers/feedback_github_issues.go quality
• [advisory] Feedback GitHub integration untested (1,519 LOC) pkg/api/handlers/feedback_github_issues.go quality
• [advisory] Stellar solver/watches handlers untested (1,574 LOC) pkg/api/handlers/stellar_solver.go quality
• [advisory] Go API handlers: 33 source files without test coverage (feedback, missions, MCP) pkg/api/handlers/feedback_github_issues.go quality
• [advisory] pkg/k8s/client_gpu_cronjob.go Install/Uninstall functions lack unit tests pkg/k8s/client_gpu_cronjob.go quality
• [advisory] pkg/agent: update_execute.go remains untested (366 LOC, needs refactor for mockability) github.com/kubestellar/console/issues/17565 quality
• [advisory] pkg/agent: config resource + kubeconfig handlers untested (669 LOC) pkg/agent/server_http_resources_config.go quality
• [advisory] SSE resource stream handlers at 0% coverage (170 LOC) pkg/agent/server_http_resources_stream.go quality
• [advisory] pkg/agent mutation handlers (namespace/SA/serviceexport) lack input validation tests pkg/agent/server_http_resources_workloads.go quality
• [advisory] pkg/agent has 23 untested files totaling ~2000+ LOC — server_http_resources_workloads.go (423), server_http_resources_config.go (359), server_http_kubeconfig.go (310) are largest pkg/agent/server_http_resources_workloads.go quality
• [advisory] pkg/agent server_health.go (178 LOC) has zero test coverage — HTTP health/status/metrics/provider-check handlers pkg/agent/server_health.go quality
• [advisory] pkg/k8s/client_gpu_health.go has zero test coverage (285 LOC) pkg/k8s/client_gpu_health.go quality
• [advisory] Pre-existing test redeclarations block pkg/k8s CI pkg/k8s/rbac_probe_test.go quality
• [advisory] PR [scanner] fix: pin react-hooks lint rules to unblock nightly release #17507 needs .lint-warning-baseline update to 2312 to pass CI web/.lint-warning-baseline quality
• [advisory] Pre-existing test redeclaration errors block all Go PRs pkg/compliance/hipaa/summary_test.go,pkg/k8s/rbac_probe_test.go,pkg/api/handlers/missions_test.go quality
• [advisory] client_clients.go: zero test coverage on critical multi-cluster connection logic pkg/k8s/client_clients.go quality
• [advisory] pkg/k8s/client_workloads.go has zero test coverage for deployment status logic pkg/k8s/client_workloads.go quality
• [advisory] clusterDisplayName test contradiction: shared-distribution.test.ts expects stale slice(0,22) web/src/hooks/mcp/__tests__/shared-distribution.test.ts quality
• [advisory] kubestellar-mcp: MCP tool registry files (684 LOC) lack dedicated unit tests pkg/mcp/server/tools_workloads_registry.go quality
• [advisory] 788 React Compiler lint warnings with no regression gate web/eslint.config.js quality
• [advisory] pkg/mcp/tools/upgrades has zero test coverage (1112 lines) pkg/mcp/tools/upgrades/upgrades.go quality
• [advisory] kubestellar/docs: Critical test gap — 7 percent file coverage (6/90 source files) kubestellar/docs/src/ quality
• [advisory] handleMixedModeChat 0% coverage - critical AI chat path pkg/agent/server_ai_mixed.go quality
• [advisory] workloadQueries/ directory (5 modules) has zero test coverage web/src/hooks/mcp/workloadQueries/ quality
• [advisory] kubestellar-mcp: RBAC tools missing tests for 5 of 11 functions (AnalyzeSubjectPermissions, DescribeRole, FindResourceOwners, AuditKubeconfig, subjectMatches) pkg/mcp/server/tools_rbac.go quality
• [advisory] safeLazy utility has zero unit tests despite being used by 16+ components web/src/lib/safeLazy.ts quality
• [advisory] console: pkg/stellar/scheduler has 27.6% test coverage — scheduling decisions untested pkg/stellar/scheduler quality
• [advisory] console: pkg/stellar/solver has 3.1% test coverage — AI scheduling logic nearly untested pkg/stellar/solver quality
• [advisory] console: pkg/stellar/observer has 2.6% test coverage — critical observability gap pkg/stellar/observer quality
• [advisory] tool_registry.go has zero dedicated unit tests pkg/mcp/server/tool_registry.go quality
• [advisory] Console repo: 137/462 Go source files lack test coverage pkg/api/handlers/ quality
• [advisory] MCP server pkg/mcp/server at 40.5% coverage — 9 tool functions at 0% pkg/mcp/server/upgrades.go quality
• [advisory] pkg/mcp/server/upgrades.go test coverage critically low (10% ratio) pkg/mcp/server/upgrades.go quality
• [advisory] tools_kubectl.go handlers lack unit tests (handleDeleteResource, handleKubectlApply) pkg/deploy/mcp/tools_kubectl.go quality
• [advisory] 12 compliance engines still have nil-check-only tests (SLSA, SBOM, signing, licenses, BAA, airgap, SoD, GxP, changecontrol, residency, frameworks, reports scoring) pkg/compliance/{slsa,sbom,signing,licenses,baa,airgap,sod,gxp,changecontrol,residency} quality
• [advisory] Compliance engine evaluation logic untested — scoring formulas never exercised with varied inputs pkg/compliance/*/engine.go quality
• [advisory] Server test helper expanded — unlocks 31 handler file coverage pkg/agent/server_test_helpers_test.go quality
• [advisory] No pre-merge E2E gate for frontend changes in console .github/workflows/playwright.yml quality
• [advisory] PR [Copilot Review] 3 comment(s) on merged PR #5848 #5851 security fix has no regression tests for CodeQL ✨ Replace vague TODO comments with actionable implementation guidance #190/🐛 Fix mission chat appending all responses into one bubble #188 fixes kubestellar/docs#5851 quality
• [advisory] PR feat: ACCM metrics dashboard + NPS cache fix (#5844) #5855 exports sanitizeHtmlForMdx — enables direct import testing kubestellar/docs#5855 quality
• [advisory] docs: sanitizeHtmlForMdx security function has zero unit tests on main kubestellar/docs:src/app/docs/[...slug]/page.tsx quality
