[JacobStephens2]

Summary

Security runs record findings as private issues when the advisory API returns 404 and repository metadata confirms the repository is private.

 record(Security finding)
   advisory API available -> draft advisory
+  advisory API 404 + private repository -> issue
+    labels: security-finding, needs-triage
+    body: same as the draft advisory description
   existing fingerprint in any state -> no duplicate

Missing labels receive descriptions; existing labels remain unchanged. Public repositories continue to receive draft advisories. Non-404 failures and a public repository's 404 fail without creating finding issues.

Closes #540

Evidence

• Before: cargo test --test security_run a_private_repository_records_each_finding_as_a_labelled_issue_with_the_advisory_body -- --exact failed because the Security run stopped at gh: Not Found (HTTP 404).
  After: The same test passes and checks the exact bodies and both labels on two private finding issues.
• cargo test --test security_run: 17 passed, covering repeat audits, closed findings after triage, missing and existing labels, public advisories, and failure handling.
• cargo test --bin thirdshift security::tests: 5 passed.
• cargo test: 1,525 passed, 0 failed, 1 existing ignored test.
• cargo check --all-targets, cargo fmt --check, and cargo clippy --all-targets -- -D warnings pass.

Test seams

• Existing end-to-end scenario harness: real binary and git, fake GitHub and agent CLIs; observable records, labels and outcomes.
• Existing Pass seam's in-memory adapter: prerequisite order and fingerprint deduplication.

Review coverage

The independent Standards and Spec reviews each read all six changed files against issue-427, pinned at 8b775669cb8bbc1bbd815428337ac587477d2151. Standards: 0 findings; Spec: 0 findings. Changed files left unread by either review: none.

Both reports, including each axis's final files-read list, are saved in .thirdshift-review-UF4Iav/standards.md and .thirdshift-review-UF4Iav/spec.md.

Unaddressed findings

Standards

None.

Spec

None.

Merge Danger

Door: two-way

Reverting restores advisory-only recording. Existing finding issues remain available for the Day shift.

Blast Radius: Security

Changes Security finding storage and the test GitHub adapter. No migration is needed.

Built with codex · gpt-6.1-sol · xhigh