[JacobStephens2]

Summary

Single public fixes no longer accept a session-created Ticket URL. Publishing fails closed unless the session stages its proposed title and body, which thirdshift validates before creating anything:

 Sessions::within(security-fix-publishing)
-  staged proposal? create from it : accept session URL
+  single public: staged proposal or bail("did not stage its proposed public issue text")
+  spec / private: session-created URL path, as before

Seams under test: the security-fix publishing boundary (publishing session final message → thirdshift-validated GitHub issue creation), exercised through the secure security-fix scenario harness in tests/security_run.rs.

Evidence

• Before: cargo test --test security_run with the new gate: 14 tests using the retired session-created single path failed with did not stage its proposed public issue text.
  After: cargo test --test security_run → 90 passed, 0 failed; cargo fmt --check and cargo clippy --all-targets clean. New regression test a_session_created_ticket_url_is_rejected_for_a_public_single_fix proves a bare session URL creates nothing (bodies["8"] absent, no PRs).

Merge Danger

Door: two-way (test-only plus one narrowed branch; revert restores the fallback)

Blast Radius: narrow (security-fix publishing for single public fixes; spec and private paths untouched)

Unaddressed findings

Standards

• Duplicated staged-proposal printf shape repeated inline instead of reusing stage_fix() (tests/security_run.rs, new title-copy/invalid/PoC tests). Declined: explicit literals carry the exact rejected text; a stage_fix(…).replace(…) chain through shell escaping is no clearer. Low-stakes judgement call; no behaviour claim, so no run applies.

Spec

• A1 — spec-size public writes still use the session-created path (src/security/fixing.rs:78, src/prompt.rs:371 "A spec still publishes its issues itself, as before"). Declined for this change per plan decision: the Security fix: validate staged public text before public issue creation #626 breakdown defers staged specs ("until staged specs land"). Follow-up tracked in #638 (needs-triage).
• C1 — a disobedient session can still leak via direct gh issue create; only thirdshift acceptance was removed. Verified by running the reviewer's test verbatim: result.code was Some(1) but bodies["8"] contained the private write-up text. Declined: harness-level restriction vs. orphan cleanup (deleting user-visible issues is a one-way door) is a Spec/Day-shift call. Tracked in #637 (needs-triage).

Changed files the review left unread: none (both axes read src/security/fixing.rs and tests/security_run.rs; full reports in .thirdshift-review-bvWi9d/standards.md and spec.md).

Closes #629

Built with muse · default model · default effort