• [advisory] console: Playwright E2E has no PR trigger (regressions only caught post-merge) kubestellar/console:.github/workflows/playwright.yml quality
• [advisory] docs: sanitizeHtmlForMdx extracted + 33 unit tests (PR Vitest config uses removed poolOptions, producing deprecation noise on every run #5860) kubestellar/docs:pull/5860 quality
• [advisory] console: mixed-mode command security validation now has 50+ tests (PR [quality] add comprehensive tests for mixed-mode command security validation #17293) kubestellar/console:pull/17293 quality
• [advisory] console: AI rate limiter + prompt cap (PR [sec-check] fix: add AI-specific rate limiter and prompt length cap for /api/cluster-groups/ai-query #17295) ships with no tests kubestellar/console:pkg/api/handlers/workloads_cluster_query.go quality
• [advisory] PR [sec-check] fix: add AI-specific rate limiter and prompt length cap for /api/cluster-groups/ai-query #17295 AI rate limiter + prompt cap has zero test coverage pkg/api/handlers/workloads_cluster_query.go quality
• [advisory] docs#5862 iframe fix targets stale page.tsx after Vitest config uses removed poolOptions, producing deprecation noise on every run #5860 extraction merge kubestellar/docs#5862 quality
• [advisory] repo-allowlist.ts has zero test coverage (SSRF guard) web/netlify/functions/_shared/repo-allowlist.ts quality
• [advisory] CSP regression test PR opened ([quality] add CSP header regression tests for middleware_setup.go #17305) — guards against wss: wildcard reintroduction pkg/api/middleware_csp_test.go quality
• [advisory] sanitizeEventField() in pkg/stellar/evaluator.go has no unit tests (prompt injection fix) pkg/stellar/evaluator.go quality
• [advisory] pkg/api/handlers at 47.1% coverage — 12 feedback files (3011 LOC) completely untested pkg/api/handlers/feedback_github_issues.go quality
• [advisory] workload_deploy.go: normalizeImageRef, cleanManifestForDeploy, normalizeImageNames untested pkg/k8s/workload_deploy.go quality
• [advisory] console_persistence_validation.go has 0% test coverage — cluster filter matching logic pkg/api/handlers/console_persistence_validation.go quality
• [advisory] stellar_auth.go has 0% test coverage — authentication helpers pkg/api/handlers/stellar_auth.go quality
• [advisory] evaluateClusterGroup has no integration test coverage pkg/api/handlers/console_persistence_validation.go quality
• [advisory] evaluateClusterGroup has zero unit test coverage pkg/api/handlers/console_persistence_validation.go quality
• [advisory] evaluateClusterGroup has no unit test coverage pkg/api/handlers/console_persistence_validation.go quality
• [advisory] console: 79 frontend component/hook directories lack unit tests web/src/components quality
• [advisory] tools_drift.go has zero unit test coverage pkg/mcp/server/tools_drift.go quality
• [advisory] console-marketplace PR#237 weakens permissions: {} to read-all .github/workflows/copilot-automation.yml quality
• [advisory] kubestellar-mcp tools_cluster.go and tools_drift.go lack unit tests pkg/mcp/server/tools_cluster.go quality
• [advisory] Missing tests for pkg/mcp/server/tools_drift.go in kubestellar-mcp pkg/mcp/server/tools_drift.go quality
• [advisory] kubestellar-mcp: tools_drift.go has no unit tests pkg/mcp/server/tools_drift.go quality
• [advisory] kubestellar-mcp: tools_cluster.go has no unit tests pkg/mcp/server/tools_cluster.go quality
• [advisory] tools_drift.go has no unit tests — critical drift detection orchestration untested pkg/mcp/server/tools_drift.go quality
• [advisory] docs repo has 4 test files covering 86 source files (4.6% file coverage) kubestellar/docs quality
• [advisory] Drasi reactive graph card: 3,388 lines with zero test coverage web/src/components/cards/drasi/ quality
• [advisory] docs#5875: transformMdx unit tests have 3 assertion failures — ordering mismatch in style/comment transforms src/__tests__/transformMdx.test.ts quality
• [advisory] Missing unit tests for secureTokenStore (token integrity verification, TTL expiry) web/src/lib/secureTokenStore.ts quality
• [advisory] Missing unit tests for stellar/providers/crypto.go (AES-GCM encrypt/decrypt) pkg/stellar/providers/crypto.go quality
• [advisory] 39 handler files in pkg/api/handlers/ have zero test coverage pkg/api/handlers/console_persistence_validation.go quality
• [advisory] console_persistence_validation.go has complex filter-matching logic with no tests pkg/api/handlers/console_persistence_validation.go quality
• [advisory] stellar_solver.go: 785 lines, 20 functions, zero test coverage pkg/api/handlers/stellar_solver.go quality
• [advisory] CORS allowlist module (cors.ts) has zero test coverage web/netlify/functions/_shared/cors.ts quality
• [advisory] In-memory rate limiter (inMemoryRateLimit.ts) has zero test coverage web/netlify/functions/_shared/inMemoryRateLimit.ts quality
• [advisory] No CSP header tests for middleware_setup.go (connect-src wildcard fix untested) pkg/api/middleware_setup.go quality
• [advisory] read-capped-json.ts zero coverage — upstream OOM guard untested web/netlify/functions/_shared/read-capped-json.ts quality
• [advisory] pkg/compliance engines have only nil-check smoke tests — compliance logic untested pkg/compliance/ quality
• [advisory] read-capped-body.ts has zero test coverage (CWE-400 guard) web/netlify/functions/_shared/read-capped-body.ts quality
• [advisory] read-capped-request.ts zero coverage — chunked encoding DoS bypass guard untested web/netlify/functions/_shared/read-capped-request.ts quality
• [advisory] Security tab components (510 LoC) had zero test coverage web/src/components/security/SecurityIssuesTab.tsx quality
• [advisory] Security.tsx orchestrator (465 LoC) has no unit tests web/src/components/security/Security.tsx quality
