Repository navigation
The Security review on a Spec PR #551
Description
This was generated by AI during triage.
Parent
What to build
Mode decision (2026-10-09)
Jacob chose guidance for the optional Security review after the #549 trial was graded. Use one session to read the relevant security attack-class guidance and review the change with supporting code; do not run the full six-phase audit or delegate auditors for this review. The separate whole-repository Security audit keeps its full-audit workflow. Existing proof-of-concept, private-record, and Self-merge requirements still apply.
Evidence and limits: trial grading and decision. Guidance was cheaper and faster in this sample; detection accuracy and equivalence between modes remain unmeasured. Detailed grades remain private.
When the Security review is on, a Spec run runs it once on its Spec PR, after the Spec review and before the push and the Repair loop, over the whole Spec branch. A Ticket's Run never runs one. Unaddressed findings, or a refused review, hold the Spec PR's Self-merge the same way they hold a Run's.
Acceptance criteria
- With the review on, a Spec run runs one Security review, after its Spec review, and its Tickets' Runs run none.
- An unaddressed introduced finding, or a refused review, keeps the Spec PR from being merged, leaves it ready for review, and the cause says why.
Activity
JacobStephens2 commentedon Oct 9, 2026
Agent Brief
Category: enhancement
Summary: Apply the chosen guidance Security review once to the whole Spec branch.
Current behavior: Jacob chose guidance after grading #549, resolving this Ticket's mode gate.
Desired behavior: With the review enabled, run one guidance session on the Spec PR after the Spec review and before pushing and the Repair loop. Scope it to the whole Spec branch against its Base branch. Ticket Runs receive no Security review. Apply the same introduced-finding, refusal, and incomplete-review Self-merge hold as a Run.
Key interfaces: Spec review-to-Delivery ordering; Security review enablement and result handling; Ticket Run dispatch.
Acceptance criteria:
Out of scope: Separate reviews for each Ticket, changing the whole-repository audit, and choosing a different Security review mode.
JacobStephens2 commentedon Oct 9, 2026
Closed by #593, merged into issue-427 by a thirdshift Merge run.