Report Security pre-audit failures without claiming an audit ran

[JacobStephens2]

Summary

 Security run
-  failed GitHub gate or audit preparation → audit failed
+  failed GitHub gate or audit preparation → pre-audit failed
+  Audit: not started
+  fixed safe operational cause + host/time stderr diagnostic route

Confirmed GitHub quota exhaustion is recognizable; other GitHub failures use a generic dependency category. Private diagnostics stay on stderr. Configured Harness/Model choices are labelled as configuration before an audit starts.

Closes #740

Evidence

Seams under test: thirdshift secure CLI exit and external effects through fake GitHub/Harness/Resend; delivered Run notification subject and body.

• Before: the exact worktree-acquisition regression failed because the notification said audit failed without a Harness session. The exact malformed-paginated-response regression failed because its cause lost the GitHub dependency category.
  After: both tests are retained and pass:

  cargo test --test security_run review_acquisition_failure_is_pre_audit -- --exact --nocapture
  cargo test --test security_run review_malformed_github_response_keeps_dependency_category -- --exact --nocapture

• All 104 Security run scenarios pass, covering GraphQL/REST/secondary quota failures, generic failures, malformed JSON/schema/URLs, unavailable GitHub CLI, privacy, configured Model wording, custom log settings, audit failures, reproduction failures, and successful skips. Tests use fake GitHub/Resend.
• cargo fmt --check and cargo clippy --all-targets -- -D warnings pass.
• Full cargo test on 40e6324: 1876 passed, 0 failed, 2 existing ignored tests across 45 test binaries.

Review

Reviewed against main (c7ec7ee278332bbb44e59e945e573bc1af4ab17b) with independent Standards and Spec reviewers. Two earlier P2 Spec findings were reproduced exactly, fixed, and retained as tests. Fresh independent review of the combined head 40e6324 found 0 Standards findings and 0 additional Spec findings. Both axes read all eight changed files. Unread changed files: none.

Security review at 40e6324 used one guidance-mode session over all eight changed files and supporting code against pinned merge base c7ec7ee278332bbb44e59e945e573bc1af4ab17b. Checked notification disclosure, GitHub error propagation, and audit-start accounting; no introduced security findings identified. In an isolated sandbox with external networking disabled, the existing debug test binaries passed 7 focused pre-audit scenarios and 26 GitHub execution/notification unit tests (33 total). No source changes were needed.

Unaddressed findings

• Standards: none.
• Spec: none.
• Security: none.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Blast Radius: reporting

Security outcome accounting and shared GitHub error types change; audit/reproduction failures, interruption behavior, and notification privacy remain covered by existing scenarios.

Built with codex · gpt-6.1-sol · high