[JacobStephens2]

Summary

Security fix dispatches retain advisory metadata before launch, so Command details keeps its links even when the fix fails or is interrupted.

Security run
  dispatch(finding)
    Ticket run record: security_fix_findings[]
      Command details: Fixes advisory → title · severity
  Command details: Fix dispatched for advisory → title · severity

Seams under test: the secure security-fix and show --json CLI commands; the Console's /peek HTTP response for retained Command records.

Evidence

• Before: cargo test --test security_run fixing_selects_the_most_severe_record_then_dispatches_one_ticket_before_auditing -- --exact failed: the advisory list was null.
  After: passes with the selected advisory's URL, title and severity retained through completion. status_tracks_security_stages_and_nests_the_dispatched_fix also passes while the dispatched fix is still live.
• Before: cargo test --test console security_fixes::security_fix_peek_links_advisories_and_marks_the_parent_dispatch_for_every_ending -- --exact failed on the missing linked advisory line.
  After: cargo test --test console security_fixes:: passes both tests: multiple advisories, severity/“ungraded”, escaped titles, parent marking, failed/interrupted/incomplete records, and legacy/ordinary records without backfill.
• cargo check and cargo fmt --check pass.
• scripts/affected-tests main passed: all 51 site tests and the full Rust suite (cargo test, since nextest was unavailable). /usr/bin/time -p scripts/affected-tests main measured 2289.34 seconds (38m 9s) wall time, including compilation; Rust test compilation took 2m 58s.
• CI passed on 4219195b, including Linux, the macOS gate, Console browser checks and site checks.

Both independent review axes read all 14 changed files against main: Standards 0 findings; Spec 0 findings. Unread changed files: none. Generated-output exclusions: none.

Merge Danger

Door: two-way

The additive list defaults to empty and is omitted for old or unrelated records; no migration or backfill.

Blast Radius: Console

Command-record metadata, CLI JSON details, and advisory links in the details pane.

Unaddressed findings

• Standards: none.
• Spec: none.
• Security: none.

Closes #1436

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh

Security review outcome

No unaddressed introduced findings.