From dd51f339a6388f46f0732474fc8aa19b67434620 Mon Sep 17 00:00:00 2001
From: Jacob Stephens <jacob@stephens.page>
Date: Sat, 17 Oct 2026 18:25:30 +0000
Subject: [PATCH 1/8] Report Security pre-audit failures truthfully (#740)

---
 src/github.rs         |  23 +++++++---
 src/github/failure.rs |  39 ++++++++++++++++
 src/notification.rs   |  31 +++++++++++--
 src/run_ending.rs     |  25 +++++++++-
 src/security.rs       |   6 +++
 tests/fakes/gh.rs     |   9 +++-
 tests/security_run.rs | 103 +++++++++++++++++++++++++++++++++++++++++-
 7 files changed, 222 insertions(+), 14 deletions(-)
 create mode 100644 src/github/failure.rs

diff --git a/src/github.rs b/src/github.rs
index f32fe850..291a955f 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -12,6 +12,9 @@ use crate::issue::{IssueUrl, Repo};
 use crate::labels::{Label, Labels};
 use crate::process::{self, Control, Interruption};
 
+mod failure;
+pub(crate) use failure::safe_cause;
+
 mod check_read;
 pub(crate) use check_read::is_transient as check_read_is_transient;
 
@@ -760,15 +763,21 @@ impl GitHub {
     /// it exits non-zero.
     fn gh_json(&self, args: &[&str]) -> Result<Value> {
         let command = format!("gh {}", args[..2].join(" "));
-        let output = self.output(args)?;
+        let output = self.output(args).with_context(|| failure::QueryFailure {
+            message: format!("{command} could not run"),
+            stderr: None,
+        })?;
         if !output.status.success() {
-            bail!(
-                "{command} failed: {}",
-                String::from_utf8_lossy(&output.stderr).trim()
-            );
+            let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+            bail!(failure::QueryFailure {
+                message: format!("{command} failed: {stderr}"),
+                stderr: Some(stderr),
+            });
         }
-        serde_json::from_slice(&output.stdout)
-            .with_context(|| format!("{command} returned invalid JSON"))
+        serde_json::from_slice(&output.stdout).with_context(|| failure::QueryFailure {
+            message: format!("{command} returned invalid JSON"),
+            stderr: None,
+        })
     }
     fn output(&self, args: &[&str]) -> Result<Output> {
         self.output_with_input(args, None)
diff --git a/src/github/failure.rs b/src/github/failure.rs
new file mode 100644
index 00000000..d89b07f9
--- /dev/null
+++ b/src/github/failure.rs
@@ -0,0 +1,39 @@
+//! Safe operational categories, derived only from GitHub response evidence.
+
+use std::fmt;
+
+#[derive(Debug)]
+pub(super) struct QueryFailure {
+    pub message: String,
+    pub stderr: Option<String>,
+}
+
+impl fmt::Display for QueryFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+
+impl std::error::Error for QueryFailure {}
+
+/// Never return diagnostics: GitHub may include credentials or private data.
+pub(crate) fn safe_cause(error: &anyhow::Error) -> Option<&'static str> {
+    let stderr = if let Some(failure) = error.downcast_ref::<QueryFailure>() {
+        failure.stderr.as_deref().unwrap_or_default()
+    } else if let Some(failure) = error.downcast_ref::<super::check_read::ApiFailure>() {
+        &failure.stderr
+    } else {
+        return None;
+    };
+    let stderr = stderr.to_ascii_lowercase();
+    Some(
+        if ["api rate limit exceeded", "api rate limit already exceeded"]
+            .iter()
+            .any(|message| stderr.contains(message))
+        {
+            "GitHub rate-limit exhaustion"
+        } else {
+            "GitHub dependency failure"
+        },
+    )
+}
diff --git a/src/notification.rs b/src/notification.rs
index ff15f1e2..bca48294 100644
--- a/src/notification.rs
+++ b/src/notification.rs
@@ -34,6 +34,7 @@ pub enum NotificationAsk {
 struct Checked {
     resend: Resend,
     started: Instant,
+    started_at: chrono::DateTime<chrono::Utc>,
 }
 
 impl Checked {
@@ -42,8 +43,13 @@ impl Checked {
     /// address is known and a Resend API key is found.
     fn new(to: Option<String>, settings: &EmailSettings) -> Result<Self> {
         let started = Instant::now();
+        let started_at = chrono::Utc::now();
         let resend = Resend::new(to, settings)?;
-        Ok(Checked { resend, started })
+        Ok(Checked {
+            resend,
+            started,
+            started_at,
+        })
     }
 }
 
@@ -151,6 +157,13 @@ impl RunNotification {
             host.as_deref().unwrap_or("unknown host"),
             self.checked.started.elapsed(),
         );
+        if account.pre_audit.is_some() {
+            text += &format!(
+                "Diagnostics:  Check this command's stderr on {} around {} UTC; for a scheduled command, check the scheduler's captured stderr.\n",
+                host.as_deref().unwrap_or("unknown host"),
+                self.checked.started_at.format("%Y-%m-%d %H:%M:%S"),
+            );
+        }
         let lines = crate::session::recording::Recording::capture().notification_lines();
         if !lines.is_empty() {
             text += "\nSession models:\n";
@@ -226,6 +239,7 @@ fn body(
     }
     if let Some(findings) = account.security_findings {
         let audit = match &account.ended {
+            _ if account.pre_audit.is_some() => "not started",
             Err(_) if account.failed_reproduction.is_some() => "audit complete",
             Ok(line) => line.as_str(),
             Err(_) => account.outcome,
@@ -273,12 +287,12 @@ fn body(
         text += &format!("Pull request: {pr_url}\n");
     }
     // Security failure causes can quote private verifier work or Harness
-    // diagnostics. Only the fixed safeguard category is safe to send.
+    // diagnostics. Only fixed operational and safeguard categories are safe to send.
     if let Err(cause) = &account.ended
         && !account.interrupted
     {
         let cause = if account.security_findings.is_some() {
-            cause.safeguard_refusal()
+            account.pre_audit.or_else(|| cause.safeguard_refusal())
         } else {
             Some(cause.full())
         };
@@ -299,7 +313,14 @@ fn body(
         text += &format!("Command log:  {}\n", log.display());
     }
     if let Some(built_with) = built_with {
-        text += &format!("{built_with}\n");
+        if account.pre_audit.is_some() {
+            text += &format!(
+                "Configured:   {}\n",
+                built_with.strip_prefix("Built with ").unwrap_or(built_with)
+            );
+        } else {
+            text += &format!("{built_with}\n");
+        }
     }
     text += &format!("Host:         {host}\n");
     text += &format!("Took:         {}\n", progress::duration(took));
@@ -357,6 +378,7 @@ mod tests {
             ticket_lines: &[],
             review: None,
             security_findings: None,
+            pre_audit: None,
             failed_reproduction: None,
             recovery: None,
             urls: vec![PR],
@@ -377,6 +399,7 @@ mod tests {
             ticket_lines: &[],
             review: None,
             security_findings: None,
+            pre_audit: None,
             failed_reproduction: None,
             recovery: None,
             urls: Vec::new(),
diff --git a/src/run_ending.rs b/src/run_ending.rs
index bd3eb8cf..664a7554 100644
--- a/src/run_ending.rs
+++ b/src/run_ending.rs
@@ -54,13 +54,16 @@ pub fn read(ending: &Ending) -> Result<Account<'_>, &Skip> {
                     ticket_lines: &[],
                     review: None,
                     security_findings: None,
+                    pre_audit: None,
                     failed_reproduction: None,
                     recovery: None,
                     urls: Vec::new(),
                 },
                 Err(failed) => Account::of_failure(
                     failed,
-                    if audited.failed_reproduction.is_some() {
+                    if !audited.audit_started {
+                        "pre-audit failed"
+                    } else if audited.failed_reproduction.is_some() {
                         "reproduction failed"
                     } else {
                         "audit failed"
@@ -68,6 +71,18 @@ pub fn read(ending: &Ending) -> Result<Account<'_>, &Skip> {
                 ),
             };
             Ok(Account {
+                pre_audit: if audited.audit_started {
+                    None
+                } else {
+                    Some(
+                        audited
+                            .outcome
+                            .as_ref()
+                            .err()
+                            .and_then(|failed| crate::github::safe_cause(&failed.error))
+                            .unwrap_or("Security run pre-audit checks failed"),
+                    )
+                },
                 failed_reproduction: audited.failed_reproduction,
                 security_findings: Some(&audited.findings),
                 advice: &audited.advice,
@@ -117,6 +132,8 @@ pub struct Account<'a> {
     pub review: Option<Review<'a>>,
     /// The failed reproduction, after a completed Security audit and private recording.
     pub failed_reproduction: Option<usize>,
+    /// Fixed safe cause when the Security audit was never entered.
+    pub pre_audit: Option<&'static str>,
     /// Safe metadata from a Security run's private records, even if the audit failed.
     pub security_findings: Option<&'a [crate::security::RecordedFinding]>,
     /// The URLs on stdout, a line each: the pull request's, or that of the
@@ -189,6 +206,7 @@ impl<'a> Account<'a> {
                 ticket_lines: &reached.ticket_lines,
                 review: None,
                 security_findings: None,
+                pre_audit: None,
                 failed_reproduction: None,
                 recovery: None,
                 urls: vec![&reached.pr_url],
@@ -215,6 +233,7 @@ impl<'a> Account<'a> {
             ticket_lines: &failed.ticket_lines,
             review: None,
             security_findings: None,
+            pre_audit: None,
             failed_reproduction: None,
             recovery: failed.recovery.as_deref(),
             urls: failed.pr_url.as_deref().into_iter().collect(),
@@ -245,6 +264,7 @@ impl<'a> Account<'a> {
                 ticket_lines: &[],
                 review: None,
                 security_findings: None,
+                pre_audit: None,
                 failed_reproduction: None,
                 recovery: None,
                 urls: vec![reviewed.url()],
@@ -536,6 +556,7 @@ mod tests {
             ticket_lines: &[],
             review: None,
             security_findings: None,
+            pre_audit: None,
             failed_reproduction: None,
             recovery: None,
             urls: vec![PR],
@@ -556,6 +577,7 @@ mod tests {
             ticket_lines: &[],
             review: None,
             security_findings: None,
+            pre_audit: None,
             failed_reproduction: None,
             recovery: None,
             urls: Vec::new(),
@@ -738,6 +760,7 @@ mod tests {
                         dispatched: None,
                     }),
                     security_findings: None,
+                    pre_audit: None,
                     failed_reproduction: None,
                     recovery: None,
                     urls: vec![PLAN],
diff --git a/src/security.rs b/src/security.rs
index 12dad396..74c4cd47 100644
--- a/src/security.rs
+++ b/src/security.rs
@@ -45,6 +45,8 @@ pub enum Outcome {
 
