[hivecommons-hive]

Test Improvement

package.json's test:coverage c8 thresholds (--lines 99 --statements 99 --branches 97 --functions 100) were looser than the repo's actual coverage, which is 100% stmts/branch/func/line on every included file (confirmed by running npm run test:coverage at revision 418adeb). The slack means a future branch-coverage regression of up to ~3% could land without failing this gate — once #390 (test:unit wired into CI) lands, that slack becomes a silent blind spot in CI itself, not just locally.

Verified the gap is real, not theoretical: temporarily removing the colon-title test case in scripts/add-frontmatter.test.mjs (a regression simulation, reverted before commit) drops branch coverage to 99.09% overall / 97.61% in scripts/ / 95.65% in add-frontmatter.mjs. With the old 97% branches threshold, npm run test:coverage still exits 0 — the regression is invisible. With the tightened 100% threshold in this PR, the same run exits 1 and reports Coverage for branches (99.09%) does not meet global threshold (100%).

Adds scripts/coverage-thresholds.test.mjs, a small regression test that reads package.json and asserts all four c8 threshold flags equal 100, so a future PR that loosens the gate again fails test:unit instead of merging silently. No production code changed.

Related Issue

Refs #390 (needs-human: that issue's fix requires a .github/workflows/ change this lane's contributor-tier token cannot push; this PR is a complementary, pushable hardening of the coverage gate itself and does not close #390)

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-4-6 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[netlify]

✅ Deploy Preview for cncf-techdocs ready!

Name	Link
🔨 Latest commit	eca24f8
🔍 Latest deploy log	https://app.netlify.com/projects/cncf-techdocs/deploys/6af7897e0d5bcdd410b8378b
😎 Deploy Preview	https://deploy-preview-411--cncf-techdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

eca24f8

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head eca24f8352b2) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Verified this locally at head eca24f8 — the change is correct and the PR body's claims check out.

What I ran:

• npm run test:coverage at the PR head: coverage is genuinely 100% stmts/branch/func/line on every included file, and the tightened --lines 100 --statements 100 --branches 100 --functions 100 gate passes (c8 table confirms, exit 0 for the coverage check itself).
• The new guard test scripts/coverage-thresholds.test.mjs is picked up by the existing scripts/**/*.test.mjs glob in test:unit and passes; its regex correctly extracts each of the four c8 flags from package.json (package.json:39).

One thing a maintainer should know before merging: test:unit currently exits 1 at this head, but the single failure is scripts/typecheck.test.mjs:11 hitting a pre-existing TS2339 in lib/docusaurusConfigPreprocessor.test.mts:15 — I reproduced the same failure on base commit 418adeb with this PR's diff absent, so it is base-branch breakage, not introduced here. Open PR #408 fixes exactly that regression; merging #408 first (or rebasing this afterward) makes this PR's suite fully green.

No production code changes, two-file diff, claims independently reproduced. Looks correct to me — ordinary sequencing after #408, nothing here needs a human decision beyond the normal merge.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88