[mldangelo-oai]

Summary

Wait for the existing database writer before inspecting an output directory that registration may archive.

Changes

• Run host-managed archive checks after writer admission.
• Preserve early validation for calls that do not move the output directory.
• Cover the rename/recreate race with two SQLite connections.

Testing

All 29 recorded archive/registration tests and the five required portable checks passed. The regression fails against the original code with the missing-directory error.

Risk and rollout

The change uses the existing writer transaction and canonical-directory validation. Non-archiving calls retain their existing error ordering, and archive rollback and artifact retention remain covered by the tests.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T20:04:15.881573Z	28fb61c	New commits
🔒 Security Review	✅ Completed 2026-10-11T20:05:01.175756Z	28fb61c	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The focused synchronization fix preserves existing behavior and has appropriate regression coverage.

0 open findings

What changed in this PR

Serializes output-directory validation with archive transactions to prevent misleading errors during concurrent registrations.

Changes:

• Defers host-managed archive validation until writer admission.
• Preserves early validation for non-moving registrations.
• Adds a deterministic concurrency regression test.

File	Description
plugins/​codex-security/​scripts/​workbench_db.py	Moves archive-directory validation inside the writer transaction when required.
plugins/​codex-security/​tests/​test_workbench_archive.py	Tests concurrent registration during archive rename and recreation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.