 /// The Security run's outcome and the private records it reached, including before a failure.
 pub struct Ended {
+    /// Whether the audit operation was entered, independently of its result.
+    pub audit_started: bool,
     pub outcome: Result<Recorded, FailedRun>,
     /// A failed reproduction's number; its audit and private recording completed.
     pub failed_reproduction: Option<usize>,
@@ -55,6 +57,7 @@ pub struct Ended {
 impl From<anyhow::Error> for Ended {
     fn from(error: anyhow::Error) -> Self {
         Self {
+            audit_started: false,
             outcome: Err(error.into()),
             failed_reproduction: None,
             findings: Vec::new(),
@@ -290,10 +293,12 @@ fn audit_and_record(
     let mut findings = Vec::new();
     let mut log = None;
     let mut reproduction = None;
+    let mut audit_started = false;
     let recorded = (|| -> Result<Recorded> {
         outside.check_harness()?;
         outside.check_node()?;
         outside.started(Work::SecurityRun(repo));
+        audit_started = true;
         let (audited, session_log) = outside.audit(base);
         log = session_log;
         let audited = audited?;
@@ -376,6 +381,7 @@ fn audit_and_record(
         None
     };
     Ended {
+        audit_started,
         outcome: recorded.map_err(|error| FailedRun {
             log,
             ..error.into()
diff --git a/tests/fakes/gh.rs b/tests/fakes/gh.rs
index 0591bb05..e3ebf023 100644
--- a/tests/fakes/gh.rs
+++ b/tests/fakes/gh.rs
@@ -26,6 +26,7 @@
 //!  "refuse_merges"?: {"times", "error"},
 //!  "after_merge"?: "<script>",
 //!  "failing"?: ["<command> <subcommand>", ...],
+//!  "failure_stderr"?: "<stderr for failing commands>",
 //!  "advisory_create_fails_after"?: <number of records>,
 //!  "user_email"?: "<address>" | null,
 //!  "sub_issues"?: {"<number>": [<number>, ...]},
@@ -2041,7 +2042,13 @@ pub fn main(args: Vec<String>) {
         .iter()
         .any(|failing| failing.as_str().is_some_and(starts_with))
     {
-        die("HTTP 502: Bad Gateway (https://api.github.com/graphql)", 1);
+        die(
+            state
+                .get("failure_stderr")
+                .and_then(Json::as_str)
+                .unwrap_or("HTTP 502: Bad Gateway (https://api.github.com/graphql)"),
+            1,
+        );
     }
     let args: Vec<&str> = args.iter().map(String::as_str).collect();
     let parsed = |rest: &[&str]| {
diff --git a/tests/security_run.rs b/tests/security_run.rs
index a4614e8a..64367773 100644
--- a/tests/security_run.rs
+++ b/tests/security_run.rs
@@ -3151,7 +3151,6 @@ fn failed_security_audits_send_one_notification_with_a_safe_status() {
             Some("api --method POST"),
             "creating a draft repository security advisory failed",
         ),
-        (audit_script("[]"), Some("issue list"), "gh issue list"),
     ] {
         let scenario = Scenario::new();
         scenario.agent_does(&script);
@@ -3188,6 +3187,108 @@ fn failed_security_audits_send_one_notification_with_a_safe_status() {
     }
 }
 
+#[test]
+fn pre_audit_github_quota_failures_notify_without_claiming_an_audit_ran() {
+    for call in ["issue list", "api --paginate"] {
+        assert_pre_audit_github_failure(
+            call,
+            "GraphQL: API rate limit already exceeded for user ID PRIVATE_USER_ID. token=PRIVATE_TOKEN Private candidate write-up. Private verifier diagnostics.",
+            "GitHub rate-limit exhaustion",
+        );
+    }
+}
+
+#[test]
+fn pre_audit_unknown_github_failures_notify_only_a_safe_dependency_category() {
+    for call in ["issue list", "api --paginate"] {
+        assert_pre_audit_github_failure(
+            call,
+            "HTTP 502: PRIVATE_USER_ID token=PRIVATE_TOKEN Private candidate write-up. Private verifier diagnostics. GraphQL: rate limit configuration unknown",
+            "GitHub dependency failure",
+        );
+    }
+}
+
+fn assert_pre_audit_github_failure(call: &str, diagnostic: &str, cause: &str) {
+    let scenario = Scenario::new();
+    scenario.agent_does(&audit_script("[]"));
+    scenario.gh_fails(call);
+    let mut github = scenario.gh_state();
+    github["failure_stderr"] = json!(diagnostic);
+    scenario.write_gh_state(&github);
+    let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+    let result =
+        scenario.run_with_env(&["secure", "email", "me@example.com"], &resend_env(&resend));
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    let (subject, text) = the_one_notification(&resend);
+    assert_eq!(
+        subject,
+        "[thirdshift] acme/widgets Security run: pre-audit failed"
+    );
+    assert!(text.contains("Result:       pre-audit failed"), "{text}");
+    assert!(text.contains("Audit:        not started"), "{text}");
+    assert!(text.contains(&format!("Cause:        {cause}")), "{text}");
+    assert!(text.contains("Configured:"), "{text}");
+    assert!(!text.contains("Built with"), "{text}");
+    assert!(text.contains("Diagnostics:"), "{text}");
+    assert!(text.contains("stderr"), "{text}");
+    assert!(text.contains("scheduler"), "{text}");
+    let host = text
+        .lines()
+        .find_map(|line| line.strip_prefix("Host:         "))
+        .unwrap();
+    let route = text
+        .lines()
+        .find(|line| line.starts_with("Diagnostics:"))
+        .unwrap();
+    assert!(route.contains(host), "{route}");
+    let (_, timestamp) = route.split_once(" around ").unwrap();
+    let (timestamp, _) = timestamp.split_once(" UTC;").unwrap();
+    chrono::NaiveDateTime::parse_from_str(timestamp, "%Y-%m-%d %H:%M:%S").unwrap();
+    for private in [
+        "PRIVATE_USER_ID",
+        "PRIVATE_TOKEN",
+        "Private candidate write-up.",
+        "Private verifier diagnostics.",
+        "GraphQL:",
+    ] {
+        assert!(!format!("{subject}\n{text}").contains(private), "{text}");
+    }
+    for absent in [
+        "Command log:",
+        "Session log:",
+        "Session models:",
+        "Reproduction:",
+        "cron.log",
+    ] {
+        assert!(!text.contains(absent), "{text}");
+    }
+    assert!(
+        result.stderr.contains("PRIVATE_USER_ID"),
+        "{}",
+        result.stderr
+    );
+    assert!(scenario.claude_calls().is_empty());
+    assert!(scenario.codex_calls().is_empty());
+    assert!(scenario.gh_state()["advisories"].is_null());
+    let calls = scenario.gh_calls();
+    assert!(
+        !calls
+            .iter()
+            .any(|call| call.starts_with(&["issue".into(), "create".into()])),
+        "{calls:?}"
+    );
+    assert!(
+        !calls.iter().any(|call| call.starts_with(&[
+            "api".into(),
+            "--method".into(),
+            "POST".into()
+        ])),
+        "{calls:?}"
+    );
+    assert_eq!(scenario.entries("work"), vec![REPO]);
+}
+
 #[test]
 fn an_interrupted_security_audit_sends_one_notification() {
     let scenario = Scenario::new();

From 096e6cffc3f89372c2fca6c4fc734d85da605404 Mon Sep 17 00:00:00 2001
From: Jacob Stephens <jacob@stephens.page>
Date: Sat, 17 Oct 2026 14:27:41 -0400
Subject: [PATCH 2/8] Report Security run pre-audit failures truthfully (#740)

---
 src/github.rs         |  60 +++++++++++++++++++----
 src/notification.rs   |  24 ++++++++--
 src/run_ending.rs     |  21 +++++++-
 src/security.rs       |   6 +++
 tests/fakes/gh.rs     |   9 +++-
 tests/security_run.rs | 109 +++++++++++++++++++++++++++++++++++++++++-
 6 files changed, 214 insertions(+), 15 deletions(-)

diff --git a/src/github.rs b/src/github.rs
index f32fe850..b24fb2bd 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -24,6 +24,52 @@ pub use advisories::{
 #[cfg(test)]
 mod execution_tests;
 
+/// A failed gh command keeps its diagnostic locally; notifications use only
+/// its fixed operational category.
+#[derive(Debug)]
+struct CommandFailure {
+    command: String,
+    stderr: String,
+}
+
+impl CommandFailure {
+    fn new(command: String, output: &Output) -> Self {
+        Self {
+            command,
+            stderr: String::from_utf8_lossy(&output.stderr).trim().to_string(),
+        }
+    }
+}
+
+impl fmt::Display for CommandFailure {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{} failed: {}", self.command, self.stderr)
+    }
+}
+
+impl std::error::Error for CommandFailure {}
+
+/// A fixed cause for failed GitHub queries, never their original diagnostics.
+/// Only explicit quota messages establish exhaustion; a bare 403 does not.
+pub(crate) fn operational_cause(error: &anyhow::Error) -> Option<&'static str> {
+    let stderr = if let Some(failure) = error.downcast_ref::<CommandFailure>() {
+        &failure.stderr
+    } else {
+        &error.downcast_ref::<check_read::ApiFailure>()?.stderr
+    };
+    let stderr = stderr.to_ascii_lowercase();
+    Some(
+        if stderr.contains("api rate limit exceeded")
+            || stderr.contains("api rate limit already exceeded")
+            || stderr.contains("secondary rate limit")
+        {
+            "GitHub rate-limit exhaustion"
+        } else {
+            "GitHub dependency failure"
+        },
+    )
+}
+
 /// GitHub CLI operations bound to an immutable interruption policy.
 /// Ordinary views stop for Command interruption; completion views finish
 /// independently without changing the recorded request or other views.
@@ -731,11 +777,10 @@ impl GitHub {
     fn gh_stdout(&self, args: &[&str]) -> Result<String> {
         let output = self.output(args)?;
         if !output.status.success() {
-            bail!(
-                "gh {} failed: {}",
-                args.join(" "),
-                String::from_utf8_lossy(&output.stderr).trim()
-            );
+            bail!(CommandFailure::new(
+                format!("gh {}", args.join(" ")),
+                &output
+            ));
         }
         Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
     }
@@ -762,10 +807,7 @@ impl GitHub {
         let command = format!("gh {}", args[..2].join(" "));
         let output = self.output(args)?;
         if !output.status.success() {
-            bail!(
-                "{command} failed: {}",
-                String::from_utf8_lossy(&output.stderr).trim()
-            );
+            bail!(CommandFailure::new(command, &output));
         }
         serde_json::from_slice(&output.stdout)
             .with_context(|| format!("{command} returned invalid JSON"))
diff --git a/src/notification.rs b/src/notification.rs
index ff15f1e2..41414966 100644
--- a/src/notification.rs
+++ b/src/notification.rs
@@ -34,6 +34,7 @@ pub enum NotificationAsk {
 struct Checked {
     resend: Resend,
     started: Instant,
+    started_at: chrono::DateTime<chrono::Utc>,
 }
 
 impl Checked {
@@ -42,8 +43,13 @@ impl Checked {
     /// address is known and a Resend API key is found.
     fn new(to: Option<String>, settings: &EmailSettings) -> Result<Self> {
         let started = Instant::now();
+        let started_at = chrono::Utc::now();
         let resend = Resend::new(to, settings)?;
-        Ok(Checked { resend, started })
+        Ok(Checked {
+            resend,
+            started,
+            started_at,
+        })
     }
 }
 
@@ -151,6 +157,13 @@ impl RunNotification {
             host.as_deref().unwrap_or("unknown host"),
             self.checked.started.elapsed(),
         );
+        if account.pre_audit_failure.is_some() {
+            text += &format!(
+                "Started (UTC): {}\nDiagnostics:  Check this command's stderr on {} at that time (or the scheduler's captured stderr, if scheduled).\n",
+                self.checked.started_at.format("%Y-%m-%d %H:%M:%S UTC"),
+                host.as_deref().unwrap_or("unknown host"),
+            );
+        }
         let lines = crate::session::recording::Recording::capture().notification_lines();
         if !lines.is_empty() {
             text += "\nSession models:\n";
@@ -226,6 +239,7 @@ fn body(
     }
     if let Some(findings) = account.security_findings {
         let audit = match &account.ended {
+            Err(_) if account.pre_audit_failure.is_some() => "not started",
             Err(_) if account.failed_reproduction.is_some() => "audit complete",
             Ok(line) => line.as_str(),
             Err(_) => account.outcome,
@@ -273,12 +287,14 @@ fn body(
         text += &format!("Pull request: {pr_url}\n");
     }
     // Security failure causes can quote private verifier work or Harness
-    // diagnostics. Only the fixed safeguard category is safe to send.
+    // diagnostics. Only fixed operational and safeguard categories are safe to send.
     if let Err(cause) = &account.ended
         && !account.interrupted
     {
         let cause = if account.security_findings.is_some() {
-            cause.safeguard_refusal()
+            account
+                .pre_audit_failure
+                .or_else(|| cause.safeguard_refusal())
         } else {
             Some(cause.full())
         };
@@ -358,6 +374,7 @@ mod tests {
             review: None,
             security_findings: None,
             failed_reproduction: None,
+            pre_audit_failure: None,
             recovery: None,
             urls: vec![PR],
         }
@@ -378,6 +395,7 @@ mod tests {
             review: None,
             security_findings: None,
             failed_reproduction: None,
+            pre_audit_failure: None,
             recovery: None,
             urls: Vec::new(),
         }
diff --git a/src/run_ending.rs b/src/run_ending.rs
index bd3eb8cf..ffb84c8e 100644
--- a/src/run_ending.rs
+++ b/src/run_ending.rs
@@ -55,12 +55,15 @@ pub fn read(ending: &Ending) -> Result<Account<'_>, &Skip> {
                     review: None,
                     security_findings: None,
                     failed_reproduction: None,
+                    pre_audit_failure: None,
                     recovery: None,
                     urls: Vec::new(),
                 },
                 Err(failed) => Account::of_failure(
                     failed,
-                    if audited.failed_reproduction.is_some() {
+                    if !audited.audit_started {
+                        "pre-audit failed"
+                    } else if audited.failed_reproduction.is_some() {
                         "reproduction failed"
                     } else {
                         "audit failed"
@@ -68,6 +71,14 @@ pub fn read(ending: &Ending) -> Result<Account<'_>, &Skip> {
                 ),
             };
             Ok(Account {
+                pre_audit_failure: if !audited.audit_started {
+                    audited.outcome.as_ref().err().map(|failed| {
+                        crate::github::operational_cause(&failed.error)
+                            .unwrap_or("pre-audit checks failed")
+                    })
+                } else {
+                    None
+                },
                 failed_reproduction: audited.failed_reproduction,
                 security_findings: Some(&audited.findings),
                 advice: &audited.advice,
@@ -117,6 +128,8 @@ pub struct Account<'a> {
     pub review: Option<Review<'a>>,
     /// The failed reproduction, after a completed Security audit and private recording.
     pub failed_reproduction: Option<usize>,
+    /// A fixed operational cause when a Security audit never started.
+    pub pre_audit_failure: Option<&'static str>,
     /// Safe metadata from a Security run's private records, even if the audit failed.
     pub security_findings: Option<&'a [crate::security::RecordedFinding]>,
     /// The URLs on stdout, a line each: the pull request's, or that of the
@@ -190,6 +203,7 @@ impl<'a> Account<'a> {
                 review: None,
                 security_findings: None,
                 failed_reproduction: None,
+                pre_audit_failure: None,
                 recovery: None,
                 urls: vec![&reached.pr_url],
             },
@@ -216,6 +230,7 @@ impl<'a> Account<'a> {
             review: None,
             security_findings: None,
             failed_reproduction: None,
+            pre_audit_failure: None,
             recovery: failed.recovery.as_deref(),
             urls: failed.pr_url.as_deref().into_iter().collect(),
         }
@@ -246,6 +261,7 @@ impl<'a> Account<'a> {
                 review: None,
                 security_findings: None,
                 failed_reproduction: None,
+                pre_audit_failure: None,
                 recovery: None,
                 urls: vec![reviewed.url()],
             },
@@ -537,6 +553,7 @@ mod tests {
             review: None,
             security_findings: None,
             failed_reproduction: None,
+            pre_audit_failure: None,
             recovery: None,
             urls: vec![PR],
         }
@@ -557,6 +574,7 @@ mod tests {
             review: None,
             security_findings: None,
             failed_reproduction: None,
+            pre_audit_failure: None,
             recovery: None,
             urls: Vec::new(),
         }
@@ -739,6 +757,7 @@ mod tests {
                     }),
                     security_findings: None,
                     failed_reproduction: None,
+                    pre_audit_failure: None,
                     recovery: None,
                     urls: vec![PLAN],
                 }
diff --git a/src/security.rs b/src/security.rs
index 12dad396..4ccaa9e0 100644
--- a/src/security.rs
+++ b/src/security.rs
@@ -46,6 +46,8 @@ pub enum Outcome {
 /// The Security run's outcome and the private records it reached, including before a failure.
 pub struct Ended {
     pub outcome: Result<Recorded, FailedRun>,
+    /// Whether the audit reached a session (or returned a completed report).
+    pub audit_started: bool,
     /// A failed reproduction's number; its audit and private recording completed.
     pub failed_reproduction: Option<usize>,
     pub findings: Vec<RecordedFinding>,
@@ -56,6 +58,7 @@ impl From<anyhow::Error> for Ended {
     fn from(error: anyhow::Error) -> Self {
         Self {
             outcome: Err(error.into()),
+            audit_started: false,
             failed_reproduction: None,
             findings: Vec::new(),
             advice: Vec::new(),
@@ -290,11 +293,13 @@ fn audit_and_record(
     let mut findings = Vec::new();
     let mut log = None;
     let mut reproduction = None;
+    let mut audit_started = false;
     let recorded = (|| -> Result<Recorded> {
         outside.check_harness()?;
         outside.check_node()?;
         outside.started(Work::SecurityRun(repo));
         let (audited, session_log) = outside.audit(base);
+        audit_started = audited.is_ok() || session_log.is_some();
         log = session_log;
         let audited = audited?;
         let mut recorded = Recorded {
@@ -380,6 +385,7 @@ fn audit_and_record(
             log,
             ..error.into()
         }),
+        audit_started,
         failed_reproduction,
         findings,
         advice,
diff --git a/tests/fakes/gh.rs b/tests/fakes/gh.rs
index 0591bb05..aa4d3627 100644
--- a/tests/fakes/gh.rs
+++ b/tests/fakes/gh.rs
@@ -26,6 +26,7 @@
 //!  "refuse_merges"?: {"times", "error"},
 //!  "after_merge"?: "<script>",
 //!  "failing"?: ["<command> <subcommand>", ...],
+//!  "failing_stderr"?: "<stderr for failing commands>",
 //!  "advisory_create_fails_after"?: <number of records>,
 //!  "user_email"?: "<address>" | null,
 //!  "sub_issues"?: {"<number>": [<number>, ...]},
@@ -2041,7 +2042,13 @@ pub fn main(args: Vec<String>) {
         .iter()
         .any(|failing| failing.as_str().is_some_and(starts_with))
     {
-        die("HTTP 502: Bad Gateway (https://api.github.com/graphql)", 1);
+        die(
+            state
+                .get("failing_stderr")
+                .and_then(Json::as_str)
+                .unwrap_or("HTTP 502: Bad Gateway (https://api.github.com/graphql)"),
+            1,
+        );
     }
     let args: Vec<&str> = args.iter().map(String::as_str).collect();
     let parsed = |rest: &[&str]| {
diff --git a/tests/security_run.rs b/tests/security_run.rs
index a4614e8a..98ba6da4 100644
--- a/tests/security_run.rs
+++ b/tests/security_run.rs
@@ -3151,7 +3151,6 @@ fn failed_security_audits_send_one_notification_with_a_safe_status() {
             Some("api --method POST"),
             "creating a draft repository security advisory failed",
         ),
-        (audit_script("[]"), Some("issue list"), "gh issue list"),
     ] {
         let scenario = Scenario::new();
         scenario.agent_does(&script);
@@ -3188,6 +3187,114 @@ fn failed_security_audits_send_one_notification_with_a_safe_status() {
     }
 }
 
