[hivecommons-hive]

Test Improvement

Adds __tests__/utils/ownersGroupPagination.test.ts, which reads an OWNERS @codertocat/maintainers group through the real octokit.paginate against msw Link headers (the existing group tests in __tests__/utils/owners.test.ts stub paginate; __tests__/bundle/ownersGroups.test.ts serves a single page). It pins expandGroups (src/utils/owners.ts:150-165) and the /approve outcome through assertAuthorizedByOwnersOrMembership:

• the paginator follows Link to page two, so a member listed only there is an approver (and both pages are requested with per_page=100);
• a page-one member is an approver once every page is read, with no warning;
• when page two answers 500, the whole group contributes nobody: the page-one member is denied (dave is not an approver for any changed file), exactly one warning is emitted (OWNERS: could not read the members of @codertocat/maintainers: HttpError: Server Error), and both pages were requested — i.e. the read fails closed rather than trusting the members fetched so far;
• that denial does not fall back to organization membership (no GET /orgs/{org}/members/{login} is made; the unhandled-request guard would reject one).

Evidence at main e3119ad: npm run test:coverage (99.92 / 99.35 / 100 / 99.91) and npm run test:coverage:e2e (100 / 99.46 / 100 / 100) both already hit owners.ts:160-162, so this is a behavioural contract, not a line-coverage change — per #554's "judge tests by behavior" section.

Related Issue

Refs #554 — ticks only the "OWNERS pagination failure: fail a subsequent membership page and assert the warning and fail-closed behavior" box of the P2 cross-request section. Decision taken by hive: the scenario is pinned at the unit layer with a real Octokit rather than in __tests__/bundle/, because the bundle variant needs the fakeGithub response-header support that #555 adds and that file is occupied ground until #555 merges. The tracker's other boxes (paginated OWNERS/timeline in #555, boundaries in #558, successive sweeps in #559, scheduling outage recovery, and the P1 CI/release/harness sections) stay open; the issue states a single test PR must not close it.

Disjoint from the open hold-gated PRs: touches only the new file; no change to fakeGithub.ts, ownersGroups.test.ts, blunderbussDelay*.test.ts, sweep*.test.ts, tide.test.ts, auth.ts, or config.ts.

Tests

• npx vitest run __tests__/utils/ownersGroupPagination.test.ts — 4 passed
• npx eslint __tests__/utils/ownersGroupPagination.test.ts — clean

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 requested_by=@mrbobbytables

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 96cfcd8

— hive: agent=quality backend=copilot model=claude-fable-5.1