[mrbobbytables]

Follow-up to ADR 0008 (#1848). Each change closes a path through which the agent fleet kept producing out-of-remit work after the ADR landed.

Remit: maintainer-filed work (ADR 0008 follow-up).

1. Mutation workflow: no scheduled full-tree run

.github/workflows/mutation.yml loses its schedule trigger. The only output of the weekly run was the list of surviving mutants, which the fleet read as a work queue (most of the quality agent's ~60 recent issues trace back to it). The PR lane is unchanged: it still mutates only the files a PR touches and fails below the break score of 90. The full-tree report remains available on request through "Run workflow". stryker.config.mjs, CONTRIBUTING.md and tests/stryker-config.test.mjs stop describing a weekly run; breakThreshold itself is untouched.

2. AGENTS.md: stop restating metrics in the agent entry point

The Build & Test section no longer lists the coverage thresholds, the "lower a ceiling when the gate reports headroom" rule, or "kill the survivors it lists". Each of those sentences was a standing invitation to move a metric. The bullets now point at CONTRIBUTING.md and state that the gates are frozen regression gates, not targets. AGENTS.md leaves DOCS_STATING_THRESHOLDS in tests/docs-threshold-parity.test.mjs since it no longer states the numbers (the test's own comment asks for exactly this). The Remit bullet under Guidelines now tells agents to state the effect as a Remit: line in the PR description.

The roadmap GitHub label has been deleted (no remaining workflow or script referenced it).

3. PR queue hygiene: Remit check

scripts/pr-queue-hygiene.mjs gains a remit check that runs in the same pass as the conflict check:

• An agent-authored PR (user.type === 'Bot' and login in AGENT_AUTHORS, default hivecommons-hive[bot]) whose body has no line of the form Remit: <effect> is labelled needs-human and gets one comment naming the five effects ADR 0008 recognises.
• The comment carries a hidden marker trusted under the same MARKER_AUTHORS rule as the conflict markers, so it is posted once per PR and a spoofed copy does not suppress it.
• The job does not judge the claim and never removes the label; a maintainer clears it or closes the PR under the ADR.
• DRY_RUN is respected; both writes go through gh pr edit / gh pr comment, which the existing curl fallback already supports.
• Held PRs are skipped as before.

GOVERNANCE.md documents the rule beside the conflict check. New unit tests cover the regex (plain, bold, upper-case, indented; missing, empty, mid-sentence), author matching, nag detection, and every main() branch (label/nag present or absent, DRY_RUN, human author, compliant agent, custom AGENT_AUTHORS, conflicting plus missing remit).

Validation

• npm run test:unit:coverage:check passes (all source-region floors met).
• npm run check:duplication at the 245 ceiling (new tests share a runRemit helper so they add no clones).
• eslint, knip, cspell, prettier and markdownlint clean on the changed files.

This touches two workflow files and GOVERNANCE.md, so it takes the independent-review path rather than any low-risk class.

[netlify]

✅ Deploy Preview for endusers ready!

Name	Link
🔨 Latest commit	cc873fb
🔍 Latest deploy log	https://app.netlify.com/projects/endusers/deploys/6adbae385071f787f7becfad
😎 Deploy Preview	https://deploy-preview-1850--endusers.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

cc873fb

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @mrbobbytables, head cc873fb47d8a) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 3 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/mutation.yml
  • .github/workflows/pr-queue-hygiene.yml
  • GOVERNANCE.md

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.