[JacobStephens2]

Summary

Security runs choose their Harness in order, with Model and Effort from its own section:

command harness
  else security.harness
  else harness.default
  else Claude Code

Security session purpose is retained on Resume
Codex security session + Resume
  agents.max_concurrent_threads_per_session = 8
  fresh sub-agents: fork_turns: "none"

Closes #546

Evidence

• Before: cargo test --test security_run the_security_harness_overrides_the_default_and_uses_its_own_model_and_effort -- --exact failed with unknown section [security].
  After: passes; observes Codex's own Model and Effort.

• Before: cargo test --test security_run codex_security_sessions_and_their_resumes_raise_the_thread_cap_and_request_fresh_sub_agents -- --exact failed with missing Security thread cap.
  After: passes for both the original session and its Resume, including fresh sub-agent instructions.

• cargo test --test security_run: 18 passed; cargo test --test codex_sessions: 13 passed.

• Full suite: cargo nextest run --test-threads 8 --no-fail-fast — 1,527 passed, 1 existing ignored test skipped (all 40 binaries).

• cargo check --all-targets, cargo fmt --check, and cargo clippy --all-targets -- -D warnings: passed.

• The complete-config Setup regression (cargo test --bin thirdshift setup::tests::on_a_terminal_pressing_enter_throughout_keeps_an_existing_user_config -- --exact) failed after adding the setting because the old fixture lacked it; passes after updating the fixture.

• The Setup section inventory (cargo test --test setup with_no_terminal_and_no_user_config_setup_writes_the_defaults -- --exact) failed because it omitted [security]; passes with the updated inventory and the blank Harness assertion.

Testing seams: the existing end-to-end scenario harness: real binary and Git, fake GitHub and agent CLIs recording their prompts and arguments. Covers Harness precedence, Model/Effort selection, blank/missing settings, invalid settings, Codex Security sessions and Resumes, Claude sessions, and ordinary Codex Runs. The existing Setup interaction double also verifies that a complete User config retains its Security setting.

Unaddressed findings

Standards

None. The single P3 maintainability finding (Security policy depended on the log-label prefix) was accepted and resolved by explicit session::Purpose, retained on Resume; the Standards follow-up confirmed the fix.

Spec

None. The initial and coverage-closing Spec reviews reported no findings.

Changed files left unread by review: src/setup.rs and tests/setup.rs under both Standards and Spec. After their single coverage-closing follow-up, the complete-config fixture gained security.harness = "codex" and the Setup section-list expectation gained [security] plus its blank-Harness assertion. Both existing regressions failed before their fixture updates and passed afterward. Both reviewers covered the other 14 changed files.

Review fixed point: issue-427 pinned at 8b775669cb8bbc1bbd815428337ac587477d2151. Standards: 1 finding addressed, 0 remaining. Spec: 0 findings. No behavior-wrong findings were raised.

Merge Danger

Door: two-way

Configuration and launch changes are reversible; no migration or stored-data change.

Blast Radius: Sessions

Security runs can use a separate configured Harness. Codex security sessions and their Resumes use eight thread slots and request independent verifiers.

Built with codex · gpt-6.1-sol · xhigh