[JacobStephens2]

Summary

 Security fix publication: pre-creation and post-linking sweeps
-close every issue created during the session window
+check each issue's title and body with the staged public-text rule
+close rejected issues immediately and fail the Security run
+leave passing issues open and name them in the Activity log

The post-linking sweep still skips the staged Spec and Tickets. The existing check still requires a private-record link and rejects copied private write-up text. Updated the guide, ADR 0015 and generated manual.

Closes #1324

Evidence

• Before: cargo test --bin thirdshift public_text_passing_window_issues_stay_open_in_both_sweeps failed because passing issue Continue an existing Issue branch #20 was closed.
  After: all 22 publication tests passed in the final head's unit suite.
• Before: cargo test --test security_run passing_window_issues_stay_open_and_are_named_in_activity_in_both_sweeps failed with zero Activity entries.
  After: it passed for single fixes and Specs, checking open state, successful dispatch and one entry per sweep.
• Review regression: cargo test --bin thirdshift rejected_window_issue_is_closed_before_a_later_text_read_fails failed as the Spec reviewer predicted. Closing each rejected issue before reading the next fixed it; the retained test passes.
• cargo check, formatting and manual regeneration checks passed. Full Linux CI passed on the exact final head 3766e88b (16m10s). Site, Console, macOS and both platform builds are green too.
• Local scripts/affected-tests main ran for 1102.87s, including the warm-cache Cargo build phase: 50 site checks, 1,492 unit tests and all 123 Security run tests passed. It stopped on systemd 252 warning about this host's unrelated snapd.service. SYSTEMD_LOG_LEVEL=err cargo test --test site_deploy the_systemd_units_verify passed. Successful CI on the exact head covers the remaining tests; no full suite was repeated afterward. Test processes selected Python 3.12 and disabled Git tag signing to avoid host defaults; no repository or global settings changed.

Test seams: the existing Security publication interface with its scripted GitHub adapter; the thirdshift secure security-fix CLI with fake external tools and its on-disk Activity log.

Review coverage

Independent Standards and Spec reviews used git diff main...HEAD, with main pinned at 2944d0425bcb33829549aa4eedbcf81281d8d209. Both reviewers read all nine changed files, including generated HTML, and reviewed the corrective hunks. No changed files were left unread; no generated output was excluded.

Standards: 0 findings. Spec: 1 P2 finding, reproduced and fixed in 3766e88b. Reports and final files-read lists are retained with the Session trace as standards.md and spec.md.

Unaddressed findings

Standards

None.

Spec

None.

Merge Danger

Door: two-way

The change is reversible; no storage format or migration changes.

Blast Radius: publication

Only Security fix publication's public-issue sweeps and their Activity entries change. The accepted public-text rule retains its existing limits, including paraphrases it cannot detect.

Built with codex · gpt-6.1-sol · high