• [advisory] 32 hooks in web/src/hooks/ lack unit tests — key gaps in useMissions, useDrasi*, useFederation web/src/hooks/ quality
• [advisory] Filed issue [quality] Unit test coverage gaps in web/src/hooks/ #17399 for hook coverage gaps (useMissions, useDrasi*, useFederation) kubestellar/console#17399 quality
• [advisory] cacheCore.ts and cacheStorage.ts lack dedicated unit tests web/src/lib/cache/cacheCore.ts quality
• [advisory] useMissions hooks have no unit test coverage web/src/hooks/useMissions.ts quality
• [advisory] Go coverage ratchet only tracks 3/16 packages — silent regression risk .github/go-package-coverage-ratchet.txt quality
• [advisory] Dispatched agent for 🐛 154 test failure(s) in Coverage Suite run #3938 #19800: 154 test failures investigation gh-19800 scanner
• [advisory] PR#19711 (gosec fix) and PR#19704 (test mock fix) branches updated with latest main gh-19711 scanner
• [advisory] Updated 9/11 CI-failing PR branches with main (Go test fix fix: repair 5 broken Go tests blocking scanner merges #19521) gh-19521 scanner
• [advisory] Merged console#19543: nil-interface panic fix gh-19543 scanner
• [advisory] docs#6049 and mcp#332 merge blocked — MCP token lacks workflow scope gh-6049 scanner
• [advisory] BLOCKED: 3 merge-eligible PRs (ci: handle cancelled post-merge verification #19590, Metrics UI shows unsupported time ranges without actual data #6049, 🐛 Auto-inject Fixes #N closing keyword in Copilot PR bodies #332) need workflow scope gh-19590 scanner
• [advisory] Dispatched agent for 🐛 101 test failure(s) in Coverage Suite run #3953 #19843: 101 coverage test failures from dark mode revert gh-19843 scanner
• [advisory] 3 merge-eligible PRs blocked by missing workflow scope gh-19590 scanner
• [advisory] 3 merge-eligible PRs blocked by missing workflow scope: ci: handle cancelled post-merge verification #19590, docs#6049, mcp#332 gh-19590 scanner
• [advisory] PR [scanner] fix: resolve Playwright cross-browser nightly test failures #19840: fix Playwright cross-browser nightly (navbar selector + mobile animation) gh-19831 scanner
• [advisory] Dispatched agent for console#19828 (112 unit test failures) gh-19828 scanner
• [advisory] console#19825/[scanner] fix: resolve color consistency issues across components #19824 blocked by 119 E2E failures inherited from main gh-19825 scanner
• [advisory] Merged [scanner] fix: repair test failures from coverage suite run #3947 #19826: test failure repairs gh-19826 scanner
• [advisory] 3 merge-eligible PRs (ci: handle cancelled post-merge verification #19590, Metrics UI shows unsupported time ranges without actual data #6049, 🐛 Auto-inject Fixes #N closing keyword in Copilot PR bodies #332) blocked by missing workflow scope on token gh-19590 scanner
• [advisory] CI-FAILING PRs blocked by pre-existing E2E test failures on main Coverage Suite gh-19824 scanner
• [advisory] Opened console#19819: fix 141 test failures from coverage suite run feature: Historical view of Inventory of GPUs #3946 gh-19819 scanner
• [advisory] 134 test failures from coverage suite run bug: my namespace does not appear in the menu #3945 - agent dispatched gh-19814 scanner
• [advisory] Merged console#19810 — 154 test failures repaired (schema, LLMd, fetchWithTimeout) gh-19810 scanner
• [advisory] PR [scanner] fix: repair 154 test failures in schema-validation, LLMd cards, and fetchWithTimeout #19810: fixed schema-validation test (variant list), push to scanner/fix-19808 gh-19810 scanner
• [advisory] PR [scanner] fix: repair 154 test failures in schema-validation, LLMd cards, and fetchWithTimeout #19810 has 123 E2E failures (build-gate passes) — dispatched fix agent gh-19810 scanner
• [advisory] Merge-eligible PRs ci: handle cancelled post-merge verification #19590, Metrics UI shows unsupported time ranges without actual data #6049, 🐛 Auto-inject Fixes #N closing keyword in Copilot PR bodies #332 blocked by OAuth 403 (workflow scope) gh-19590 scanner
• [advisory] Fixed TS2322 build error on PR [scanner] fix: repair 154 test failures in schema-validation, LLMd cards, and fetchWithTimeout #19810 (tags fallback in savedMissionToExport) gh-19810 scanner
• [advisory] 154 test failures dispatched to 3 parallel agents gh-19800 scanner
• [advisory] 4 merge-eligible PRs blocked by workflow scope gh-19604 scanner
• [advisory] Cannot merge ci: handle cancelled post-merge verification #19590, Metrics UI shows unsupported time ranges without actual data #6049, 🐛 Auto-inject Fixes #N closing keyword in Copilot PR bodies #332 — OAuth token lacks workflow scope gh-19590 scanner
• [advisory] PR [scanner] fix: safe uintptr-to-int conversion in flock_unix.go #19787 merged - gosec flock_unix.go fix gh-19787 scanner
• [advisory] PR [scanner] fix: safe uintptr-to-int conversion in flock_unix.go #19787 DCO fix pushed gh-19787 scanner
• [advisory] 4 merge-eligible PRs blocked: token lacks workflow scope gh-console-19604 scanner
• [advisory] Merged PR#19789: cache-test timing threshold increase (closes Nightly regression: cache-test #19785) gh-19789 scanner
• [advisory] CI fix: update nilaway-baseline.json on PR#19787 gh-19787 scanner
• [advisory] CI fix: update lint-warning-baseline on PR#19790 gh-19790 scanner
• [advisory] Updated branches + DCO fix: [scanner] fix: restore codeGenerator.templates exports broken by file split #19790, 🐛 fix: increase cache-test timing threshold for CI stability #19789, [scanner] fix: safe uintptr-to-int conversion in flock_unix.go #19787 — CI running gh-19790 scanner
• [advisory] Updated branches: [scanner] fix: restore codeGenerator.templates exports broken by file split #19790, 🐛 fix: increase cache-test timing threshold for CI stability #19789, [scanner] fix: safe uintptr-to-int conversion in flock_unix.go #19787 — CI triggered gh-19790 scanner
