[JacobStephens2]

Summary

public fix publishing + Resume
  → selected Harness.security_session
  → remove GitHub token variables; use a fresh empty gh config
  → stage Ticket or Spec text
  → check_public_fix_text
  → thirdshift creates issues and native links
private bigger fix → existing authenticated publishing

The publishing prompt supplies the private record and worktree. The post-session side-effect sweep remains.

Closes #673

Evidence

• Before: cargo test --test security_run public_fix_publishing_cannot_write_github_content_with_any_harness -- --exact failed because the publishing session created an issue.
  After: all 97 Security-run tests pass, covering denied issue/comment/PR/API writes across six Harnesses, valid single/Spec publication, supported publishing Resumes, private bigger fixes and cleanup.
• Full cargo test, cargo check --all-targets, cargo clippy --all-targets -- -D warnings, cargo fmt --check, prompt regeneration and all three site tests pass.

Seams under test

• The thirdshift secure security-fix CLI, with real Git/worktrees and external Harness/GitHub stand-ins, observing public repository state and the delivered PR.

Unaddressed findings

Standards

• P3 possible Repeated Switches, src/session.rs:233 and :320: retain the explicit completion-policy classification and exhaustive launch match for the five Purpose variants. This local plan decision keeps protocol dispatch visible and compiler-checked; a predicate used as a match guard would require a fallback. This is a maintenance judgement, not a behavioral failure.

Spec

• P1 stored credentials remain reachable, src/session.rs:343: the review's exact temporary-fixture reproduction was independently run and failed (exit 101): explicitly unsetting GH_CONFIG_DIR let the same OS user reuse a stored fake credential and edit issue Numbered Issue branches after a merged or closed PR #7. This is not refuted by the passing denial tests. Security fix: run the publishing session without GitHub write authority #673 prescribes removing environmental credentials/using an empty gh config; ADR 0013 prescribes fully trusted sessions with the worktree as their only boundary. The stronger interpretation requires a publishing-only OS isolation boundary and a decision about supplying all six Harnesses' model credentials. The decision is filed as #691, labelled only needs-triage; changing that session boundary is a Spec/Day-shift decision.

Review coverage: both axes read all seven changed files; no changed file was left unread. Full reports, final files-read lists and the retained reproduction are saved in .thirdshift-review-1d5wAY/standards.md and spec.md in the implementation worktree.

Merge Danger

Door: two-way

Reverting restores the previous session launch environment.

Blast Radius: Sessions

Public fix publishing and its Resumes lose automatic GitHub authentication. This does not isolate an unrestricted session from the user's readable credential stores; see the Spec finding above.

Built with codex · gpt-6.1-sol · high