Clarify Security Harness fallback defaults

[JacobStephens2]

Summary

Clarify the existing Security run Harness fallback in Setup's generated User config and the README. Blank or omitted security.harness uses harness.default; if that is absent, it uses Claude Code.

Security run Harness
  command's harness word
  security.harness (when nonblank)
  harness.default
  Claude Code

Extend CLI coverage of the final fallback across absent sections, omitted keys, empty strings and whitespace-only strings.

Closes #598

Evidence

• Before: cargo test --test setup setup_asks_once_about_security_fixing_with_off_as_the_default_and_writes_yes -- --exact failed after adding the assertion for the explicit fallback comment.
  After: The same command passes with the clarified generated comment.
• Before: The existing fallback test already passed for configured Codex settings, so no runtime change was needed.
  After: cargo test --test security_run a_blank_or_missing_security_harness_preserves_the_default_harness_and_its_settings -- --exact passes with the absent-default Claude Code cases extended to every blank or omitted Security setting.
• cargo test --test setup --test security_run: 105 passed.
• cargo test: 1,661 passed, 0 failed, 1 ignored across 41 test executables.
• cargo check --all-targets, cargo fmt --check, and cargo clippy --all-targets -- -D warnings: passed.

Test seams

• The thirdshift secure CLI reading the User config and launching the selected Harness with its Model and Effort.
• The thirdshift setup CLI writing the commented User config.

Review

Reviewed against main (7b6feb399b6f6396413a8694bf7193decc6df632) with thirdshift-code-review.

• Standards: 0 findings; no worst issue.

• Spec: 0 findings; no worst issue.

• Changed files left unread: none on either axis. Both reviewers read README.md, src/config.rs, tests/security_run.rs, and tests/setup.rs.

• Security: 0 introduced findings. Reviewed all four changed files and supporting config parsing, Setup writing, and Harness selection against the same pinned merge base with thirdshift-security-audit in guidance mode. No repository SECURITY.md or threat model was present.

• Security validation: both focused tests passed with cargo test --offline --locked --test security_run a_blank_or_missing_security_harness_preserves_the_default_harness_and_its_settings -- --exact and cargo test --offline --locked --test setup setup_asks_once_about_security_fixing_with_off_as_the_default_and_writes_yes -- --exact, inside an isolated sandbox with no external network, an allowlisted environment, read-only source and toolchain, and bounded resources.

Unaddressed findings

• Standards: none.
• Spec: none.
• Security: none.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Documentation, generated comments and test coverage can be reverted; no runtime selection logic changes.

Blast Radius: configuration

New or completed Setup configs gain the clearer comment. Existing user comments are preserved.

Built with codex · gpt-6.1-sol · high