• [advisory] Merged 5 PRs: docs#6119, console#19770, [scanner] fix: add ARIA labels and keyboard navigation to interactive elements #19769, [scanner] fix: resolve 247 test failures from batch 3 file split #19768, [scanner] fix: split oversized codeGenerator.templates.ts (1326→~400 lines each) #19763 gh-6119 scanner
• [advisory] Cannot merge PRs 19590/6049/332 — OAuth workflow scope limitation gh-19590 scanner
• [advisory] Updated branches on PRs [scanner] fix: improve color contrast for WCAG AA compliance #19770, [scanner] fix: add ARIA labels and keyboard navigation to interactive elements #19769, [scanner] fix: resolve 247 test failures from batch 3 file split #19768, [scanner] fix: split oversized codeGenerator.templates.ts (1326→~400 lines each) #19763 gh-19770 scanner
• [advisory] Opened console#19755: fix 244 test failures (conditional browser mocks) gh-19755 scanner
• [advisory] Merged kubestellar-mcp#378: validate MCP tool inputs gh-378 scanner
• [advisory] Closed PRs [scanner] fix: add demo mode subscription to 2 card components #19744, [scanner] fix: add freshness indicators to cluster/namespace cards #19743, [scanner] fix: add freshness indicators to layout/blueprint components #19742 after 5+ failed CI attempts gh-19744 scanner
• [advisory] PR 19748 opened for 4 test failures gh-19748 scanner
• [advisory] Issue 19745 test failure fix dispatched gh-19745 scanner
• [advisory] PR 19742 lint regression fix dispatched gh-19742 scanner
• [advisory] PR 19743 lint regression fix dispatched gh-19743 scanner
• [advisory] PR 19744 lint regression fix dispatched gh-19744 scanner
• [advisory] Merged PR [scanner] fix: resolve 240 test failures on main #19741 — 240 test failures fix (vitest pattern + corrupted files) gh-19741 scanner
• [advisory] Merge-eligible PRs 19590/6049/332 blocked by missing workflow scope gh-merge-blocked scanner
• [advisory] PRs 19741/19743/19716 blocked by intermittent react-hooks/purity lint error gh-lint-blocker scanner
• [advisory] Merge sweep blocked — all 3 eligible PRs touch workflow files, token lacks workflow scope gh-19590 scanner
• [advisory] PR [scanner] fix: add freshness indicators to layout/blueprint components #19742 build fix — removed unused Loader2, fixed subtitle type gh-19742 scanner
• [advisory] CI fix: PR [scanner] fix: add freshness indicators to cluster card components #19739 TypeScript build error (ClusterInfo.lastUpdated) gh-19739 scanner
• [advisory] CI fix: PR docs: add inline comments explaining workflow token permissions #19716 build-gate lint error (Date.now purity) gh-19716 scanner
• [advisory] CI fix: PR [scanner] fix: add demo mode subscription to 2 cards #19740 TypeScript build error (isDemoMode prop) gh-19740 scanner
• [advisory] PR docs: add inline comments explaining workflow token permissions #19716 build-gate failing - likely blocked by main test failures gh-19716 scanner
• [advisory] CI-failing PR#19716 branch updated after main fix gh-19716 scanner
• [advisory] 5 CI-failing PRs have systemic Playwright E2E failures (build-gate passes) gh-19725 scanner
• [advisory] All 4 merge-eligible PRs blocked by OAuth workflow scope gh-19716 scanner
• [advisory] CI-failing PRs 19717-19720 blocked by main breakage gh-19717 scanner
• [advisory] CI-failing PRs [scanner] fix: resolve nightly test regressions (unit, cache, gosec) #19717-19720 blocked by main breakage gh-19717 scanner
• [advisory] Merge sweep blocked: OAuth workflow scope gh-19716 scanner
• [advisory] 4 merge-eligible PRs blocked: OAuth token lacks workflow scope (docs: add inline comments explaining workflow token permissions #19716, ci: handle cancelled post-merge verification #19590, Metrics UI shows unsupported time ranges without actual data #6049, 🐛 Auto-inject Fixes #N closing keyword in Copilot PR bodies #332) gh-merge-blocked scanner
• [advisory] Merged PR [scanner] fix: resolve test failures from Coverage Suite run #3917 #19704 — resolve 222 test failures from Coverage Suite Better UX for users using AI missions #3917 gh-19704 scanner
• [advisory] Fixed PR [scanner] fix: restore shared test infrastructure broken by #19684 #19693 lint baseline (2649→2767) to unblock CI gh-19693 scanner
• [advisory] Merge blocked: 4 PRs modify .github/workflows/ — OAuth token lacks workflow scope gh-19590 scanner
• [advisory] Closed console#19692 - 181 test failures fixed by [scanner] fix: restore shared test infrastructure broken by #19684 #19693 gh-19692 scanner
• [advisory] Opened PR console#19551: migrate modal state to shared useModalState hook gh-19530 scanner
• [advisory] Merged console#19693 - restored shared test infra gh-19693 scanner
• [advisory] 4 merge-eligible PRs blocked by missing workflow OAuth scope gh-19604 scanner
• [advisory] PR [scanner] fix: add unit tests for pkg/watcher coverage regression #19638 CI fix: removed duplicate test functions gh-19638 scanner
• [advisory] 181 test failures in Coverage Suite [Auto-QA] Silent failures in error handling detected #3913 — fix agent dispatched gh-19692 scanner
• [advisory] Dispatched agent for 181 test failures (console#19692) gh-19692 scanner
• [advisory] console#19497 rebase done but push blocked — needs workflow scope or contributor action gh-19497 scanner
• [advisory] 4 merge-eligible PRs blocked by OAuth workflow scope (docs: add inline comments explaining workflow token permissions #19604, ci: handle cancelled post-merge verification #19590, Metrics UI shows unsupported time ranges without actual data #6049, 🐛 Auto-inject Fixes #N closing keyword in Copilot PR bodies #332) gh-19604 scanner
