Use the configured Harness for release notes

[JacobStephens2]

Summary

 release summary
-  hard-coded Claude
+  User config → default Harness + Model + Effort
+  complete input over stdin or a temporary file → final assistant text
   unavailable summary → GitHub's generated notes

The release script shares this checkout's config parser and Harness adapters through an internal --release-summary command. All six Harnesses receive complete input, including input above the argument-size limit. Summary generation runs in a temporary directory without Factory skills; Claude's tools stay disabled. The release instructions now name the configured Harness as the login prerequisite.

Closes #596

Evidence

• Before: main invoked claude -p --tools '' --strict-mcp-config regardless of the User config.
  After: cargo test --test release --test harness_choice passed all 61 tests, covering configured Harness/Model/Effort, all six Harnesses, final text, and fallback after invalid config, failed or blank output.
• every_harness_receives_the_complete_release_input_above_the_argument_limit verifies complete 150 KB input for every Harness. A smoke check through the real summary_agent Cargo interface also passed with configured Codex, complete 150 KB input, and final text on stdout.
• Before: the Spec review's README inspection command failed on the stale Claude login prerequisite (exit 1).
  After: the same command passed after naming the User config's default Harness (exit 0).
• cargo check, cargo fmt --check, cargo clippy --all-targets -- -D warnings, and bash -n scripts/release.sh passed.
• Full cargo test suite: 1667 passed, 0 failed, 1 existing ignored test.

Test seams

• scripts/release.sh against a local Git origin and fake Harness CLIs: selected Harness/Model/Effort, summary content, fallback, and release completion.
• thirdshift --release-summary (internal script interface): config failures, Harness completion, and complete large-input delivery through the existing adapters.

Unaddressed findings

Standards

None. The review found no documented-standard violations or actionable baseline smells.

Spec

None. The single finding, the stale Claude login prerequisite in README.md:989, was reproduced and fixed in 6119a52; the same inspection command now passes.

Security

The automated Security review could not run target code on this host because it had no sandbox, so it flagged one risk without reproducing it. It has since been triaged by hand.

• Codex release summary reached unrestricted tools: addressed in f8c682e. Release input (contributor-editable PR titles and bodies) went to Codex with --dangerously-bypass-approvals-and-sandbox, where the pinned base used claude -p --tools ''. The Codex summary now runs with:

  • --sandbox read-only, approval_policy="never", web_search="disabled" and mcp_servers={};
  • shell_tool, unified_exec, apps, plugins, browser_use, computer_use and hooks disabled.

  A Codex that doesn't know one of these features fails, and the release falls back to GitHub's generated notes. The release test now asserts these arguments and the absence of the bypass flag; it failed before the change. An end-to-end run of --release-summary with real Codex 0.162.0, given input instructing it to touch a marker file and quote ~/.gitconfig, produced a plain summary: no marker was created and nothing was quoted.

• agy, Grok, Muse and OpenCode summaries: addressed in 9759a0c. Each summary now drops its session bypass and keeps as few tools as the CLI allows. Each setting was checked against the real CLI with a direct request to touch a marker file and quote ~/.gitconfig:

  • Grok: --tools todo_write --disallowed-tools search_tool,use_tool --disable-web-search. Only todo_write remains. Nothing ran and nothing was quoted.
  • Muse: approval and sandbox stay on, with --disable-shell --disable-write --disable-web-tools --no-foreign-personal-context --max-model-steps 1. Muse can still read files, but with a single step a read can never reach the summary; the probe failed closed.
  • OpenCode: no --auto, plus OPENCODE_CONFIG_CONTENT={"permission":{"*":"deny"}}, which holds even with --auto. Nothing ran.
  • agy: no --dangerously-skip-permissions, plus --sandbox --disable-slash-commands --print-timeout 10m. Headless agy auto-denies commands, writes, URLs and MCP, and a denial ends the turn with no summary.

• Residual risk (agy only): agy's file reads need no permission, and no flag removes them. A probe asking it to quote ~/.gitconfig returned no summary, but this is not guaranteed.

Two more fixes in the same commit:

• agy's stream-json input needs "event":"user", not "type":"user". Every real agy rejected the summary before this.
• The summary prompt now says there are no tools, because a refused tool call ends an agy or OpenCode turn with no summary.

Ordinary summaries were verified through thirdshift --release-summary with real agy, Grok, Muse and OpenCode. A new release test asserts each Harness's restrictions and the absence of its bypass; it failed before the change.

Review coverage

Both axes read all 19 changed files against main. No changed file was left unread. Reports, final files-read lists, and the Spec reproduction are saved in .thirdshift-review-uVfIt3/standards.md and .thirdshift-review-uVfIt3/spec.md in the continuation worktree.

Security review outcome

• Security review incomplete: session failed, ended early or omitted a valid final line; see Session log

Merge Danger

Door: two-way

The script and internal helper can be reverted together.

Blast Radius: Releases

Release summaries use the configured Harness and its Model/Effort. Cargo is required to run the helper from the checkout; summary failures retain the generated-notes fallback.

Built with codex · gpt-6.1-sol · high