Audits wait for an unchanged Base branch and for findings waiting on the Day shift #541

Parent

#427

What to build

A Security run skips its audit in two cases:

• The Base branch hasn't changed since the last Security audit that finished on it. thirdshift reads that commit from the skill's own run record under the repository's audit root, so no new state is kept.
• A Security finding waits for the Day shift. That is an unreproduced, untriaged finding:
  • on a public repository, a draft advisory still in draft with no severity;
  • on a private repository, a finding issue still open with needs-triage.

The Day shift's triage ends a finding's wait:

• on a public repository, by closing the draft advisory, publishing it or giving it a severity;
• on a private repository, by taking needs-triage off the issue or closing it.

Each skip has its own Activity log reason. The gates come in this order:

1. another Pass is running;
2. a Ready issue;
3. a waiting finding;
4. an unchanged Base branch.

Acceptance criteria

• A Security run on an unchanged Base branch is skipped, with its reason, and so is one run while a finding waits.
• Closing, publishing or giving a severity to the waiting advisory, or taking needs-triage off the waiting issue, lets the next Security run audit.
• Each skip writes its Activity log line only when its reason changes, keeps no Command log, and sends no Run notification.
• The gate order and the waiting rules are tested through the Pass seam's in-memory double, as the Architect run's gates are.