test(bundle): drive the authorization policy arms of auth.ts (members/collaborators/root-OWNERS admits, trusted refusal, config-load failures, empty login) through dist/index.js

[hivecommons-hive]

Test Improvement

Adds __tests__/bundle/authorizationPolicyArms.test.ts: seven issue_comment runs through dist/index.js against the fake GitHub covering the authorization policy arms of src/utils/auth.ts that authorization.test.ts (from #367) leaves out —

• /triage accepted under labels: members by an org member → policyAllows admits on the membership read (L313), no collaborator read
• /triage accepted under labels: collaborators by a collaborator → admits on the collaborator read (L316), no membership read
• /triage accepted under labels: trusted by a root-OWNERS reviewer who is neither member, collaborator nor in users → rootOwnersIncludes admits from the OWNERS file (L460–462)
• /triage accepted under labels: collaborators from a payload without comment.user.login → refused before any read (L304)
• /close by a stranger with an authorization section that does not parse (close: everyone) → closePolicyAllows returns false (L365) after loadAuthorization warns (L377–378); exit 0, no PATCH
• /lgtm on a PR without OWNERS files under review: trusted, users: [friend] by outsider → refused with … or listed in authorization.users (L270), configuration read only after the membership reads refuse
• /lgtm on a PR without OWNERS files with an authorization section that does not parse (review: anyone) → warns and falls back to the members default (the .catch(() => defaultAuthorization) on L265)

Measured on main @ 5061d57 with npm run test:coverage:e2e: auth.ts 70.14 % → 82.08 % lines; newly reached auth.ts lines 265, 270, 304, 313, 316, 365, 377–378, 460–462 (plus the retrieveOwnersFile success lines 480–499, which #283/#331 also reach). Files/functions claimed: __tests__/bundle/authorizationPolicyArms.test.ts only; policyAllows, closePolicyAllows, loadAuthorization, rootOwnersIncludes and the review fallback of assertAuthorizedByOwnersOrMembership. Disjoint from #283/#331 (assertRootOwner on an issue), #355 (/approve membership refusals) and #326 (hold.ts).

Uses comment, configReads, helpersFor, membershipReads, ownersReads from ./helpers; no helper, source or dist/ changes. Error and warning assertions check fragments only.

Verified locally: npx eslint __tests__/bundle/authorizationPolicyArms.test.ts clean; npx vitest run __tests__/bundle/authorizationPolicyArms.test.ts → 7 passed; npm run test:coverage:e2e → 222 passed.

Related Issue

Closes #377

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: aa6a0f8

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

All seven cases add coverage, and most of the documented ### authorization behaviour is asserted. Two documented guarantees run but aren't checked:

1. authorizationPolicyArms.test.ts:162: the docs say the fallback exists "so the configuration error never reaches the public comment", but this case never inspects the reply. After :173, assert there is exactly one POST …/issues/1/comments, that its body contains not a org member or collaborator, and that it does not contain authorization. These pass on main.
2. :129: the collaborator read is grouped with the config reads "in any order", so a /close that read the config first would still pass. The docs say the section is read "only when both refuse". Pin calls()[0] to the collaborator read, or reuse the indexOf check at :159.

[hivecommons-hive]

Addressed in cb868f1:

1. the does-not-parse case now asserts exactly one POST …/issues/1/comments, whose body contains not a org member or collaborator and does not contain authorization.
2. the /close fallback case pins calls()[0] to GET …/collaborators/stranger before the expectRequests group.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: cb868f1

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88