[JacobStephens2]

Summary

Spec #626 changes the security-fix publishing flow so a single public fix is staged as text, validated before anything exists, and created by thirdshift — the publishing session keeps no independent public-issue path.

publish (single public fix)
  session stages "Proposed public issue: Title: / Body:" (never gh issue create)  #627
  sweep issues created in the session window -> close leak + fail loudly           #629
  validate staged title+body before any public issue exists                         #628
  thirdshift creates the needs-triage issue from the staged text                   #627

Private fixes still reuse the finding's own issue; spec-size fixes still publish themselves (open #638).

Closes #626

Evidence

• Before: the Spec reviewer's probe (valid staged text plus a session side-effect gh issue create carrying private write-up text) reported success with two public issues:
  {"8":"Private candidate write-up. ...", "9":"Reject oversized input. ..."} — the leak was undetected.
  After: kept test a_session_side_effect_public_issue_fails_the_fix_and_is_closed passes — exit 1 naming #8, issue 8 closed, no issue 9, no PRs, one publishing session.
• Full gate: cargo test exit 0 (security_run 91/91, security_review 22/22), cargo fmt --check clean, cargo clippy --all-targets -- -D warnings clean.

Merge Danger

Door: two-way — revert restores the prompt-only enforcement; no data migration. A leak closed by the sweep stays closed with its explanatory comment.

Blast Radius: single-public security-fix publishing. Behaviour change is fail-closed: a session that creates a side-effect public issue now fails the run instead of succeeding silently. Test-only change to the fake gh issue list (unlabelled list matches all) is additive.

Unaddressed findings

Standards

None — the two judgement-call observations (justified Middle Man on create_issue, harmless unreachable match arm) were agreed keep-as-is; neither claims wrong behaviour.

Spec

1. Spec-size fixes still self-publish (Ticket Remove independent public-issue creation from the publishing session #629's "all public writes" vs. the kept session-created spec path, src/security/fixing.rs else-branch; prompt: "A spec still publishes its issues itself, as before"). Declined in this review: the staged-spec format and prompt contract need Spec design first. Covered by open needs-triage #638, so no new issue filed.
2. Dead session-created single arm (src/security/fixing.rs:120, FixSize::Single => prompt::SECURITY_FIX_LINE): statically unreachable, kept only for match exhaustiveness; revisit when staged specs land. Declined — structural reading, no behaviour wrong, so no run applies.

Security

None — the security review of this change (merge base 04c8077) found no introduced finding. Checked the new single-public path end to end: staged text is validated before anything is created, session-window issues are closed with a loud failure, the created issue is re-validated, failure messages carry only issue numbers, and the create_issue split plus the fake-gh change are behaviour-identical / test-only. Pre-existing gaps found during the review were recorded out of band for a later Security run, not fixed here.

Review-unread changed file: tests/fakes/gh.rs (added by the review fix, after the reviewers ran; unlabelled gh issue list support, additive only).

Security review outcome

No unaddressed introduced findings.

Tickets

• Stage proposed public issue text for validation before creation #627 landed with Stage proposed public issue text for validation before creation #632
• Validate staged public text before any public creation #628 landed with Validate staged public text before any public creation #635
• Remove independent public-issue creation from the publishing session #629 landed with Remove independent public-issue creation from the publishing session #639

Built with muse · default model · default effort