🌱 refactor(cmd/hive): extract runEvalCycle's ioscan canary gate behind a seam (#7232)

[kubestellar-hive]

Refactor

Refs #7232 — one increment of its step 1 (runEvalCycle seams); deliberately non-closing: runEvalCycle's remaining collaborators and all of main() are still to extract, per the issue's own sequencing.

Claimed ground: src/cmd/hive/eval_cycle_seams.go (new gateAdvisoryFindings + advisoryIngestDeps), the advisory-findings ingestion block of runEvalCycle in src/cmd/hive/main.go (~L6434), and new test file src/cmd/hive/eval_cycle_advisory_gate_7232_test.go. Disjoint from hold PR #7312 (dashboard fleet-report files only).

What moved

runEvalCycle's ioscan canary gate — the decision that a leaked canary token in an advisory finding's report text is always recorded (audit entry + critical bead) and withholds the finding from persistence only under ioscan.fail_closed — was inline against the process-global canary registry, a live dashboard, and real bead stores, so none of it was reachable by tests. It now follows the exact split of the earlier #7232 kick-dispatch seam: decisions in gateAdvisoryFindings (eval_cycle_seams.go), effects injected at the call site in main.go, order preserved verbatim.

Behavior pinned (mutation-tested, 4/4 killed)

• canaries disabled ⇒ nil scanner: every finding passes, no effect fires — configuration alone never blocks
• fail-closed withholds only the leaking finding; clean batch-mates still persist, in order
• fail-open records the leak (audit + bead) but keeps the finding — evidence without suppression
• audit entry names canary.leak, the leak's agent, and the advisory-finding source exactly
• scan text is title\ndetail\nfile\ntype\nseverity — dropping any field fails the test

Verification

• go vet ./cmd/hive/ clean; go test ./cmd/hive/ -count=1 passes (44.3% → 44.6%, gateAdvisoryFindings at 100%)
• Mutations killed: leak-always-blocks, dropped bead effect, dropped Detail from scan text, scan gated on failClosed

---

Filed by scanner agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=scanner backend=copilot model=claude-fable-5 copilot=1.0.78

[kubestellar-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "scanner" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "scanner". If this is an outreach PR, a human must review it and remove the label.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Changelog: this PR changes code but carries no changelog entry
(no changelog.d/ fragment and no CHANGELOG.md edit).

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a fragment file changelog.d/<category>-<pr-or-slug>.md
containing exactly your entry (see changelog.d/README.md; the
category is one of added/changed/deprecated/fixed/security). Please
do not append to CHANGELOG.md's ## Unreleased directly — that
shared section is the merge-conflict generator fragments replaced
(#5675). If it is a refactor, a test-only change, or dependency
churn, no entry is needed and you can ignore this.

This is a reminder, not a gate; it never blocks a merge.

[clubanderson]

Canary gate seam extraction is a pure move with the test seam threaded through — behavior pinned by the new table tests. LGTM.

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: 48a10c5c8eb0bc9451096a1735503e77946c931f

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback