[hivecommons-hive]

Description

Pins five behaviours of src/utils/owners.ts that a single-operator mutation probe showed the suite did not assert, although the file is 100 % line-covered in both the unit and the bundle e2e run. Tests only; no src/ or dist/ change.

Files / functions claimed: __tests__/utils/owners.test.ts (parseGroup, expandGroups), __tests__/utils/ownersAuth.test.ts (loadOwnersTree → decode, probeOwners), __tests__/utils/repoHasOwners.test.ts (defaultBranch). Disjoint from the open held PRs #510–#524 (auth getErrorDetails, contributing docs, remove, labelMatch/command, sweep, tide, requireMatchingLabel, approve, trigger).

Probe

25 mutants hand-applied to src/utils/owners.ts on main @ 88241f4, each run against the 31 unit suites that import or drive the file (npx vitest run over __tests__/utils/{owners,ownersAuth,repoHasOwners,pullRequestOwners,mergeGate,auth}.test.ts and the plugin/command suites that load OWNERS — 893 tests per mutant). 20 killed (ownersDir keeping its trailing slash killed by an infinite directory walk), 5 survived:

mutant	new test (fails on the mutant)
owners.ts:99 parseGroup [^/\s]+ → [^\s]+	parseGroup › is undefined for @myorg/a/b (a third path segment); expandGroups › drops an @ entry … now asserts the @myorg/a/b diagnostic too
owners.ts:283 decode drop || !file.encoding	assertAuthorizedByOwnersOrMembership on a pull request › rejects an OWNERS blob that comes back without an encoding
owners.ts:322 loadOwnersTree drop entry.type === 'blob'	… › ignores a directory named OWNERS in the tree listing and never fetches it as a blob
owners.ts:381 probeOwners hasOwners: owners.size > 0 → true	… › falls back to membership when a truncated tree probes every ancestor and finds no OWNERS
owners.ts:468 defaultBranch drop fromPayload !== ''	repoHasOwners › reads the default branch from the api when the payload names an empty default_branch

The parseGroup table also covers a plain login, @bob, an empty org, an empty slug, and whitespace in either part, since the exported function had no direct test.

Related Issue

None open for this finding: hive-open-issue consolidated both attempts to file it into unrelated issues (#517, tide.ts; #507, auth.ts BRDA) on title shape. This PR body is the record of the finding; merging it leaves nothing to track.

Testing

• npx vitest run __tests__/utils/owners.test.ts __tests__/utils/ownersAuth.test.ts __tests__/utils/repoHasOwners.test.ts — 3 files / 81 tests pass on this branch
• Each of the five mutants re-applied to src/utils/owners.ts on this branch fails exactly the test named in the table above (verified by re-running the three suites per mutant)
• npx eslint __tests__/utils/ — clean

Checklist

• Commits are signed off (DCO)
• No src/ change, so dist/ is unchanged and no npm run pack is needed
• No new dependencies
• Self-review done

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[github-actions]

Please add a kind label with /kind feature, /kind failing-test or /kind cleanup.

[mrbobbytables]

Copilot review performed under the maintainer's explicit authorization to update, review, release reviewed holds, and merge eligible PRs in this cleanup.

The OWNERS cases distinguish malformed group segments, directory versus blob entries, missing encoding, empty probe results, and an empty default-branch fallback using observable API requests.

Verified successful build-test, e2e-coverage and DCO results on head 9cd2219. Any folded issue findings remain assigned to the canonical destinations in the updated scope tables.