+#[test]
+fn pre_audit_github_failures_report_a_safe_cause_without_claiming_an_audit_ran() {
+    for (diagnostic, expected_cause) in [
+        (
+            "GraphQL: API rate limit already exceeded for user ID PRIVATE-IDENTIFIER.",
+            "GitHub rate-limit exhaustion",
+        ),
+        (
+            "gh: API rate limit exceeded for PRIVATE-IDENTIFIER. (HTTP 403)",
+            "GitHub rate-limit exhaustion",
+        ),
+        (
+            "gh: You have exceeded a secondary rate limit. (HTTP 403)",
+            "GitHub rate-limit exhaustion",
+        ),
+        (
+            "gh: Resource not accessible by PRIVATE-IDENTIFIER (HTTP 403)",
+            "GitHub dependency failure",
+        ),
+        (
+            "HTTP 502: Bad Gateway (https://api.github.com/graphql)",
+            "GitHub dependency failure",
+        ),
+    ] {
+        for call in ["issue list", "api --paginate"] {
+            let scenario = Scenario::new();
+            scenario.user_config_is(&format!(
+                "[harness.codex]\nmodel = \"gpt-6.1-sol\"\neffort = \"high\"\n[logs]\ndir = {:?}\n",
+                scenario.path("custom-logs")
+            ));
+            scenario.gh_fails(call);
+            let mut github = scenario.gh_state();
+            github["failing_stderr"] = json!(format!(
+                "{diagnostic} token=PRIVATE-CREDENTIAL Private candidate write-up. Private provider/verifier diagnostic."
+            ));
+            scenario.write_gh_state(&github);
+            let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+            let result = scenario.run_with_env(
+                &["secure", "harness", "codex", "email", "me@example.com"],
+                &resend_env(&resend),
+            );
+            assert_eq!(result.code, Some(1), "{}", result.stderr);
+            assert!(scenario.claude_calls().is_empty());
+            assert!(scenario.codex_calls().is_empty());
+            assert!(scenario.gh_calls_of("issue", "create").is_empty());
+            assert!(scenario.gh_state()["advisories"].is_null());
+            assert!(
+                !scenario
+                    .path("custom-logs/acme/widgets/commands/secure")
+                    .exists()
+            );
+            let (subject, text) = the_one_notification(&resend);
+            assert_eq!(
+                subject,
+                "[thirdshift] acme/widgets Security run: pre-audit failed"
+            );
+            assert!(text.contains("Result:       pre-audit failed"), "{text}");
+            assert!(text.contains("Audit:        not started"), "{text}");
+            assert!(
+                text.contains(&format!("Cause:        {expected_cause}")),
+                "{text}"
+            );
+            assert!(
+                text.contains("Diagnostics:  Check this command's stderr on "),
+                "{text}"
+            );
+            let started = text
+                .lines()
+                .find_map(|line| line.strip_prefix("Started (UTC): "))
+                .expect(&text);
+            chrono::NaiveDateTime::parse_from_str(started, "%Y-%m-%d %H:%M:%S UTC").expect(&text);
+            let host = text
+                .lines()
+                .find_map(|line| line.strip_prefix("Host:         "))
+                .expect(&text);
+            assert!(
+                text.contains(&format!(
+                    "Check this command's stderr on {host} at that time"
+                )),
+                "{text}"
+            );
+            assert!(text.contains("gpt-6.1-sol · high (configured)"), "{text}");
+            for private in [
+                "PRIVATE-IDENTIFIER",
+                "PRIVATE-CREDENTIAL",
+                "Private candidate write-up.",
+                "GraphQL:",
+                "Private provider/verifier diagnostic.",
+                diagnostic,
+            ] {
+                assert!(
+                    !resend.requests()[0].body.to_string().contains(private),
+                    "{text}"
+                );
+            }
+            for absent in [
+                "Session log:",
+                "Command log:",
+                "Reproduction:",
+                "Session models:",
+                "cron.log",
+            ] {
+                assert!(!text.contains(absent), "{text}");
+            }
+        }
+    }
+}
+
 #[test]
 fn an_interrupted_security_audit_sends_one_notification() {
     let scenario = Scenario::new();

From 5f07cb25701231f4b1ab9924042acdd867e76551 Mon Sep 17 00:00:00 2001
From: Jacob Stephens <jacob@stephens.page>
Date: Sat, 17 Oct 2026 18:28:08 +0000
Subject: [PATCH 3/8] Preserve audit preparation stage and classify paginated
 query errors

---
 src/github.rs         | 12 +++++++--
 src/github/failure.rs |  6 ++---
 src/pass.rs           | 15 +++++------
 src/security.rs       | 10 ++++----
 src/security/audit.rs | 31 +++++++++++++++++------
 tests/security_run.rs | 58 +++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 107 insertions(+), 25 deletions(-)

diff --git a/src/github.rs b/src/github.rs
index 291a955f..f6b96763 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -746,7 +746,12 @@ impl GitHub {
     /// Every item of the `field` list of the GitHub API's `path`, across all its
     /// pages.
     fn gh_api_items(&self, path: &str, field: &str) -> Result<Vec<Value>> {
-        let output = self.output(&["api", "--paginate", "--jq", &format!(".{field}[]"), path])?;
+        let output = self
+            .output(&["api", "--paginate", "--jq", &format!(".{field}[]"), path])
+            .with_context(|| failure::QueryFailure {
+                message: format!("gh api {path} could not run"),
+                stderr: None,
+            })?;
         if !output.status.success() {
             bail!(check_read::ApiFailure {
                 path: path.to_string(),
@@ -756,7 +761,10 @@ impl GitHub {
         serde_json::Deserializer::from_slice(&output.stdout)
             .into_iter()
             .collect::<Result<_, _>>()
-            .with_context(|| format!("gh api {path} returned invalid JSON"))
+            .with_context(|| failure::QueryFailure {
+                message: format!("gh api {path} returned invalid JSON"),
+                stderr: None,
+            })
     }
 
     /// Run `gh <args>` and parse its stdout as JSON, failing with gh's stderr if
diff --git a/src/github/failure.rs b/src/github/failure.rs
index d89b07f9..cb24e5e1 100644
--- a/src/github/failure.rs
+++ b/src/github/failure.rs
@@ -20,10 +20,10 @@ impl std::error::Error for QueryFailure {}
 pub(crate) fn safe_cause(error: &anyhow::Error) -> Option<&'static str> {
     let stderr = if let Some(failure) = error.downcast_ref::<QueryFailure>() {
         failure.stderr.as_deref().unwrap_or_default()
-    } else if let Some(failure) = error.downcast_ref::<super::check_read::ApiFailure>() {
-        &failure.stderr
     } else {
-        return None;
+        &error
+            .downcast_ref::<super::check_read::ApiFailure>()?
+            .stderr
     };
     let stderr = stderr.to_ascii_lowercase();
     Some(
diff --git a/src/pass.rs b/src/pass.rs
index f148fb80..80228042 100644
--- a/src/pass.rs
+++ b/src/pass.rs
@@ -104,7 +104,7 @@ pub trait Outside {
     /// Check Node.js before a Security audit needs its validators.
     fn check_node(&mut self) -> Result<()>;
     /// Audit the Base branch in a disposable checkout and validate its artifacts.
-    fn audit(&mut self, base: &str) -> (Result<crate::security::audit::Audited>, Option<PathBuf>);
+    fn audit(&mut self, base: &str) -> crate::security::audit::Attempt;
     /// Private advisory or issue records in every state.
     fn security_records(&mut self) -> Result<SecurityRecords>;
     /// Whether origin's prepared Base branch is the last completed audit's commit.
@@ -234,7 +234,7 @@ impl Outside for LaunchAndGitHub<'_> {
         crate::security::audit::check_node()
     }
 
-    fn audit(&mut self, base: &str) -> (Result<crate::security::audit::Audited>, Option<PathBuf>) {
+    fn audit(&mut self, base: &str) -> crate::security::audit::Attempt {
         crate::security::audit::run(self.launch.git(), self.repo, base, self.harness)
     }
 
@@ -749,10 +749,7 @@ mod in_memory {
             Ok(())
         }
 
-        fn audit(
-            &mut self,
-            base: &str,
-        ) -> (Result<crate::security::audit::Audited>, Option<PathBuf>) {
+        fn audit(&mut self, base: &str) -> crate::security::audit::Attempt {
             self.calls.push(Call::SecurityAudit(base.to_string()));
             let audited = match self.audit_error.take() {
                 Some(cause) => Err(anyhow!(cause)),
@@ -760,7 +757,11 @@ mod in_memory {
                     findings: std::mem::take(&mut self.audit_findings),
                 }),
             };
-            (audited, self.session_log.clone())
+            crate::security::audit::Attempt {
+                started: true,
+                outcome: audited,
+                log: self.session_log.clone(),
+            }
         }
 
         fn security_records(&mut self) -> Result<SecurityRecords> {
diff --git a/src/security.rs b/src/security.rs
index 74c4cd47..315bc62b 100644
--- a/src/security.rs
+++ b/src/security.rs
@@ -45,7 +45,7 @@ pub enum Outcome {
 
 /// The Security run's outcome and the private records it reached, including before a failure.
 pub struct Ended {
-    /// Whether the audit operation was entered, independently of its result.
+    /// Whether an audit session was requested, after its preparation succeeded.
     pub audit_started: bool,
     pub outcome: Result<Recorded, FailedRun>,
     /// A failed reproduction's number; its audit and private recording completed.
@@ -298,10 +298,10 @@ fn audit_and_record(
         outside.check_harness()?;
         outside.check_node()?;
         outside.started(Work::SecurityRun(repo));
-        audit_started = true;
-        let (audited, session_log) = outside.audit(base);
-        log = session_log;
-        let audited = audited?;
+        let attempt = outside.audit(base);
+        audit_started = attempt.started;
+        log = attempt.log;
+        let audited = attempt.outcome?;
         let mut recorded = Recorded {
             created: 0,
             existing: 0,
diff --git a/src/security/audit.rs b/src/security/audit.rs
index 5b027ca0..4cce6eb3 100644
--- a/src/security/audit.rs
+++ b/src/security/audit.rs
@@ -20,6 +20,14 @@ use crate::session::{Logs, Purpose, Sessions};
 use crate::skills;
 use crate::worktree::ReviewWorktree;
 
+/// Audit startup and its result stay together: preparation can fail before
+/// any audit session is requested.
+pub struct Attempt {
+    pub started: bool,
+    pub outcome: Result<Audited>,
+    pub log: Option<PathBuf>,
+}
+
 pub struct Audited {
     pub findings: Vec<DraftAdvisory>,
 }
@@ -67,12 +75,7 @@ pub fn check_node() -> Result<()> {
     Ok(())
 }
 
