Sweep spec publish session for unlinked public issues

[JacobStephens2]

Summary

Closes #648. Spec-size public Security fixes are now published through a post-linking window sweep, and staged Blocked by: trailers fail closed.

publish (public fix)
  issues_created_since → fail_on_side_effects      # pre-creation sweep (unchanged)
  Single: parse → validate → create one issue      # unchanged
  Spec: publish_staged_spec
    parse_staged_spec_proposal                     # parse_blocked_by rejects multiline trailers
    validate every staged text before creating anything
    create spec + Tickets → add_sub_issue → add_blocked_by
    NEW: issues_created_since → unlinked_issues → fail_on_side_effects

Seams tested: staged-spec text parsing (parse_staged_spec_proposal, parse_blocked_by); the spec publish window sweep (publish_staged_spec against fake gh through secure security-fix scenarios); the single-fix staged path as regression.

Evidence

• Before: staged_spec_rejects_a_trailing_blocked_by_edge_on_its_own_line fails — a Blocked by: 1 line followed by a 2 line parsed with edge [0], silently dropping the stated edge.
  After: that test passes; cargo test --bin thirdshift fixing tests green; cargo test --test security_run 92 passed, 0 failed; full cargo test 44 binaries, 1732 passed, 0 failed; cargo clippy --all-targets -- -D warnings and cargo fmt --check clean.

Merge Danger

Door: two-way — reverting the two commits restores the pre-creation-sweep-only behavior; no migration, no stored state.

Blast Radius: security-fix publishing. The post-linking sweep no-ops when the window holds only the staged spec and its Tickets; the trailer strictness only rejects staged text that previously parsed with silently dropped edges.

Unaddressed findings

Standards

1. Duplicated Code in tests/fakes/gh.rs (api_add_sub_issue at line 724 vs api_add_blocked_by at line 758) — skipped by plan decision: the reviewer de-escalated it in the same breath ("kept as-is is defensible (fake handlers favor explicitness), so not flagged further"). No behavior claim, no test attached.
2. Data Clumps in src/github.rs (post_by_id at line 218, endpoint+field pair) — skipped: the reviewer judges "the current shape is fine" for a private helper with exactly two callers; it is Stage spec proposal text and validate before creating public issues #647's enabling code, untouched by Sweep spec publish session for unlinked public issues #648.

Spec

3. Post-linking sweep failure branch unreachable end-to-end (partial coverage) — addressed as far as construction allows. started is captured before the session and both sweeps query the same issues_created_since window (src/security/fixing.rs:72,75,88), so no session leak can appear between the pre-creation and post-linking sweeps; no integration test can trip the post-sweep failure branch through the session interface. Covered instead by the unlinked_issues unit test (src/security/fixing.rs:441, run: cargo test --bin thirdshift unlinked_issues) and happy-path assertions that the sweep leaves staged issues alone (a_bigger_public_fix_publishes_tickets_and_ends_as_the_spec_run asserts issue Keeping the PR mergeable: merge the Base branch and conflict Repair #8 stays OPEN with no "outside the staged path" in stderr; cargo test --test security_run 92 passed).
4. Reviewer's verbatim staged_spec_rejects_a_multiline_blocked_by_trailer test — ran as written on pre-fix code and PASSED: its first ticket is Blocked by: 1 on a two-ticket spec, i.e. a self-edge, so it passes via the pre-existing self-edge rejection without exercising truncation. Declined as defective proof, citing that run; the underlying truncation finding was accepted and fixed, proven by the corrected staged_spec_rejects_a_trailing_blocked_by_edge_on_its_own_line test (failed pre-fix, passes post-fix).
5. Staged-issue fate when the post-linking sweep fires (spec + Tickets stay open while the run fails) — the spec's "fail or close them" covers the unlinked leaks only; what happens to the already-created staged issues is a Spec/Day-shift decision, declined here: see needs-triage issue Decide staged-issue fate when the post-linking spec sweep fails #655 (Decide staged-issue fate when the post-linking spec sweep fails #655).

The review left no changed file unread.

Built with muse · default model · default effort