[JacobStephens2]

Summary

- sub-issue number → Spec.sibling(number) → child Run
+ sub-issue IssueUrl → same-repository Ticket → child Run
+ foreign sub-issue → Unready Ticket in the Tickets checklist

Blockers and Ticket standings compare repository plus number. Security fixes reject foreign Spec Tickets before checking or labelling them.

Closes #672

Evidence

• Before: cargo test --bin thirdshift spec_run::tests::a_foreign_sub_issue_is_unready_and_never_starts_a_run -- --exact failed: the Spec reached completion after starting the foreign sub-issue.
  After: the regression passes; local Tickets run and the foreign Ticket remains unready with its full URL in the checklist.

• Before: the Standards reviewer's exact cargo test spec_run::tests::scripted_endings_close_the_started_issue_without_a_foreign_number_collision -- --exact failed: ending a local Run closed the same-numbered foreign Ticket in the test adapter.
  After: that command passes, and the regression is retained.

• Before: the new in-process Security fix validation test failed without the repository guard at its seam.
  After: all eight security::fixing::tests pass; the existing Security fix integration regression remains.

• Affected integration suites: 68 Spec run, 94 Security run, and 60 Pickup tests passed.

• cargo check --all-targets, cargo fmt --check, and cargo clippy --all-targets -- -D warnings passed.

• Full cargo test: 1,752 passed, 0 failed, 2 existing ignored tests across 41 test binaries.

Test seams

• TicketBoard: scheduling, repository collisions, rereads and Tickets checklist.
• Spec run Outside: child Run identity and graph-driven lifecycle.
• GitHub CLI: Ticket and blocker URL selection, parsing and malformed responses.
• Security fix Spec Ticket validation: repository authorization before GitHub checks; command flow through the existing Scenario seam.

Review coverage

Independent Standards and Spec reviewers read all nine changed files and checked the review fixes. No changed files were left unread by either axis.

Unaddressed findings

• Standards: None. Both findings were addressed; the behavioral finding was reproduced with its exact command and fixed with its test retained.
• Spec: None. The missing in-process validation coverage was added and verified.
• Security: Review incomplete. The required comparison git diff 099ad50cb5a0ff3e58e1e77ecb290b8f10874df2...HEAD is empty because the pinned commit equals HEAD. The PR changes nine files against main, whose merge base with HEAD is 6e30e0df4e5ff95e04c544f0d0123f396fb065c0. A corrected pinned merge base is required to review those changes and classify introduced findings. No introduced Security findings were validated, and no proof-of-concept tests or fixes were made in this session.

Merge Danger

Door: two-way

Reverting restores the previous Ticket handling; no migration is involved.

Blast Radius: Tickets

Spec scheduling, dependency reporting and Security fix Spec Ticket validation.

Built with codex · gpt-6.1-sol · high