• [advisory] Dispatched fix agent for 168 test failures (🐛 168 test failure(s) in Coverage Suite run #3905 #19672) gh-19672 scanner
• [advisory] 4 merge-eligible PRs blocked by OAuth workflow scope gh-19604 scanner
• [advisory] Merged PR [scanner] fix: resolve 168 test failures from coverage suite run #3903 #19663: fix 168 test failures (coverage suite [Auto-QA] Active user count feature needs improvements #3903) gh-19663 scanner
• [advisory] Fixed PR#19787 nilaway baseline — CI re-running (fixes Nightly regression: gosec-test #19782) gh-19787 scanner
• [advisory] ESLint errors blocking release workflow on main branch gh-17380 scanner
• [advisory] console#19406: v0.4 public milestone decision required by July 5 — scope vs timeline tradeoff gh-19406 scanner
• [advisory] TS build error in PR [scanner] fix: migrate remaining cards to standardized card hooks (part 2) #19547 — isDemoMode reference not updated gh-19547 scanner
• [advisory] Fixed console#19639 — removed phantom packages from ratchet gh-19639 scanner
• [advisory] Closed console#19641 — wrong Go downgrade gh-19641 scanner
• [advisory] Fixed console#19644 — added missing Button import gh-19644 scanner
• [advisory] 6 PRs blocked by OAuth workflow scope — need manual merge gh-merge-blocked scanner
• [advisory] Merged 6 PRs across 3 repos gh-sweep-20260625 scanner
• [advisory] Opened console#19616 fix 20 test failures across 4 files gh-19616 scanner
• [advisory] Merge blocked: 4 PRs touch workflow files (OAuth scope limitation) gh-merge-blocked scanner
• [advisory] Dispatched agent: fix console#19614 — 20 test failures gh-19614 scanner
• [advisory] Dispatched agent: fix console-marketplace#318 token permissions gh-318 scanner
• [advisory] Dispatched agent: fix PR ✨ Add Netlify presence tracking for live viewer count on console.kubestellar.io #357 CI (test assertion mismatch) gh-357 scanner
• [advisory] Dispatched fix agent for kubestellar-mcp#357 type mismatch gh-357 scanner
• [advisory] Opened console#19609 - tighten workflow security (fixes [sec-check] hive-interactive.yml: actions:write permission allows dispatching any workflow (Scorecard #858) #19601,[sec-check] 8 open Scorecard TokenPermissions alerts for newly-added workflows (hardening) #19602,[sec-check] claude-code-review.yml: no trust gate — all PRs (including fork PRs) trigger CLAUDE_CODE_OAUTH_TOKEN consumption and send code to Anthropic #19603) gh-19609 scanner
• [advisory] Merged kubestellar-mcp#356 - add post-publish verification gh-356 scanner
• [advisory] Merged docs#6093 - tighten run-all-maintainer-audits permissions gh-6093 scanner
• [advisory] Merged console#19607 - tighten workflow permissions gh-19607 scanner
• [advisory] 16 test failures blocking CI (PR dispatched) gh-19600 scanner
• [advisory] Merged PR#19594: fix 21 test failures from Coverage Suite 🐛 Fix sidebar collapse and pin icons overlapping with sidebar content  #3887 gh-19594 scanner
• [advisory] Playwright E2E blank-page infrastructure issue gh-19594 scanner
• [advisory] Opened PR [scanner] fix: resolve 21 test failures from Coverage Suite run #3887 #19594 fixing 21 test failures on main (Fixes 🐛 21 test failure(s) in Coverage Suite run #3887 #19593) gh-19594 scanner
• [advisory] 21 test failures on main (issue 🐛 21 test failure(s) in Coverage Suite run #3887 #19593) — dispatched fix agent gh-19593 scanner
• [advisory] Test failures: 21 tests broken by PR#19591 merge gh-19593 scanner
• [advisory] CI fix: TS2367 in ResourceCapacity.tsx pagination gh-19592 scanner
• [advisory] Merged PR#19591: 45 test failure fix gh-19591 scanner
• [advisory] docs#6049 + mcp#332: merge blocked — OAuth lacks workflow scope gh-6049 scanner
• [advisory] Closed 7 issues as completed: [quality] pkg/agent/kagent has zero unit-level test coverage — 1,251 lines of CRD handlers #19554, [quality] pkg/k8s GPU health subsystem has zero test coverage — 5 pure helpers untested #19555, 🐛 11 test failure(s) in Coverage Suite run #3879 #19558, [quality] pkg/api/handlers/gitops helpers.go lacks tests for SSE injection prevention (#7050) #19564, [quality] Drasi proxy SSRF prevention helpers have zero direct unit test coverage #19571, Workflow failure: Playwright Cross-Browser (Nightly) #19579, Nightly regression: cache-test #19581 gh-19554 scanner
• [advisory] Merged 9 PRs: [scanner] fix: resolve nightly unit-test and cache-test regressions #19588, [scanner] fix: resolve Playwright cross-browser nightly workflow failure #19587, [scanner] fix: correct 2 pre-existing test failures blocking PR CI #19576, [scanner] fix: align navbar responsive breakpoint for tablet viewports #19585, 🌱 test: add unit tests for Drasi proxy SSRF prevention helpers #19573, [scanner] test: add unit tests for pkg/agent/kagent #19569, [scanner] fix: resolve test failures in coverage suite #19568, [scanner] test: add unit tests for pkg/k8s GPU health subsystem #19567, [scanner] test: add unit tests for pkg/api/handlers/gitops helpers #19566 gh-19588 scanner
• [advisory] Dispatched 4 fix agents: Nightly regression: unit-test #19580+Nightly regression: cache-test #19581, Workflow failure: Playwright Cross-Browser (Nightly) #19579, console-kb#2680, go-test-fix on PR#19576 gh-19580 scanner
• [advisory] Pushed fixup to PR#19576: 2 test expectations updated for graceful-degradation gh-19576 scanner
• [advisory] CI-failing PRs all blocked by pre-existing Go test failures in feedback/handlers gh-19576 scanner
• [advisory] 6 console PRs blocked by inherited main test failures gh-19568 scanner
• [advisory] docs#6049 and mcp#332 blocked by OAuth workflow scope gh-6049 scanner
• [advisory] docs#6049 + mcp#332: blocked by OAuth workflow scope gh-6049 scanner
• [advisory] Main branch: 4 Go test failures in feedback/missions/stellar handlers gh-19574 scanner
• [advisory] CI repair: fix remaining test assertions on PR [scanner] fix: correct broken test assertions on main (v2) #19574 gh-19574 scanner
• [advisory] Resolved merge conflict on console#19497 gh-19497 scanner
• [advisory] Dispatched 10 CI repair agents for failing PRs gh-19557 scanner
• [advisory] Fixed vitest CI failure on console-marketplace#309 gh-309 scanner
• [advisory] Fixed unused import CI failure on console#19553 gh-19553 scanner
• [advisory] Opened PR console#19552: extract repeated layout patterns into shared components gh-19535 scanner
• [advisory] Opened PR console-marketplace#309: fix CodeQL superfluous card hook args gh-307 scanner
• [advisory] Updated branches on 10 CI-failing PRs after Go test fix merged gh-19537 scanner
• [advisory] Merged PR#19549: 60+ unit tests for pkg/kb/rag gh-19549 scanner
• [advisory] CI-failing PRs [scanner] fix: add unit tests for pkg/watcher coverage regression #19638,[quality] Ratchet up coverage floors for packages exceeding thresholds #19642 blocked by main test failures (need PR [quality] fix: resolve two test failures breaking main #19639 merged first) gh-19638,gh-19642 scanner
• [advisory] Updated 8/11 CI-failing PR branches after main fix gh-19544 scanner
• [advisory] Issue [strategist] CNCF security audit Q2 2026 action item overdue — ROADMAP deadline passed #18207: CNCF audit action item — commented, needs human action gh-18207 scanner
• [advisory] [strategist] GitHub branch protection settings required — policy-file guardrails cannot block merges #18355 branch protection requires human admin action gh-18355 scanner
• [advisory] [strategist] CNCF security audit Q2 2026 action item overdue — ROADMAP deadline passed #18207 CNCF audit request requires human filing gh-18207 scanner
• [advisory] [strategist] GitHub branch protection settings required — policy-file guardrails cannot block merges #18355 branch protection requires admin action — commented with specific settings needed gh-18355 scanner
• [advisory] [strategist] CNCF security audit Q2 2026 action item overdue — ROADMAP deadline passed #18207 CNCF audit request overdue — commented requesting status from @clubanderson gh-18207 scanner
• [advisory] OAuth workflow scope blocks merge of 4 PRs modifying .github/workflows/ gh-19405 scanner
• [advisory] console#19307: v0.4 T-11 days with zero feature PRs merged — release scope at risk gh-19307 scanner
• [advisory] console#19005: 5 simultaneous nightly CI failures — root cause analysis needed before v0.4 gh-19005 scanner
• [advisory] console#19499: Playwright nightly fails on mobile-safari, mobile-chrome, webkit — likely missing viewport/touch handlers gh-19499 scanner
• [advisory] console-kb#2665: 17 open TokenPermissions alerts — copilot-dco.yml has no permissions block at all gh-2665 scanner
• [advisory] console-marketplace#304: 5+ workflows with over-permissive GITHUB_TOKEN scopes gh-304 scanner
• [advisory] homebrew-tap#121: copilot-dco.yml has NO permissions block — inherits write-all (worst case) gh-121 scanner
• [advisory] kubestellar-mcp#349: 5 workflows with excess perms — scorecard top-level security-events:write, pr-verifier checks:write gh-349 scanner
• [advisory] docs#6070: 11 workflows with over-permissive GITHUB_TOKEN — contents/actions/checks/statuses:write gh-6070 scanner
• [advisory] console#19504: 8 workflows with excess GITHUB_TOKEN scopes (contents/packages/actions/statuses:write) gh-19504 scanner
• [advisory] console-kb#2666: no branch protection on default branch — direct pushes, no review required gh-2666 scanner
• [advisory] homebrew-tap#122: no branch protection on default branch — direct pushes, no review required gh-122 scanner
• [advisory] console-marketplace#305: no branch protection on default branch — direct pushes, no review required gh-305 scanner
• [advisory] kubestellar-mcp#350: no branch protection on default branch — direct pushes, no review required gh-350 scanner
• [advisory] docs#6071: no branch protection on default branch — direct pushes, no review required gh-6071 scanner
• [advisory] Opened console#19493 fixing [Auto-QA Child] Extract strings from card test files #19489 [Auto-QA Child] Extract strings from modal/unified test files #19490 [Auto-QA Child] Extract strings from Storybook files #19491 [Auto-QA Child] Extract strings from dashboard test files #19492 gh-19493 scanner
• [advisory] Blocked: docs#6049 and kubestellar-mcp#332 require workflow scope gh-6049 scanner
• [advisory] Merge sweep blocked: workflow scope gh-6049 scanner
• [advisory] merge-blocked: docs#6049,mcp#332,console#19400 all touch workflow files — MCP token lacks workflow scope gh-6049 scanner
• [advisory] Merge blocked: OAuth workflow scope gh-6049 scanner
• [advisory] GitHub topics absent: zero discoverability on topic search — adoption funnel starts here gh-19404 strategist
• [advisory] cache-test TTC: 17 consecutive threshold bumps mask warm-path regression ([strategist] cache-test TTC: 17 consecutive threshold bumps mask real CI performance regression #19348) gh-19348 strategist
• [advisory] @Jayant-kernel 3 PRs/2 days incl governance: strategic retention opportunity gh-19306 strategist
• [advisory] PR hygiene crisis: 67% DCO failures + 37% WIP zombies — Copilot structural DCO gap and stale PR accumulation gh-19007 strategist
• [advisory] Stellar handler layer zero test coverage (1,780 lines): explicit GA gate added — [strategist] Stellar handler layer zero coverage (#18491) blocks Stellar GA milestone — add as explicit GA gate #18535 gh-18535 strategist
• [advisory] ADOPTERS.md self-referential only: KubeStellar lists itself — no external adopter evidence for CNCF gh-18188 strategist

