[JacobStephens2]

Summary

Trusted account = repository owner | owning organization member | collaborator

issue author + latest ready-for-agent label actor
  Ready issue search → pass over failures, naming the check
  Spec Ticket start → error before starting its Run
  direct Issue URL  → warning, then continue

Define the fixed rule in CONTEXT.md and share it across Pickup, Architect, Security and Spec runs. Preserve full Ticket identities through the trust gate and child dispatch. Read all event pages; public read access alone does not establish collaborator membership.

Closes #667

Evidence

The following CLI regressions failed before their fixes and passed afterward:

Regression	Before	After
Pickup after an outsider reapplies ready-for-agent	Starts the agent	Passes over the issue with the failed check
Spec Ticket written by an untrusted author	Starts and lands Tickets	Stops before starting the Ticket's Run
Direct Issue URL with an untrusted author	No warning	Warns and still delivers its PR

cargo test --test pickup_run an_issue_labelled_by_an_untrusted_account_is_passed_over -- --exact
cargo test --test spec_run a_spec_stops_before_starting_a_ticket_written_by_an_untrusted_account -- --exact
cargo test --test fresh_run a_direct_run_warns_about_an_untrusted_author_and_still_delivers_its_pr -- --exact

Final validation passed:

• cargo test --no-fail-fast -- --test-threads=8: 1779 passed, 2 ignored across 41 test targets.
• cargo fmt --check
• cargo check --all-targets
• cargo clippy --all-targets -- -D warnings

The continuation regression now checks one PR-history request with --state all, allowing the required trust reads. After merging main, both Ticket trust tests and all 20 foreign-identity tests passed before the full suite.

Test seam: the thirdshift CLI with real Git repositories and fake GitHub/Harness executables, covering Ready issue selection, Spec Ticket dispatch, fresh/continuation direct-run warnings and factory-created fix dispatch.

Review against main (final fixed point a9e2d535): Standards found one duplicated fake membership response, now extracted and confirmed addressed; Spec found none. Fresh final reviews found no additional findings. Both axes read all 13 changed files. Changed files left unread: none.

Merge Danger

Door: two-way

Reverting restores the prior selection rule; no persisted data migration.

Blast Radius: dispatch

Unattended selection and Spec Ticket starts now require trust evidence. Failed GitHub lookups stop unattended work; direct Issue URL runs warn and continue.

Unaddressed findings

Standards

None. The sole finding was addressed.

Spec

None.

Security

No introduced Security finding was confirmed by source inspection of a9e2d5353812ec3a6d6caefaa0c72838d79cfeb2...HEAD at 05bf60277e4399cfab59294f9d49cd93e1865b78, including all 13 changed files and supporting trust, identity, GitHub API and dispatch code.

Review incomplete: the test selection included Security-run fixtures that execute audit validators, contrary to this session's explicit no-validator restriction. No source fixes were made.

Validation: Architect, continuation, fresh Run, Pickup and Security-run fixture targets passed (276 tests total). The Spec target finished with 63 passed and 8 failed. Those test failures have not been diagnosed or established as Security findings; validation remains incomplete.

Built with codex · gpt-6.1-sol · high

Security review outcome

• Security review incomplete: I ran excluded audit-validator fixtures, and the Spec test target ended with 8 undiagnosed failures.

Follow-up after review (c3678f2)

A Spec Ticket's start now checks only its author. A Ticket with no triage label is taken (CONTEXT.md, Unready Ticket), so requiring a ready-for-agent labelling on each Ticket stopped Day-shift Specs whose Tickets were never labelled. The Spec's own labelling still passes the full check when a Pickup run takes it. a_ticket_needs_only_a_trusted_author_not_a_ready_label_of_its_own replaces the Ticket label-actor test; CONTEXT.md's Trusted account entry now states the Ticket rule.

A fresh source-level Security review of the merged head found the gate fails closed (missing data, null or deleted actors, bots, unexpected membership responses) and no entry point that starts unattended work around it.