-pub fn run(
-    launch: &Git,
-    repo: &Repo,
-    base: &str,
-    harness: &Choice,
-) -> (Result<Audited>, Option<PathBuf>) {
+pub fn run(launch: &Git, repo: &Repo, base: &str, harness: &Choice) -> Attempt {
     let prepared = (|| -> Result<_> {
         let worktree = ReviewWorktree::create(launch, &repo.name, base)?;
         let commit = Git::new(worktree.path()).run(&["rev-parse", "HEAD"])?;
@@ -104,11 +107,19 @@ pub fn run(
     })();
     let (worktree, output, prompt, commit) = match prepared {
         Ok(prepared) => prepared,
-        Err(error) => return (Err(error), None),
+        Err(error) => {
+            return Attempt {
+                started: false,
+                outcome: Err(error),
+                log: None,
+            };
+        }
     };
     let logs = Logs::of_security_run(repo);
+    let mut started = false;
     let (audited, log) = Sessions::within(&logs, worktree.path(), harness, |sessions| {
         progress::step(format!("starting the Security audit of {base}"));
+        started = true;
         let message =
             sessions.run_to_final_message(Purpose::Security, "security-audit", &prompt)?;
         let line = message.as_deref().and_then(|message| {
@@ -185,7 +196,11 @@ pub fn run(
         (Ok(audited), Ok(())) => Ok(audited),
         (Err(error), _) | (_, Err(error)) => Err(error),
     };
-    (audited, log)
+    Attempt {
+        started,
+        outcome: audited,
+        log,
+    }
 }
 
 fn finish_record(output: &Path, commit: &str, base: &str, complete: bool) -> Result<()> {
diff --git a/tests/security_run.rs b/tests/security_run.rs
index 64367773..189062ed 100644
--- a/tests/security_run.rs
+++ b/tests/security_run.rs
@@ -4193,3 +4193,61 @@ printf '%s\n' 'Security fix Spec: https://github.com/acme/widgets/issues/7' > "$
     assert!(state["prs"].as_array().unwrap().is_empty());
     assert_eq!(scenario.claude_calls().len(), 1);
 }
+
+#[test]
+fn review_acquisition_failure_is_pre_audit() {
+    let scenario = Scenario::new();
+    fs::create_dir(scenario.path("work/widgets-architect")).unwrap();
+    fs::write(
+        scenario.path("work/widgets-architect/keep.txt"),
+        "unowned user work",
+    )
+    .unwrap();
+    let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+    let result =
+        scenario.run_with_env(&["secure", "email", "me@example.com"], &resend_env(&resend));
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    assert!(scenario.claude_calls().is_empty());
+    assert!(scenario.codex_calls().is_empty());
+    let (subject, text) = the_one_notification(&resend);
+    assert!(
+        subject.ends_with(": pre-audit failed"),
+        "{subject}\n{text}\n{}",
+        result.stderr
+    );
+    assert!(text.contains("Audit:        not started"), "{text}");
+}
+
+#[test]
+fn review_malformed_github_response_keeps_dependency_category() {
+    use std::os::unix::fs::PermissionsExt;
+    let scenario = Scenario::new();
+    fs::create_dir(scenario.path("bin/original")).unwrap();
+    fs::rename(scenario.path("bin/gh"), scenario.path("bin/original/gh")).unwrap();
+    fs::write(
+        scenario.path("bin/gh"),
+        r#"#!/bin/sh
+if [ "$1" = api ] && [ "$2" = --paginate ]; then
+  printf '%s' 'PRIVATE_RESPONSE_NOT_JSON'
+  exit 0
+fi
+exec "$(dirname "$0")/original/gh" "$@"
+"#,
+    )
+    .unwrap();
+    fs::set_permissions(scenario.path("bin/gh"), fs::Permissions::from_mode(0o755)).unwrap();
+    let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+    let result =
+        scenario.run_with_env(&["secure", "email", "me@example.com"], &resend_env(&resend));
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    assert!(scenario.claude_calls().is_empty());
+    let (subject, text) = the_one_notification(&resend);
+    assert!(subject.ends_with(": pre-audit failed"), "{subject}");
+    assert!(text.contains("Audit:        not started"), "{text}");
+    assert!(!text.contains("PRIVATE_RESPONSE_NOT_JSON"), "{text}");
+    assert!(
+        text.contains("Cause:        GitHub dependency failure"),
+        "{text}\n{}",
+        result.stderr
+    );
+}

From 0f8a160875245daadb47c3db827d825ffc5511c8 Mon Sep 17 00:00:00 2001
From: Jacob Stephens <jacob@stephens.page>
Date: Sat, 17 Oct 2026 18:30:54 +0000
Subject: [PATCH 4/8] Preserve interruption diagnostics during GitHub query
 classification

---
 src/github.rs         | 12 ++++--------
 src/github/failure.rs | 13 +++++++++++++
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/src/github.rs b/src/github.rs
index f6b96763..25802e8e 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -748,10 +748,7 @@ impl GitHub {
     fn gh_api_items(&self, path: &str, field: &str) -> Result<Vec<Value>> {
         let output = self
             .output(&["api", "--paginate", "--jq", &format!(".{field}[]"), path])
-            .with_context(|| failure::QueryFailure {
-                message: format!("gh api {path} could not run"),
-                stderr: None,
-            })?;
+            .map_err(|error| failure::execution_failed(error, &format!("gh api {path}")))?;
         if !output.status.success() {
             bail!(check_read::ApiFailure {
                 path: path.to_string(),
@@ -771,10 +768,9 @@ impl GitHub {
     /// it exits non-zero.
     fn gh_json(&self, args: &[&str]) -> Result<Value> {
         let command = format!("gh {}", args[..2].join(" "));
-        let output = self.output(args).with_context(|| failure::QueryFailure {
-            message: format!("{command} could not run"),
-            stderr: None,
-        })?;
+        let output = self
+            .output(args)
+            .map_err(|error| failure::execution_failed(error, &command))?;
         if !output.status.success() {
             let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
             bail!(failure::QueryFailure {
diff --git a/src/github/failure.rs b/src/github/failure.rs
index cb24e5e1..186c22ec 100644
--- a/src/github/failure.rs
+++ b/src/github/failure.rs
@@ -16,6 +16,19 @@ impl fmt::Display for QueryFailure {
 
 impl std::error::Error for QueryFailure {}
 
+/// Preserve cancellation as a Command outcome rather than reclassifying it as
+/// a dependency failure. Completion operations retain the same recorded signal.
+pub(super) fn execution_failed(error: anyhow::Error, command: &str) -> anyhow::Error {
+    if crate::interrupt::requested() {
+        error
+    } else {
+        error.context(QueryFailure {
+            message: format!("{command} could not run"),
+            stderr: None,
+        })
+    }
+}
+
 /// Never return diagnostics: GitHub may include credentials or private data.
 pub(crate) fn safe_cause(error: &anyhow::Error) -> Option<&'static str> {
     let stderr = if let Some(failure) = error.downcast_ref::<QueryFailure>() {

From 414d04144750e80cec8bccee59d7ac6c666db50c Mon Sep 17 00:00:00 2001
From: Jacob Stephens <jacob@stephens.page>
Date: Sat, 17 Oct 2026 14:31:37 -0400
Subject: [PATCH 5/8] Address review findings and preserve GitHub query failure
 provenance

---
 src/github.rs         |  36 +++++++++------
 tests/security_run.rs | 104 ++++++++++++++++++++++++++++++++++++------
 2 files changed, 112 insertions(+), 28 deletions(-)

diff --git a/src/github.rs b/src/github.rs
index b24fb2bd..086e0d6d 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -27,14 +27,15 @@ mod execution_tests;
 /// A failed gh command keeps its diagnostic locally; notifications use only
 /// its fixed operational category.
 #[derive(Debug)]
-struct CommandFailure {
-    command: String,
-    stderr: String,
+enum CommandFailure {
+    Rejected { command: String, stderr: String },
+    InvalidJson { command: String },
+    Execution,
 }
 
 impl CommandFailure {
-    fn new(command: String, output: &Output) -> Self {
-        Self {
+    fn rejected(command: String, output: &Output) -> Self {
+        Self::Rejected {
             command,
             stderr: String::from_utf8_lossy(&output.stderr).trim().to_string(),
         }
@@ -43,7 +44,11 @@ impl CommandFailure {
 
 impl fmt::Display for CommandFailure {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{} failed: {}", self.command, self.stderr)
+        match self {
+            Self::Rejected { command, stderr } => write!(f, "{command} failed: {stderr}"),
+            Self::InvalidJson { command } => write!(f, "{command} returned invalid JSON"),
+            Self::Execution => f.write_str("could not run gh"),
+        }
     }
 }
 
@@ -52,10 +57,10 @@ impl std::error::Error for CommandFailure {}
 /// A fixed cause for failed GitHub queries, never their original diagnostics.
 /// Only explicit quota messages establish exhaustion; a bare 403 does not.
 pub(crate) fn operational_cause(error: &anyhow::Error) -> Option<&'static str> {
-    let stderr = if let Some(failure) = error.downcast_ref::<CommandFailure>() {
-        &failure.stderr
-    } else {
-        &error.downcast_ref::<check_read::ApiFailure>()?.stderr
+    let stderr = match error.downcast_ref::<CommandFailure>() {
+        Some(CommandFailure::Rejected { stderr, .. }) => stderr,
+        Some(_) => return Some("GitHub dependency failure"),
+        None => &error.downcast_ref::<check_read::ApiFailure>()?.stderr,
     };
     let stderr = stderr.to_ascii_lowercase();
     Some(
@@ -777,7 +782,7 @@ impl GitHub {
     fn gh_stdout(&self, args: &[&str]) -> Result<String> {
         let output = self.output(args)?;
         if !output.status.success() {
-            bail!(CommandFailure::new(
+            bail!(CommandFailure::rejected(
                 format!("gh {}", args.join(" ")),
                 &output
             ));
@@ -798,7 +803,9 @@ impl GitHub {
         serde_json::Deserializer::from_slice(&output.stdout)
             .into_iter()
             .collect::<Result<_, _>>()
-            .with_context(|| format!("gh api {path} returned invalid JSON"))
+            .with_context(|| CommandFailure::InvalidJson {
+                command: format!("gh api {path}"),
+            })
     }
 