🟡 MEDIUM (491)

• [advisory] stellar handler god files: handler.go 974L mixes SSE/workers/state/helpers pkg/api/handlers/stellar/#19001 architect
• [advisory] 15 god hooks exceed 500 lines — extract & compose needed web/src/hooks/#18906 architect
• [advisory] Extract consumer-side interfaces for 6 handlers (rbac, crds, service_exports, webhook, lima, stellar) console#17822 architect
• [advisory] hooks/mcp/ god module: 44 source files, types.ts exports 54 types web/src/hooks/mcp/#18905 architect
• [advisory] middleware/auth.go god file: 862 lines mixing JWT, revocation, user validation, WebSocket auth pkg/api/middleware/auth.go#18971 architect
• [advisory] Clarification: How and where will this tool run — CLI, container, browser extension, or CI service? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: What should the tool NOT do, and what are its hard boundaries or non-functional constraints? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: How will you know the tool is working correctly — what are the success criteria? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: Who are the primary users and how will they use this tool? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: What data does the tool manage and how should baseline screenshots be stored and versioned? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: Which language/runtime should the tool be built with? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] Clarification: What are the 2-3 must-have features for this visual regression tool? inception/idea-i-want-a-tool-to-do-end-to-end-visual-regression-testing brainstorm
• [advisory] kubestellar/console: Playwright Cross-Browser (Nightly) run#108 — 4 browser jobs failed on main playwright-nightly-run-27746123468 ci-maintainer
• [advisory] kubestellar/console: Nightly UX Journey Tests failing (run#77, scheduled 2026-06-18) nightly-ux-run-27741527635 ci-maintainer
• [advisory] Coverage Suite: 3 frontend tests failing after React 19.2.7 sync — blueprint-info-panels, buildpacks-coverage, Deployments Coverage-Suite/27639625057,issue/18438 ci-maintainer
• [advisory] Cloud Native Buildpacks CNCF Incubating: console ships buildpacks card — zero engagement gh-18946 outreach
• [advisory] Knative CNCF Graduated (5k★): console ships Knative status card — zero engagement gh-18942 outreach
• [advisory] security practitioner community: SPIFFE+TUF+Trestle cards — zero CNCF Security TAG engagement gh-18822 outreach
• [advisory] Orbit recurring missions: zero public content on autonomous cluster maintenance gh-18818 outreach
• [advisory] WasmCloud CNCF incubating: console card ships — engage for co-promotion gh-18817 outreach
• [advisory] Ollama community: guided K8s deploy mission — zero engagement despite shipped card gh-18815 outreach
• [advisory] vCluster (6k★): console ships VCluster status card — engage Loft Labs + multi-tenancy community gh-18947 outreach
• [advisory] console-marketplace contributor funnel: no first-contribution guide for card pattern gh-18945 outreach
• [advisory] cross-repo README drift: kubestellar-mcp missing console integration docs gh-18948 outreach
• [advisory] KEDA CNCF Graduated (8k★): console ships KEDA status card — zero engagement gh-18998 outreach
• [advisory] pkg/api/audit tests failing (7 failures) pkg/api/audit quality
• [advisory] rbac_sa_roles.go: isSystemRole pure function untested pkg/k8s/rbac_sa_roles.go quality
• [advisory] kubestellar-mcp: server.json not validated in CI (issue [Auto-QA] Components fetching data without loading/error states #371) server.json quality
• [advisory] PR 🐛 Auto-inject Fixes #N closing keyword in Copilot PR bodies #332 downloads mcp-publisher without checksum verification .github/workflows/publish-mcp-registry.yml quality
• [advisory] llmd card render tests: 6 exported components now covered web/src/components/cards/llmd/__tests__/ quality
• [advisory] Accessibility Tests and chromium shard-4 failing consistently across all PRs - pre-existing CI flakiness .github/workflows/e2e-tests.yml quality
• [advisory] Accessibility Tests CI check failing consistently across all quality PRs (pre-existing/flaky) .github/workflows quality
• [advisory] web/src/components/missions: ~30 untested React components and dialogs web/src/components/missions quality
• [advisory] web/src/config/cards: stub tests lack configuration depth web/src/config/cards/__tests__ quality
• [advisory] 7 missions components still without tests: FixerCard, InstallerCard, MissionContentContext/Viewer, ResolutionErrorBoundary/KnowledgePanel, UnstructuredFilePreview web/src/components/missions/ quality
• [advisory] PreflightFailure + MissionToolPrerequisiteNotice components had zero test coverage web/src/components/missions/PreflightFailure.tsx quality
• [advisory] analytics-accm/aggregation.ts: 170 LOC of analytics aggregation with zero test coverage web/netlify/functions/analytics-accm/aggregation.ts quality
• [advisory] lib/utils/layouts.ts: 6 layout utility functions used 800+ times with zero tests web/src/lib/utils/layouts.ts quality
• [advisory] analytics-accm/helpers.ts: isoWeek, lastNWeeks, isAIContribution have zero test coverage web/netlify/functions/analytics-accm/helpers.ts quality
• [advisory] pkg/watcher coverage regression resolved: 67.1% → 71.4% via PR [quality] boost pkg/watcher coverage from 67.1% to 71.4% (above 70.0% floor) #19635 pkg/watcher/watcher_coverage_test.go quality
• [advisory] pkg/watcher: 73% coverage across 19 functions pkg/watcher quality
• [advisory] pkg/mcp: 72.6% coverage across 40 functions — MCP server logic undertested pkg/mcp quality
• [advisory] pkg/agent/updater: 69.6% coverage across 59 functions pkg/agent/updater quality
• [advisory] docs: vitest runs but has no coverage threshold or gate .github/workflows/vitest.yml quality
• [advisory] console: pkg/agent/procutil has no test coverage pkg/agent/procutil quality
• [advisory] console-marketplace: hooks and utility libs have no tests web/src/hooks,web/src/lib quality
• [advisory] console: Go packages kagentiprovider and models at 0% coverage pkg/kagentiprovider,pkg/models quality
• [advisory] kubestellar-mcp: no per-package coverage ratchet — only global 43.5% floor kubestellar-mcp:.github/go-coverage-ratchet.txt quality
• [advisory] pkg/kagentiprovider at 0% ratchet despite 5 test files console:pkg/kagentiprovider quality
• [advisory] Marketplace card rendering: most cards have tests, gap is in helper components (StatTile, NodePoolRow, GatewayRow) kubestellar/console-marketplace#322 quality
• [advisory] pkg/mcp/server/tools_rbac.go: 4 handler functions untested (subjectMatches, analyzeSubjectPermissions, describeRole, findResourceOwners) pkg/mcp/server/tools_rbac.go quality
• [advisory] pkg/settings/types.go lacked unit tests - PR 19612 filed pkg/settings/types.go quality
• [advisory] pkg/models teams.go and user.go lacked unit tests — PR [quality] add unit tests for teams.go, user.go, and settings/types.go #19612 filed pkg/models/teams.go quality
• [advisory] MCP tool registry files lacked unit tests — PR 🐛 Fix Bob agent returning lazy summaries instead of analysis #360 filed pkg/mcp/server/tools_*_registry.go quality
• [advisory] console#19611: model/settings unit test gap (teams, user, settings types) console#19611 quality
• [advisory] kubestellar-mcp#359: MCP tool registry tests needed (RBAC, policy, upgrades) kubestellar-mcp#359 quality
• [advisory] kubestellar-mcp: tool registry files (RBAC, policy, upgrades) lack unit tests pkg/mcp/server/tools_rbac_registry.go quality
• [advisory] console: pkg/models (teams.go, user.go) and pkg/settings/types.go lack unit tests pkg/models/teams.go quality
• [advisory] Post-merge-verify treats cancelled as failed (spurious regression issues) .github/workflows/post-merge-verify.yml quality
• [advisory] MCP Registry publish workflow has no post-publish validation .github/workflows/publish-mcp-registry.yml quality
• [advisory] 16 compliance packages have tests but 0% coverage ratchet — regression undetected .github/go-package-coverage-ratchet.txt quality
• [advisory] UpdateMemberRole is a no-op stub — no permission check or store call pkg/services/team/service.go:225 quality
• [regression-risk] PR fix: name alert threshold constants #19497 units.ts changes byte constant derivation without test update web/src/lib/constants/units.ts quality

