[JacobStephens2]

Summary

A Security run with closing allowed now closes the finding its fix merged, after re-running the proof-of-concept test against the merged Base branch:

fix (Security run)
  dispatch SecurityFix
  record ending
  close_after_merge (only when merged + closing allowed)
    recheck_security_fix (PoC in reproduction sandbox)
    close_security_record (advisory: description + state; issue: comment + close)
      or note_security_close_left_open
  Ending::SecurityFix { ended, findings, close }
    stderr + Activity log: "; closed <finding> by <pr>"
    notification: "Closed: <title> by <pr>" / "Close: <title> left open: <reason>"

New words security-close / no-security-close (accepted wherever security-fix is) and [security] close (default false; Setup offers it only when fixing is on). Closing takes effect only when fixing is also allowed; a fix left ready for review closes nothing; a failed close never changes the fix's outcome.

Seams

• Command/config surface: security-close words plus [security] close precedence (args, asks, config, setup tests).
• Private-record protocol: Closed-by line and left-open note behind the fix-link guard (advisories tests).
• GitHub close ops: advisory PATCH, issue comment plus close (fake-backed integration tests).
• Run close gate: Outside recheck/close/note behind InMemory fakes (security run_through tests).
• Reporting: ended line, notification body, activity summary (run_ending and notification tests).

Evidence

• Before: no close path (an advisory stayed draft after its fix merged).
  After: cargo test --test security_run closing - 4 passed (advisory close, issue close, failing gate, setting/word precedence); full gate scripts/affected-tests main green, including cargo clippy --all-targets -- -D warnings, fmt, site docs:check and browser tests.
• Review: Standards found no hard violations (3 no-action smells); Spec found no missing requirements and no scope creep (1 finding declined, see below). Full reports sit beside the session trace.

Merge Danger

Door: two-way. Closing is off by default and inert without fixing, so reverting restores report-only behavior. A wrongly closed finding is API state (advisory state, issue state) recoverable by reopening.

Blast radius: Security runs with closing enabled. Default-off paths behave exactly as before; the new session kind and stage names flow through existing readers.

Review findings

• Standards: no hard violations (3 no-action smells). Spec: nothing missing, no scope creep.
• One Spec finding addressed during review repair: with_left_open_note() now refuses an already closed record (a 'Closed by' line claims the finding is closed, so no later write appends to one), mirroring with_close(); regression test left_open_note_refuses_an_already_closed_record retained. No unaddressed findings; no needs-triage issue.
• Security: one introduced finding, fixed in this branch with regression test github::advisories::tests::close_inputs_cannot_forge_a_closed_record (the PoC failed before the fix: a multi-line left-open reason carrying the close marker flipped an open finding to closed, hiding it from triage, and a multi-line pull request URL was recorded verbatim; reasons are now flattened to one line and invalid URLs refused). Unaddressed findings: none.

The review left no changed file unread.

Closes #1073

Built with muse · default model · default effort

Unaddressed findings

Security review outcome

No unaddressed introduced findings.