     /// Run `gh <args>` and parse its stdout as JSON, failing with gh's stderr if
@@ -807,10 +814,10 @@ impl GitHub {
         let command = format!("gh {}", args[..2].join(" "));
         let output = self.output(args)?;
         if !output.status.success() {
-            bail!(CommandFailure::new(command, &output));
+            bail!(CommandFailure::rejected(command, &output));
         }
         serde_json::from_slice(&output.stdout)
-            .with_context(|| format!("{command} returned invalid JSON"))
+            .with_context(|| CommandFailure::InvalidJson { command })
     }
     fn output(&self, args: &[&str]) -> Result<Output> {
         self.output_with_input(args, None)
@@ -826,6 +833,7 @@ impl GitHub {
                 stop: &|child| process::stop(child, &[libc::SIGTERM]),
             },
         )
+        .context(CommandFailure::Execution)
     }
 }
 
diff --git a/tests/security_run.rs b/tests/security_run.rs
index 98ba6da4..bad69dc2 100644
--- a/tests/security_run.rs
+++ b/tests/security_run.rs
@@ -3135,35 +3135,31 @@ fn a_skipped_security_run_sends_no_notification_requested_by_word_or_config() {
 
 #[test]
 fn failed_security_audits_send_one_notification_with_a_safe_status() {
-    for (script, failing_call, cause) in [
+    for (script, recording_fails, cause) in [
         (
             audit_script("[]").replace("Security audit: complete", "Security audit: incomplete"),
-            None,
+            false,
             "ended incomplete",
         ),
         (
             audit_script("[{}]"),
-            None,
+            false,
             "validator validate-findings.cjs",
         ),
         (
             audit_script(&json!([finding("new")]).to_string()),
-            Some("api --method POST"),
+            true,
             "creating a draft repository security advisory failed",
         ),
     ] {
         let scenario = Scenario::new();
         scenario.agent_does(&script);
-        if let Some(call) = failing_call {
-            if call == "api --method POST" {
-                // The API consumes the request before rejecting it, avoiding
-                // a race between writing stdin and an early fake gh exit.
-                let mut github = scenario.gh_state();
-                github["advisory_create_fails_after"] = json!(0);
-                scenario.write_gh_state(&github);
-            } else {
-                scenario.gh_fails(call);
-            }
+        if recording_fails {
+            // The API consumes the request before rejecting it, avoiding
+            // a race between writing stdin and an early fake gh exit.
+            let mut github = scenario.gh_state();
+            github["advisory_create_fails_after"] = json!(0);
+            scenario.write_gh_state(&github);
         }
         let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
         let result =
@@ -3295,6 +3291,86 @@ fn pre_audit_github_failures_report_a_safe_cause_without_claiming_an_audit_ran()
     }
 }
 
+#[test]
+fn malformed_pre_audit_github_response_has_dependency_cause() {
+    use std::os::unix::fs::PermissionsExt;
+
+    let scenario = Scenario::new();
+    let gh = scenario.path("bin/gh");
+    fs::remove_file(&gh).unwrap();
+    fs::write(&gh, "#!/bin/sh\nprintf '%s\\n' 'PRIVATE-INVALID-JSON'\n").unwrap();
+    fs::set_permissions(&gh, fs::Permissions::from_mode(0o755)).unwrap();
+
+    let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+    let result = scenario.run_with_env(
+        &["secure", "email", "me@example.com"],
+        &[
+            ("THIRDSHIFT_RESEND_URL", resend.url()),
+            ("RESEND_API_KEY", "re_fake"),
+        ],
+    );
+
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    assert!(
+        result
+            .stderr
+            .contains("gh issue list returned invalid JSON"),
+        "{}",
+        result.stderr
+    );
+    assert!(scenario.claude_calls().is_empty());
+    assert!(scenario.codex_calls().is_empty());
+
+    let requests = resend.requests();
+    assert_eq!(requests.len(), 1);
+    let text = requests[0].body["text"].as_str().unwrap();
+    assert!(text.contains("Audit:        not started"), "{text}");
+    assert!(
+        !requests[0]
+            .body
+            .to_string()
+            .contains("PRIVATE-INVALID-JSON")
+    );
+    assert!(
+        text.contains("Cause:        GitHub dependency failure"),
+        "{text}"
+    );
+}
+
+#[test]
+fn an_unavailable_github_cli_has_a_safe_pre_audit_dependency_cause() {
+    let scenario = Scenario::new();
+    let git = std::process::Command::new("which")
+        .arg("git")
+        .output()
+        .unwrap();
+    let git = String::from_utf8(git.stdout).unwrap();
+    std::os::unix::fs::symlink(git.trim(), scenario.path("bin/git")).unwrap();
+    fs::remove_file(scenario.path("bin/gh")).unwrap();
+    let path = scenario.path("bin");
+    let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+    let mut env = resend_env(&resend).to_vec();
+    env.push(("PATH", path.to_str().unwrap()));
+    let result = scenario.run_with_env(&["secure", "email", "me@example.com"], &env);
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    assert!(
+        result.stderr.contains("could not run gh"),
+        "{}",
+        result.stderr
+    );
+    assert!(scenario.claude_calls().is_empty());
+    assert!(scenario.codex_calls().is_empty());
+    let (subject, text) = the_one_notification(&resend);
+    assert!(subject.ends_with(": pre-audit failed"), "{subject}");
+    assert!(text.contains("Audit:        not started"), "{text}");
+    assert!(
+        text.contains("Cause:        GitHub dependency failure"),
+        "{text}"
+    );
+    assert!(!text.contains("could not run gh"), "{text}");
+    assert!(!text.contains("No such file"), "{text}");
+}
+
 #[test]
 fn an_interrupted_security_audit_sends_one_notification() {
     let scenario = Scenario::new();

From f1fbcc8f129f1b16b67e01f0972307fa43badb11 Mon Sep 17 00:00:00 2001
From: Jacob Stephens <jacob@stephens.page>
Date: Sat, 17 Oct 2026 14:36:08 -0400
Subject: [PATCH 6/8] Classify GitHub response errors while preserving
 interruption behavior

---
 src/github.rs         | 195 +++++++++++++++++++++++++++++-------------
 tests/security_run.rs |  26 +++---
 2 files changed, 151 insertions(+), 70 deletions(-)

diff --git a/src/github.rs b/src/github.rs
index 086e0d6d..7fca7df5 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -30,6 +30,7 @@ mod execution_tests;
 enum CommandFailure {
     Rejected { command: String, stderr: String },
     InvalidJson { command: String },
+    InvalidResponse(String),
     Execution,
 }
 
@@ -47,6 +48,7 @@ impl fmt::Display for CommandFailure {
         match self {
             Self::Rejected { command, stderr } => write!(f, "{command} failed: {stderr}"),
             Self::InvalidJson { command } => write!(f, "{command} returned invalid JSON"),
+            Self::InvalidResponse(message) => f.write_str(message),
             Self::Execution => f.write_str("could not run gh"),
         }
     }
@@ -118,7 +120,9 @@ impl GitHub {
         let json = self.issue_view(issue, "title")?;
         Ok(json["title"]
             .as_str()
-            .context("gh output has no title")?
+            .context(CommandFailure::InvalidResponse(
+                "gh output has no title".into(),
+            ))?
             .to_string())
     }
 
@@ -127,13 +131,19 @@ impl GitHub {
         let json = self.issue_view(issue, "title,state,labels,createdAt")?;
         let created = json["createdAt"]
             .as_str()
-            .context("gh output has no createdAt")?;
+            .context(CommandFailure::InvalidResponse(
+                "gh output has no createdAt".into(),
+            ))?;
         Ok(Issue {
             title: json["title"].as_str().map(String::from),
             is_open: state_is_open(&json)?,
             labels: labels_of(&json)?,
             created: DateTime::parse_from_rfc3339(created)
-                .with_context(|| format!("gh output has an unreadable createdAt {created}"))?
+                .with_context(|| {
+                    CommandFailure::InvalidResponse(format!(
+                        "gh output has an unreadable createdAt {created}"
+                    ))
+                })?
                 .to_utc(),
         })
     }
@@ -241,8 +251,9 @@ impl GitHub {
             "--jq",
             ".id",
         ])?;
-        json.as_u64()
-            .context("gh api did not return the issue's database id")
+        json.as_u64().context(CommandFailure::InvalidResponse(
+            "gh api did not return the issue's database id".into(),
+        ))
     }
 
