Preserve literal arguments in Base fix and Security guidance

[JacobStephens2]

Summary

Base fix and Security fixing offers preserve literal arguments, including Model labels containing spaces. One Command line interface owns public flag reconstruction and POSIX shell rendering; omitted choices still consult the User config.

Asks(Issue URL, Flags) ──────► retry_with_base_fix
Security(original Base, Flags) ► retry_with_security_fix
                                  │
                       shared public flag words
                                  │
                       literal POSIX command text

Closes #645

Evidence

• Before: cargo test --bin thirdshift args::tests::base_fix_guidance_preserves_a_model_label_with_spaces -- --exact failed with unexpected argument after the Issue URL: Label.
  After: the same test passes through the production interface, sh argv recovery, and the public parser.
• Both semantic operations round-trip public choices, every Harness, omitted values, and punctuation-bearing values; requested permission appears once. Computed retry text and hidden child Run facts stay out of public guidance.
• Caller scenarios verify dispatch targeting, permission offer/suppression, optional original Security Base branch, and terminal/Run notification agreement. All 13 Base fix and 87 Security run tests passed on the final commit.
• cargo fmt --check and cargo clippy --all-targets -- -D warnings pass on the final commit.
• Plain cargo test stopped at site_deploy::the_systemd_units_verify because the host's unrelated /etc/systemd/system/career-dashboard-secrets.service contains RequiredBy in [Unit]. That exact test passes with SYSTEMD_UNIT_PATH=/usr/lib/systemd/system:/lib/systemd/system, which still validates this repo's units against vendor dependencies while excluding host overrides. Full suite passed with SYSTEMD_UNIT_PATH=/usr/lib/systemd/system:/lib/systemd/system cargo test (one existing unit test ignored).

Test seams

• Command line: the two semantic guidance operations, recovered by a POSIX shell and parsed through the public argument parser.
• Asks: Base fix offer policy and Issue URL targeting for direct and dispatched Runs.
• CLI: existing Base fix and Security run scenarios, observing terminal and Run notification advice.

Review

Standards and Spec reviewed against main at 02b3365108f95e03df30f637647257b501cceed3, including the follow-up changes. Standards S1 (private rendering choices in caller assertions) and S2 (duplicated shell recovery helpers) are addressed. Spec reported no findings.

Review coverage: both axes read all eight changed files, including supporting files. Changed files left unread: none.

Unaddressed findings

• Standards: none.
• Spec: none.

Merge Danger

Door: two-way

Reversible internal consolidation; command targets and permission policy remain the same.

Blast Radius: guidance

Both existing permission offers share the serializer; explicit public choices and omitted defaults are covered by shell/parser tests.

Built with codex · gpt-6.1-sol · high