Add opt-in guidance Security reviews to Runs

[JacobStephens2]

Summary

Run an opt-in guidance Security review after implementation and before Delivery pushes or enters the Repair loop. Unresolved introduced findings and incomplete or refused reviews hold Self-merge and leave the PR ready for the Day shift.

command word / security.review
  opening session
  guidance Security review (one session)
    reproduce → fix → retain regression test
  push → ready PR → Repair loop
  Self-merge only when review completed with no unresolved introduced findings

Closes #550

Spec PR review and private recording of old findings remain scoped to #551 and #552. Whole-repository Security audits retain their full audit workflow.

Evidence

• Before: security_review_words_are_accepted_on_commands_that_start_runs failed because security-review was rejected.
  After: the same test passes; command/config precedence, Setup persistence and Base fix propagation pass through the executable.
• Before: enabled_review_fixes_reach_origin_before_delivery_finishes failed because the review never ran.
  After: the review's committed fix reaches origin.
• Before: an_unaddressed_introduced_finding_holds_self_merge_with_the_pr_ready observed an unwanted merge, and a_security_session_cannot_claim_completion_with_killed_work accepted an unfinished review.
  After: both regressions pass; refusals, malformed final lines and unfinished work hold Self-merge.
• Before: the Spec review's exact command, cargo test --test security_review review_regression_ -- --nocapture, failed all three supplied regressions: a held Merge run skipped CI repair, a summary-write error discarded the refusal and drafted its PR, and Continuation retained an obsolete finding.
  After: the same command passes all three retained regressions. Held Merge runs finish readiness work, summary-write errors preserve the Security cause and ready state, and Continuation replaces the factory's marked outcome.

Validation: the full cargo test --no-fail-fast suite passes (one existing ignored test). cargo check --tests, cargo clippy --all-targets -- -D warnings, cargo fmt --check, and git diff --check pass. Generated prompt checks pass.

Test seams

• Command parsing and resolved Asks, including dispatched Runs and Base fix child arguments.
• User config parse/render and Setup interaction.
• Delivery outcomes and external effects through its existing outside-world adapter.
• Sessions completion at the Harness seam.
• Generated Prompts and skills page.

Unaddressed findings

Standards

None. Addressed the review's Data Clumps judgment by passing security::Options through Base fix and child-run interfaces. Final review: 0 outstanding findings.

Spec

None. Reproduced and fixed all three behavior findings using the reviewers' written tests and exact command; all three regressions are retained. Final review: 0 outstanding findings.

Review coverage: both axes reviewed the initial 34 changed paths against issue-427 fixed at f54c0148560d202ba8ea2ec60b20813206016f23, including all 13 follow-up paths at 4ca2719. Full-suite validation then exposed missing default answers to the added Setup question; three fixture answers were added, and cargo test --test muse_sessions --test opencode_sessions setup -- --nocapture passes all three affected tests. Changed files left unread by both Standards and Spec: tests/muse_sessions.rs and tests/opencode_sessions.rs (these final fixture-only corrections). Full reports and each axis's final files-read list are saved in .thirdshift-review-UktcD0/standards.md and .thirdshift-review-UktcD0/spec.md in the implementation workspace.

Merge Danger

Door: two-way

No migration or destructive data change; the review is off by default.

Blast Radius: Delivery

Enabled Runs add a Security session, and unresolved or incomplete reviews prevent Self-merge.

Built with codex · gpt-6.1-sol · xhigh