[JacobStephens2]

Summary

A failed Security fix keeps its Claim and pauses Fencing until the Day shift closes its issue. Pickup excludes Security fixes even when GitHub prevented Claim creation. A Security run that leaves a reproduced finding unfixed with permission undecided offers both ways to allow fixing on stderr and in its Run notification.

Security run
  Ready issue → yield
  open failed or unfinished fix → skip; record Activity log reason
  reproduced finding + fixing allowed → dispatch one fix
    record pending before dispatch
    record succeeded or failed afterward; preserve private edits
  audit + reproduction + fixing undecided → offer security-fix and [security].fix

Failed fix → keep Claim; exclude from Pickup
Closed fix issue → allow Security runs again

The pending record keeps Fencing paused if recording the ending fails. Successful fixes awaiting review allow further Security work. The README documents the Fencing cron command, its yield to work the Day shift shaped, and its pauses for failed fixes and findings awaiting triage. Help and domain documentation describe the same behavior.

Closes #544

Evidence

• Before: A failed fix without a push released its Claim; later Security runs had no failed-fix gate. Pickup could take a fix whose Claim could not be made.
  After: a_failed_fix_keeps_its_claim_and_pauses_security_and_pickup_until_closed covers public/private records, failures before/after a push, the skip reason, no notification on a skip, and resumption after closure. review_failed_fix_before_claim_is_not_retried_by_pickup covers the Claim-creation failure.
• Before: A rejected ending update could erase the failed-fix pause, and updating from the original description could lose private edits.
  After: review_failed_fix_marker_write_error_still_pauses_security, a_failed_fix_still_pauses_after_its_failure_record_patch_is_rejected, and a_failed_fix_preserves_private_edits_made_during_its_run_and_still_pauses retain coverage of those cases. a_successful_fix_awaiting_review_does_not_pause_allowed_security_work protects the successful path.
• Before: A report-only run did not offer fixing.
  After: an_undecided_run_offers_both_ways_to_allow_a_reproduced_fix checks the command and setting in stderr and the notification, and suppresses them for no-security-fix, fix = false, or an unreproduced finding.
• Validation: cargo check --all-targets, cargo fmt --check, and cargo clippy --all-targets -- -D warnings passed. cargo test --test security_run passed all 79 tests. The final cargo test --no-fail-fast passed: 1,603 passed, 0 failed, 1 ignored across 43 test targets.

Test seams

• End-to-end scenario harness: real binary and Git, fake GitHub and Harness; stderr, Activity log, and Run notification.
• Pass seam: Security gate order and choice of work through its in-memory adapter.

Review coverage

Independent Standards and Spec reviews used git diff issue-427...HEAD, with issue-427 pinned to f54c0148560d202ba8ea2ec60b20813206016f23. Both axes read all 12 changed files and reported zero findings. No coverage follow-up was needed. Changed files left unread: none under either axis.

Unaddressed findings

Standards

None.

Spec

None.

Merge Danger

Door: two-way

The code can be reverted; it adds lifecycle lines to existing private records without a data migration.

Blast Radius: Scheduling

Security-fix Claim retention, Security/Pickup scheduling, and the fixing offer. An unfinished dispatch stays paused if its ending cannot be recorded, until the Day shift closes its fix issue.

Built with codex · gpt-6.1-sol · xhigh