     /// Link `child` as a native sub-issue of `parent`.
@@ -312,16 +323,24 @@ impl GitHub {
             "1000",
         ])?;
         json.as_array()
-            .context("gh issue list did not return a list")?
+            .context(CommandFailure::InvalidResponse(
+                "gh issue list did not return a list".into(),
+            ))?
             .iter()
             .map(|listed| {
                 let field = |name: &str| {
-                    listed[name]
-                        .as_str()
-                        .with_context(|| format!("gh issue list output has no {name}"))
+                    listed[name].as_str().with_context(|| {
+                        CommandFailure::InvalidResponse(format!(
+                            "gh issue list output has no {name}"
+                        ))
+                    })
                 };
                 Ok(ListedIssue {
-                    issue: IssueUrl::parse(field("url")?)?,
+                    issue: IssueUrl::parse(field("url")?).context(
+                        CommandFailure::InvalidResponse(
+                            "gh issue list output has an invalid issue URL".into(),
+                        ),
+                    )?,
                     title: field("title")?.to_string(),
                     labels: labels_of(listed)?,
                 })
@@ -349,19 +368,24 @@ impl GitHub {
                 "--limit",
                 "1000",
             ])?;
-            for listed in json
-                .as_array()
-                .context("gh issue list did not return a list")?
-            {
+            for listed in json.as_array().context(CommandFailure::InvalidResponse(
+                "gh issue list did not return a list".into(),
+            ))? {
                 let url = listed["url"]
                     .as_str()
-                    .context("gh issue list output has no url")?;
+                    .context(CommandFailure::InvalidResponse(
+                        "gh issue list output has no url".into(),
+                    ))?;
                 let at = listed["createdAt"]
                     .as_str()
-                    .context("gh issue list output has no createdAt")?;
+                    .context(CommandFailure::InvalidResponse(
+                        "gh issue list output has no createdAt".into(),
+                    ))?;
                 let at = DateTime::parse_from_rfc3339(at)
                     .with_context(|| {
-                        format!("gh issue list output has an unreadable createdAt {at}")
+                        CommandFailure::InvalidResponse(format!(
+                            "gh issue list output has an unreadable createdAt {at}"
+                        ))
                     })?
                     .to_utc();
                 if at.timestamp() >= since.timestamp() {
@@ -385,15 +409,21 @@ impl GitHub {
             let info = &page["pageInfo"];
             if !info["hasNextPage"]
                 .as_bool()
-                .context("label history has no hasNextPage")?
+                .context(CommandFailure::InvalidResponse(
+                    "label history has no hasNextPage".into(),
+                ))?
             {
                 break json;
             }
             let next = info["endCursor"]
                 .as_str()
-                .context("label history has no endCursor")?;
+                .context(CommandFailure::InvalidResponse(
+                    "label history has no endCursor".into(),
+                ))?;
             if Some(next) == after.as_deref() {
-                bail!("label history cursor did not advance");
+                bail!(CommandFailure::InvalidResponse(
+                    "label history cursor did not advance".into()
+                ));
             }
             after = Some(next.to_string());
         };
@@ -411,9 +441,15 @@ impl GitHub {
         let at = |event: &Value| -> Result<DateTime<Utc>> {
             let at = event["createdAt"]
                 .as_str()
-                .context("gh api graphql output has an event with no createdAt")?;
+                .context(CommandFailure::InvalidResponse(
+                    "gh api graphql output has an event with no createdAt".into(),
+                ))?;
             Ok(DateTime::parse_from_rfc3339(at)
-                .with_context(|| format!("gh api graphql output has an unreadable createdAt {at}"))?
+                .with_context(|| {
+                    CommandFailure::InvalidResponse(format!(
+                        "gh api graphql output has an unreadable createdAt {at}"
+                    ))
+                })?
                 .to_utc())
         };
         let mut shaped = Vec::new();
@@ -422,7 +458,9 @@ impl GitHub {
             let applied = match event["__typename"].as_str() {
                 Some("LabeledEvent") => true,
                 Some("UnlabeledEvent") => false,
-                other => bail!("gh api graphql output has an unknown label event {other:?}"),
+                other => bail!(CommandFailure::InvalidResponse(format!(
+                    "gh api graphql output has an unknown label event {other:?}"
+                ))),
             };
             let name = event["label"]["name"].as_str();
             history = history.after(name, applied, label);
@@ -437,7 +475,9 @@ impl GitHub {
             let by = match event["__typename"].as_str() {
                 Some("SubIssueAddedEvent" | "SubIssueRemovedEvent") => Shaping::SubIssues,
                 Some("BlockedByAddedEvent" | "BlockedByRemovedEvent") => Shaping::Blockers,
-                other => bail!("gh api graphql output has an unknown event {other:?}"),
+                other => bail!(CommandFailure::InvalidResponse(format!(
+                    "gh api graphql output has an unknown event {other:?}"
+                ))),
             };
             shaped.push(Shaped { by, at: at(event)? });
         }
@@ -459,11 +499,9 @@ impl GitHub {
         let known = self.gh_json(&[
             "label", "list", "--repo", repo, "--json", "name", "--limit", "1000",
         ])?;
-        let known = named(
-            known
-                .as_array()
-                .context("gh label list did not return a list")?,
-        );
+        let known = named(known.as_array().context(CommandFailure::InvalidResponse(
+            "gh label list did not return a list".into(),
+        ))?);
         for label in labels {
             if !known.has(*label) {
                 self.gh(&[
@@ -518,7 +556,9 @@ impl GitHub {
             "--label",
             &names.join(","),
         ])?;
-        IssueUrl::parse(&url).context("gh issue create did not print the issue's URL")
+        IssueUrl::parse(&url).context(CommandFailure::InvalidResponse(
+            "gh issue create did not print the issue's URL".into(),
+        ))
     }
 
     /// The public email of the signed-in user's GitHub profile, or `None` if it
@@ -569,18 +609,22 @@ impl GitHub {
             Some("MERGEABLE") => Mergeable::Yes,
             Some("CONFLICTING") => Mergeable::No,
             Some("UNKNOWN") => Mergeable::Unknown,
-            other => bail!("gh output has an unknown mergeable state {other:?}"),
+            other => bail!(CommandFailure::InvalidResponse(format!(
+                "gh output has an unknown mergeable state {other:?}"
+            ))),
         };
         Ok(Some(PrSnapshot {
             pr: PullRequest::from_json(&json)?,
             mergeable,
             head_commit: json["headRefOid"]
                 .as_str()
-                .context("gh output has no headRefOid")?
+                .context(CommandFailure::InvalidResponse(
+                    "gh output has no headRefOid".into(),
+                ))?
                 .to_string(),
-            from_fork: json["isCrossRepository"]
-                .as_bool()
-                .context("gh output has no isCrossRepository")?,
+            from_fork: json["isCrossRepository"].as_bool().context(
+                CommandFailure::InvalidResponse("gh output has no isCrossRepository".into()),
+            )?,
         }))
     }
 
@@ -607,7 +651,9 @@ impl GitHub {
             &format!("{PR_FIELDS},isCrossRepository"),
         ])?;
         json.as_array()
-            .context("gh pr list did not return a list")?
+            .context(CommandFailure::InvalidResponse(
+                "gh pr list did not return a list".into(),
+            ))?
             .iter()
             .filter(|pr| pr["isCrossRepository"] != Value::Bool(true))
             .map(PullRequest::from_json)
@@ -645,7 +691,9 @@ impl GitHub {
         let json = self.pr_view(issue, &number.to_string(), "body")?;
         Ok(json["body"]
             .as_str()
-            .context("gh output has no body")?
+            .context(CommandFailure::InvalidResponse(
+                "gh output has no body".into(),
+            ))?
             .to_string())
     }
 
@@ -733,7 +781,9 @@ impl GitHub {
             checks.push(Check {
                 name: run["name"]
                     .as_str()
-                    .context("a check run has no name")?
+                    .context(CommandFailure::InvalidResponse(
+                        "a check run has no name".into(),
+                    ))?
                     .to_string(),
                 state,
                 job: ActionsJob::of(run["id"].as_u64(), run["details_url"].as_str()),
@@ -749,7 +799,9 @@ impl GitHub {
             checks.push(Check {
                 name: status["context"]
                     .as_str()
-                    .context("a commit status has no context")?
+                    .context(CommandFailure::InvalidResponse(
+                        "a commit status has no context".into(),
+                    ))?
                     .to_string(),
                 state,
                 url: url(&status["target_url"]),
@@ -833,13 +885,23 @@ impl GitHub {
                 stop: &|child| process::stop(child, &[libc::SIGTERM]),
             },
         )
-        .context(CommandFailure::Execution)
+        .map_err(|error| {
+            self.interruption
+                .check()
+                .err()
+                .unwrap_or_else(|| error.context(CommandFailure::Execution))
+        })
     }
 }
 
 /// Whether the issue `json` describes, with its `state`, is open.
 fn state_is_open(json: &Value) -> Result<bool> {
-    Ok(json["state"].as_str().context("gh output has no state")? == "OPEN")
+    Ok(json["state"]
+        .as_str()
+        .context(CommandFailure::InvalidResponse(
+            "gh output has no state".into(),
+        ))?
+        == "OPEN")
 }
 
 /// An issue as an Architect run reads the issue its Architecture review
@@ -854,11 +916,9 @@ pub struct Issue {
 
 /// The labels of the issue `json` describes, with its `labels`.
 fn labels_of(json: &Value) -> Result<Labels> {
-    Ok(named(
-        json["labels"]
-            .as_array()
-            .context("gh output has no labels")?,
-    ))
+    Ok(named(json["labels"].as_array().context(
+        CommandFailure::InvalidResponse("gh output has no labels".into()),
+    )?))
 }
 
 /// The labels `labels` describe, each with its `name`.
@@ -928,16 +988,18 @@ query($owner: String!, $repo: String!, $number: Int!) {
 
 /// The `nodes` of `connection`, the `what` of a GraphQL answer.
 fn nodes<'a>(connection: &'a Value, what: &str) -> Result<&'a Vec<Value>> {
-    connection["nodes"]
-        .as_array()
-        .with_context(|| format!("gh api graphql output has no {what}"))
+    connection["nodes"].as_array().with_context(|| {
+        CommandFailure::InvalidResponse(format!("gh api graphql output has no {what}"))
+    })
 }
 
 /// Whether the issue a GraphQL answer's `node` describes is open.
 fn node_is_open(node: &Value) -> Result<bool> {
     Ok(node["state"]
         .as_str()
-        .context("gh api graphql output has an issue with no state")?
+        .context(CommandFailure::InvalidResponse(
+            "gh api graphql output has an issue with no state".into(),
+        ))?
         == "OPEN")
 }
 
@@ -946,7 +1008,9 @@ fn node_issue(node: &Value) -> Result<IssueUrl> {
     IssueUrl::parse(
         node["url"]
             .as_str()
-            .context("gh api graphql output has an issue with no URL")?,
+            .context(CommandFailure::InvalidResponse(
+                "gh api graphql output has an issue with no URL".into(),
+            ))?,
     )
 }
 
@@ -954,14 +1018,18 @@ fn node_issue(node: &Value) -> Result<IssueUrl> {
 fn node_number(node: &Value) -> Result<u64> {
     node["number"]
         .as_u64()
-        .context("gh api graphql output has an issue with no number")
+        .context(CommandFailure::InvalidResponse(
+            "gh api graphql output has an issue with no number".into(),
+        ))
 }
 
 /// How many sub-issues the issue a GraphQL answer's `node` describes has.
 fn sub_issue_count(node: &Value) -> Result<u64> {
     node["subIssues"]["totalCount"]
         .as_u64()
-        .context("gh api graphql output has an issue with no subIssues count")
+        .context(CommandFailure::InvalidResponse(
+            "gh api graphql output has an issue with no subIssues count".into(),
+        ))
 }
 
 /// An issue as a listing of its repository's issues gives it.
@@ -1135,26 +1203,33 @@ impl PullRequest {
 
     fn from_json(json: &Value) -> Result<Self> {
         let field = |name: &str| -> Result<String> {
-            json[name]
-                .as_str()
-                .map(String::from)
-                .with_context(|| format!("gh output has no {name}"))
+            json[name].as_str().map(String::from).with_context(|| {
+                CommandFailure::InvalidResponse(format!("gh output has no {name}"))
+            })
         };
         let state = match field("state")?.as_str() {
             "OPEN" => PrState::Open,
             "CLOSED" => PrState::Closed,
             "MERGED" => PrState::Merged,
-            other => bail!("gh output has an unknown PR state {other}"),
+            other => bail!(CommandFailure::InvalidResponse(format!(
+                "gh output has an unknown PR state {other}"
+            ))),
         };
         Ok(PullRequest {
-            number: json["number"].as_u64().context("gh output has no number")?,
+            number: json["number"]
+                .as_u64()
+                .context(CommandFailure::InvalidResponse(
+                    "gh output has no number".into(),
+                ))?,
             url: field("url")?,
             state,
             head: field("headRefName")?,
             base: field("baseRefName")?,
             is_draft: json["isDraft"]
                 .as_bool()
-                .context("gh output has no isDraft")?,
+                .context(CommandFailure::InvalidResponse(
+                    "gh output has no isDraft".into(),
+                ))?,
         })
     }
 }
diff --git a/tests/security_run.rs b/tests/security_run.rs
index bad69dc2..a2989c24 100644
--- a/tests/security_run.rs
+++ b/tests/security_run.rs
@@ -3291,14 +3291,13 @@ fn pre_audit_github_failures_report_a_safe_cause_without_claiming_an_audit_ran()
     }
 }
 