  PR fix: name alert threshold constants #19497 changes BYTES_PER_MIB from 10241024 to BYTES_PER_KIBBYTES_PER_KIB (correct but compositional). A units.test.ts file already exists but should be verified to cover the new derivation chains.

• [coverage-gap] kubestellar-mcp coverage at 43.5% — significant room for improvement kubestellar/kubestellar-mcp quality

---

⚠️ Digest truncated: 138187 → 65214 characters (GitHub limit: 65536)

[clubanderson]

Scanner Pass — 2026-06-28 03:42 AM ET

Merge-Eligible PRs — Blocked

All 3 merge-eligible PRs (#19590, docs#6049, kubestellar-mcp#332) touch workflow files. MCP merge fails with 403: refusing to allow an OAuth App to create or update workflow without 'workflow' scope. These need manual merge via gh pr merge --admin --squash or GitHub UI.

CI-Failing PRs — Main is Broken

⚠️ Main branch has ~120 Playwright E2E test failures across all shards:

Shard	Main failures	PR failures	Delta
1	27	27	0
2	39	39	0
3	5	7	+2
4	49	50	+1
A11y	1	1	0
Total	121	124	+3

The CI-failing PRs (#19829, #19825, #19824) are NOT causing these failures — they inherit them from main. The build-gate passes on all 3 PRs.

Common error pattern: "Route rendered blank (0 chars)" — app fails to render content during E2E tests.