Release 0.11.0

[JacobStephens2]

Summary

0.11.0 adds Security runs (thirdshift secure) to find, reproduce and optionally fix vulnerabilities, plus opt-in Security reviews before PR delivery. Scheduled Security runs with fixing allowed provide Fencing; fixing and reviews are off by default (#556).

• thirdshift secure audits origin's Base branch in a detached worktree, validates reports with the embedded Cloudflare audit skill and records findings privately. Public repositories use draft security advisories; private repositories use labelled security-finding issues when the advisory endpoint is unavailable. Findings are deduplicated by fingerprint (Ship Cloudflare security-audit as a Factory skill #553, Add report-only Security runs #558, Record private repository Security findings as labelled issues #561).
• security-fix, or [security] fix = true, allows one fix of the most severe reproduced finding; no-security-fix overrides it. Fixes dispatch a Run or, for larger work, a Spec run. Public fix issues are terse and link the private record; private repositories reuse the finding's issue (Allow Security runs to fix one reproduced finding #578, Support larger Security fixes and reuse private finding issues #581).
• security-review, or [security] review = true, enables a guidance review after implementation and before Delivery. It reproduces findings, fixes them and retains regression tests. Unresolved introduced findings, refusals and incomplete reviews hold Self-merge and leave the PR ready for review. Spec PRs receive one review of the whole Spec branch; Ticket Runs receive none (Add opt-in guidance Security reviews to Runs #592, Run guidance Security review once on Spec PRs #593).
• Recorded findings are reproduced in fresh worktrees at the audited commit. The private record keeps the outcome, reproduced severity, notes and test; findings already triaged by the Day shift are preserved (Reproduce recorded Security findings #566).
• Old vulnerabilities found during guidance review are recorded privately, with reproduction and fix-size metadata for a later Security run. They stay out of the PR and do not hold Self-merge; existing fingerprints and Day shift grades are preserved (Record old Security review findings privately #594).
• Security runs share the Pass lock with Architect and Pickup runs, yield to Ready issues and skip audits for waiting findings or an unchanged Base branch. Failed Security fixes keep their Claim, are excluded from Pickup and pause Fencing until their issue is closed. When fixing is undecided, an unfixed reproduced finding prompts an offer to enable it (Prefactor shared Pass lock, logging and command words #555, Skip Security audits for waiting findings and unchanged Base branches #568, Pause Security after failed fixes and offer fixing #582).
• Security runs support a separate security.harness setting; command words take precedence. Codex audit sessions and Resumes allow eight concurrent threads and request independent verifiers. Security sessions fail on safeguard refusals, and Model evidence reaches progress and Command logs. Guidance reviews remain in one session, including Resume (Choose the Security Harness and adjust Codex sessions #563, Fail Security sessions on safeguard refusals and log answering Models #577, Security runs and the Security review: thirdshift finds, reproduces and fixes vulnerabilities #556).
• Requested Security run notifications include the outcome, finding severity, title and private link, with detailed write-ups and failure diagnostics kept in local logs. Skipped runs send none (Send Security run notifications without private write-ups #562).
• Setup asks whether to allow Security fixing and reviews, both off by default. Claude failures now preserve provider diagnostics and supplied usage-limit facts in terminal output and Run notifications (Ask about Security fixing during Setup #580, Security runs and the Security review: thirdshift finds, reproduces and fixes vulnerabilities #556, Preserve Claude failure diagnostics and usage-limit details #591).

Also: README setup and Fencing cron examples, generated prompts and the Prompts and skills page; a documented trial of Security review modes; and corrected macOS interruption-test timing (#553, #557, #556, #560).

Version diff

diff --git a/Cargo.lock b/Cargo.lock
index baf6292..52cc0c2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1469,3 +1469,3 @@ dependencies = [
 name = "thirdshift"
-version = "0.10.3"
+version = "0.11.0"
 dependencies = [
diff --git a/Cargo.toml b/Cargo.toml
index 7d00392..393e23d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,3 +2,3 @@
 name = "thirdshift"
-version = "0.10.3"
+version = "0.11.0"
 edition = "2024"