-#[test]
-fn malformed_pre_audit_github_response_has_dependency_cause() {
+fn assert_pre_audit_response_dependency_cause(response: &str, diagnostic: &str) {
     use std::os::unix::fs::PermissionsExt;
 
     let scenario = Scenario::new();
     let gh = scenario.path("bin/gh");
     fs::remove_file(&gh).unwrap();
-    fs::write(&gh, "#!/bin/sh\nprintf '%s\\n' 'PRIVATE-INVALID-JSON'\n").unwrap();
+    fs::write(&gh, format!("#!/bin/sh\nprintf '%s\\n' '{response}'\n")).unwrap();
     fs::set_permissions(&gh, fs::Permissions::from_mode(0o755)).unwrap();
 
     let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
@@ -3311,13 +3310,7 @@ fn malformed_pre_audit_github_response_has_dependency_cause() {
     );
 
     assert_eq!(result.code, Some(1), "{}", result.stderr);
-    assert!(
-        result
-            .stderr
-            .contains("gh issue list returned invalid JSON"),
-        "{}",
-        result.stderr
-    );
+    assert!(result.stderr.contains(diagnostic), "{}", result.stderr);
     assert!(scenario.claude_calls().is_empty());
     assert!(scenario.codex_calls().is_empty());
 
@@ -3337,6 +3330,19 @@ fn malformed_pre_audit_github_response_has_dependency_cause() {
     );
 }
 
+#[test]
+fn malformed_pre_audit_github_response_has_dependency_cause() {
+    assert_pre_audit_response_dependency_cause(
+        "PRIVATE-INVALID-JSON",
+        "gh issue list returned invalid JSON",
+    );
+}
+
+#[test]
+fn invalid_schema_pre_audit_github_response_has_dependency_cause() {
+    assert_pre_audit_response_dependency_cause("{}", "gh issue list did not return a list");
+}
+
 #[test]
 fn an_unavailable_github_cli_has_a_safe_pre_audit_dependency_cause() {
     let scenario = Scenario::new();

From 40e632467ef8fff2071b3f6f586633438b053a12 Mon Sep 17 00:00:00 2001
From: Jacob Stephens <jacob@stephens.page>
Date: Sat, 17 Oct 2026 14:42:31 -0400
Subject: [PATCH 7/8] Resolve merged review findings in notification data and
 GitHub URL parsing

---
 src/github.rs         | 14 +++++++++++--
 src/notification.rs   | 23 ++++++++++------------
 tests/security_run.rs | 46 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 68 insertions(+), 15 deletions(-)

diff --git a/src/github.rs b/src/github.rs
index 7fca7df5..db52e6c6 100644
--- a/src/github.rs
+++ b/src/github.rs
@@ -389,7 +389,11 @@ impl GitHub {
                     })?
                     .to_utc();
                 if at.timestamp() >= since.timestamp() {
-                    found.push(IssueUrl::parse(url)?);
+                    found.push(
+                        IssueUrl::parse(url).context(CommandFailure::InvalidResponse(
+                            "gh issue list output has an invalid issue URL".into(),
+                        ))?,
+                    );
                 }
             }
         }
@@ -431,7 +435,10 @@ impl GitHub {
         let parent = issue["parent"]["url"]
             .as_str()
             .map(IssueUrl::parse)
-            .transpose()?;
+            .transpose()
+            .context(CommandFailure::InvalidResponse(
+                "gh api graphql output has an invalid parent issue URL".into(),
+            ))?;
         let mut open_blockers = Vec::new();
         for blocker in nodes(&issue["blockedBy"], "blockedBy")? {
             if node_is_open(blocker)? {
@@ -1012,6 +1019,9 @@ fn node_issue(node: &Value) -> Result<IssueUrl> {
                 "gh api graphql output has an issue with no URL".into(),
             ))?,
     )
+    .context(CommandFailure::InvalidResponse(
+        "gh api graphql output has an invalid issue URL".into(),
+    ))
 }
 
 /// The number of the issue a GraphQL answer's `node` describes.
diff --git a/src/notification.rs b/src/notification.rs
index 68243379..5d776116 100644
--- a/src/notification.rs
+++ b/src/notification.rs
@@ -88,7 +88,7 @@ pub struct RunNotification {
     checked: Checked,
     subject: Subject,
     /// The command's configured Harness, Model and Effort, once known.
-    built_with: Option<String>,
+    configured: Option<String>,
 }
 
 impl RunNotification {
@@ -117,7 +117,7 @@ impl RunNotification {
         Ok(RunNotification {
             checked,
             subject,
-            built_with: None,
+            configured: None,
         })
     }
 
@@ -135,7 +135,7 @@ impl RunNotification {
     /// Name the configured Harness, Model and Effort without claiming
     /// that the Harness confirmed which Model executed.
     pub fn built_with(&mut self, harness: &Choice) {
-        self.built_with = Some(format!("{} (configured)", harness.built_with()));
+        self.configured = Some(format!("{harness} (configured)"));
     }
 
     /// Send the one notification for the command that ended as `account`
@@ -152,7 +152,7 @@ impl RunNotification {
         let mut text = body(
             &self.subject,
             account,
-            self.built_with.as_deref(),
+            self.configured.as_deref(),
             command_log.as_deref(),
             host.as_deref().unwrap_or("unknown host"),
             self.checked.started.elapsed(),
@@ -218,7 +218,7 @@ fn architect_subject(repo: Option<&Repo>, outcome: &str) -> String {
 }
 
 /// The plain-text body of the notification for a command that ended as
-/// `account` tells, about `subject`, with its configured `built_with` line, if known,
+/// `account` tells, about `subject`, with its `configured` Harness, Model and Effort, if known,
 /// naming `command_log`, if the command keeps one,
 /// and `host`, for a command that `took` so long. It starts with the command's
 /// outcome, as the subject gives it, then the original Issue URL when the
@@ -228,7 +228,7 @@ fn architect_subject(repo: Option<&Repo>, outcome: &str) -> String {
 fn body(
     subject: &Subject,
     account: &Account,
-    built_with: Option<&str>,
+    configured: Option<&str>,
     command_log: Option<&Path>,
     host: &str,
     took: Duration,
@@ -314,14 +314,11 @@ fn body(
     if let Some(log) = command_log {
         text += &format!("Command log:  {}\n", log.display());
     }
-    if let Some(built_with) = built_with {
+    if let Some(configured) = configured {
         if account.pre_audit_failure.is_some() {
-            text += &format!(
-                "Configured:   {}\n",
-                built_with.strip_prefix("Built with ").unwrap_or(built_with)
-            );
+            text += &format!("Configured:   {configured}\n");
         } else {
-            text += &format!("{built_with}\n");
+            text += &format!("Built with {configured}\n");
         }
     }
     text += &format!("Host:         {host}\n");
@@ -607,7 +604,7 @@ mod tests {
             body(
                 &Subject::Pending,
                 &account,
-                Some("Built with claude · opus · high"),
+                Some("claude · opus · high"),
                 Some(Path::new("/home/me/.thirdshift/logs/commands/issue/x.log")),
                 "droplet-1",
                 Duration::from_secs(4)
diff --git a/tests/security_run.rs b/tests/security_run.rs
index 8415e25e..bb7bc306 100644
--- a/tests/security_run.rs
+++ b/tests/security_run.rs
@@ -4346,3 +4346,49 @@ exec "$(dirname "$0")/original/gh" "$@"
         result.stderr
     );
 }
+
+#[test]
+fn invalid_parent_issue_url_retains_github_dependency_cause() {
+    use std::os::unix::fs::PermissionsExt;
+
+    let scenario = Scenario::new();
+    scenario.issue_labelled(7, &["ready-for-agent"]);
+    fs::create_dir(scenario.path("bin/original")).unwrap();
+    fs::rename(scenario.path("bin/gh"), scenario.path("bin/original/gh")).unwrap();
+    fs::write(scenario.path("bin/gh"), r#"#!/bin/sh
+if [ "$1" = api ] && [ "$2" = graphql ]; then
+    printf '%s\n' '{"data":{"repository":{"issue":{"labelled":{"nodes":[],"pageInfo":{"hasNextPage":false}},"parent":{"url":"PRIVATE-INVALID-PARENT"}}}}}'
+    exit 0
+fi
+exec "$(dirname "$0")/original/gh" "$@"
+"#).unwrap();
+    fs::set_permissions(scenario.path("bin/gh"), fs::Permissions::from_mode(0o755)).unwrap();
+
+    let resend = ResendStandIn::replying(200, r#"{"id":"1"}"#);
+    let result = scenario.run_with_env(
+        &["secure", "email", "me@example.com"],
+        &[
+            ("THIRDSHIFT_RESEND_URL", resend.url()),
+            ("RESEND_API_KEY", "re_fake"),
+        ],
+    );
+    assert_eq!(result.code, Some(1), "{}", result.stderr);
+    assert!(
+        result
+            .stderr
+            .contains("not a GitHub issue URL: PRIVATE-INVALID-PARENT"),
+        "{}",
+        result.stderr
+    );
+    assert!(scenario.claude_calls().is_empty());
+    assert!(scenario.codex_calls().is_empty());
+    let requests = resend.requests();
+    assert_eq!(requests.len(), 1);
+    let text = requests[0].body["text"].as_str().unwrap();
+    assert!(text.contains("Audit:        not started"), "{text}");
+    assert!(!text.contains("PRIVATE-INVALID-PARENT"), "{text}");
+    assert!(
+        text.contains("Cause:        GitHub dependency failure"),
+        "{text}"
+    );
+}

From 4fa7cef6678a84c447727a2e1c7d7ecf63bc28c1 Mon Sep 17 00:00:00 2001
From: Jacob Stephens <jacob@stephens.page>
Date: Sat, 17 Oct 2026 19:42:56 +0000
Subject: [PATCH 8/8] thirdshift: failed run (PR
 https://github.com/JacobStephens2/thirdshift/pull/767 is a draft)

2026-10-17T19:42:56Z, host stephens. Uncommitted work at the time of failure is included in this commit.