[JacobStephens2]

Summary

Staged single-public Security fix text is now validated before thirdshift creates the public issue. A rejection blocks creation, so no public issue can leak private write-up text.

 staged (title, body)
-  create public issue, then check text
+  check_public_fix_text(title + body)
+  if rejected: return error, create nothing
+  if accepted: create public issue (needs-triage)

Evidence

• Before: a staged proposal copying private write-up text (or omitting the private record link) was created as a public issue first and only failed afterwards in check_issue_text.
  After: the same proposals fail before creation — no public issue, no PR:
  • cargo test --test security_run a_staged_proposal → 2 passed (a_staged_proposal_is_created_by_thirdshift_not_the_session, a_staged_proposal_is_validated_before_any_public_issue_is_created)
  • cargo test --test security_run → 89 passed, 0 failed
  • cargo test --bin thirdshift security::fixing → 2 passed
  • cargo clippy --all-targets and cargo fmt --check → clean

Merge Danger

Door: two-way

Small validation gate on the staged single-public path; rolling it back restores create-then-check.

Blast Radius: security-fix-publishing

Only the staged single-public path changes (validate-then-create via the existing record.check_public_fix_text). The session-created and Spec paths are untouched.

Unaddressed findings

Standards

• Duplicated Code (judgement call, dismissed, no action): format!("{title}\n\n{body}") at src/security/fixing.rs:89 repeats the identical join in GitHub::security_fix_text at src/github/advisories.rs:488. Plan decision: leave inline — a shared join_fix_text helper for one format string adds indirection without leverage (deletion test favours inline). Refuted by: cargo test --test security_run → 89 passed, 0 failed; no behaviour is wrong and no strutted abstraction was added.

Spec

• None. The Spec reviewer found no missing, extra, or wrong behaviour.

No finding was declined for Spec or Day-shift decision, so no needs-triage issue was filed.

Review coverage: both axes read both changed files (src/security/fixing.rs, tests/security_run.rs). No changed file was left unread by the review.

Closes #628

Built with muse · default model · default effort