[mldangelo-oai]

Summary

Preserve valid partial worker results when a discovery deadline settles before any discovery is accepted. Recovery retains usable checkpoint evidence and pending review without claiming a completed reduction.

Changes

• Integrate current main’s balanced runner qualification, native-configuration fixture shutdown fix, and package Deep Scan retry budget. The origins-reader fixture waits for its native child to exit before returning its response, while ordinary CLI reads and error diagnostics retain their behavior.
• Recover checkpoint findings, coverage, source provenance, and valid saved threat models through both deadline completion paths.
• Derive scoped deadline inventory from the registered scan scope before finalization, so interrupted parent coverage cannot prevent a zero-discovery finish or publication of valid saved worker findings.
• Validate records against the current contract before duplicate selection, retain requested finding scope, and represent malformed or interrupted records in deferred coverage.
• Keep invalid optional threat models from discarding otherwise valid findings and preserve source selection through frozen replay.
• Track files created by the publication attempt. On failure, restore existing outputs and timestamps and remove only newly created recovery artifacts. Preserve committed success when interruption follows the database commit.
• Continue rollback after a journaled write fails before creating its parent directory; a real publication regression verifies complete cleanup and restoration of prior contents and timestamps.
• Keep export warnings and untouched optional artifacts intact. Integrate current main's worker ownership, receipt-selection, and task-link fixes through its existing packaged coverage helpers.

Testing

Merged main at fe9d77e1c3d9; this refresh changes only the two Dockerfile base-image references to Node 26.12.1. The merge is clean, git diff --check passes, and every tracked entry outside Dockerfile is identical to the previously published head. The validation below is historical evidence for its named revisions; runtime tests and image builds were not repeated for this Dockerfile-only refresh. Fresh exact-head hosted CI remains required.

Merged main at 5f521759e7c6ff8c3fbd5e81fd1a3567ac801b59 into this branch at 01daf16439afdf34ce0b04e64e2d082445e9303f. Those preceding merges were clean; the deadline-recovery contribution is preserved.

• All 27 native-configuration tests passed at the intermediate merge, including origins success/error shutdown, ordinary-reader passthrough, early exit, stored-key configuration, and repeated launches. All 68 affected workflow, container, package-skeleton, and report-comparison tests also passed. Their complete relevant source, fixture, build, dependency, and artifact inputs remain unchanged in the final head.
• All six package smoke-timeout tests passed on the final head, along with SDK type checks, syntax checks for both changed smoke scripts, formatting for the three additional files, and git diff --check.
• SDK CI-helper compilation, SDK/MCP type checks, formatting for the ten earlier incoming files, and Actionlint syntax/expression checks passed before the final three-file main update. Unaffected results are retained through exact input bindings; SDK types were rerun because the additional timeout test is included in the TypeScript configuration.

These checks ran on Linux with Node 22.23.3 and Bun 1.3.14. Initial sandbox attempts stopped at temporary-directory permission and ownership checks; the completed native run used a trusted private temporary directory. Existing dependency installations and 149 generated plugin files, including 14 native artifacts, were reused after source/build/lock/artifact comparisons. Plugin source is unchanged, so portable plugin checks were not repeated. No fresh plugin/native build, full SDK suite, installed-package smoke run, or cross-platform execution is claimed. ShellCheck was unavailable.

The earlier Windows failure prompted a separate probe that demonstrated the fixture’s native-child lifetime gap. The upstream fixture change repairs that ordering issue; it does not establish the cause of the Windows SQLite initialization failure. Fresh hosted CI, including Windows, remains required for this head.

Earlier deadline-recovery qualification is historical, including 61 recovery/rollback tests, the five portable plugin checks, and preceding Python/MCP integration checks. Those records apply to their earlier revisions and were not repeated for this refresh.

Risk and rollout

Recovery applies only at a settled discovery deadline with no accepted discovery, and recovered output remains partial. Existing source validation, coordinator ownership, cancellation, and acceptance checks govern publication. The creation journal is local to the publication attempt; rollback removes only files that attempt created. No public command or configuration surface changes.

Public disclosure review

Reviewed the latest-main merges, their thirteen changed files, synthetic fixture and workflow tests, generic commit and branch metadata, captured local evidence, comments, links, and this description. Existing disclosure attestations retain their prior scope.

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T05:53:00.914497Z	f3d426a	New commits
🔒 Security Review	✅ Completed 2026-10-23T05:54:04.476774Z	f3d426a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e034d4029a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

[Copilot]

🔵 Needs a closer look

Cross-transaction filesystem recovery and rollback behavior warrants final human review despite comprehensive tests.

0 open findings

What changed in this PR

Preserves valid Deep Scan worker checkpoints when discovery expires before any worker completes.

Changes:

• Recovers checkpoint findings, coverage, provenance, and threat models.
• Rolls back publication artifacts and timestamps after failures.
• Adds extensive Python and MCP integration regressions.

File	Description
plugins/​codex-security/​scripts/​workbench_saved_results.py	Implements recovery, validation, and rollback.
plugins/​codex-security/​scripts/​deep_scan_workbench.py	Invokes recovery during deadline completion.
plugins/​codex-security/​references/​scan-contract.md	Documents deadline recovery behavior.
plugins/​codex-security/​tests/​test_saved_threat_model_recovery.py	Tests malformed and fallback threat models.
plugins/​codex-security/​tests/​test_deep_deadline_rollback.py	Tests rollback and chronology preservation.
plugins/​codex-security/​tests/​test_deep_deadline_recovery_edges.py	Covers recovery and failure edge cases.
plugins/​codex-security/​mcp-app/​tests/​test_deep_scan_store_integration.ts	Adds end-to-end checkpoint recovery coverage.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 76a7db99af

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

Thanks for preserving checkpoint evidence at discovery deadlines. Owner-level merge-safety review: no blocking findings. Current-contract validation precedes duplicate selection, requested scope remains enforced, invalid optional threat models no longer discard valid findings, and rollback respects publication ownership and committed success. The five previous findings are addressed.

All five portable checks, MCP types and formatting pass. Fourteen pure rollback/model tests and six independent publication probes pass; the probes exercise real merge/finalizer/write functions with an in-memory database adapter. Local affected tests have 119 passes and 113 failures at existing ownership guards; the real store also stops at its initial write. Downloaded hosted validation passes all 232 affected Python cases and the real store integration file on an identical merge tree.

[Copilot]

🟡 Changes recommended

A missing journal directory can abort rollback and leave failed-publication checkpoints available for recovery.

1 open issue

• Skip absent journal entries during rollback · New

_{Review effort: Balanced}

[alandelong-oai]

Owner-level merge-safety review: one rollback issue needs attention. I reproduced the existing missing-journal-entry finding through the actual deadline publication path: a worker head-snapshot write fails before its directory exists, merging continues, and a later publication update fails. Cleanup then raises FileNotFoundError and leaves three newly created recovery files behind. The control with only the publication failure restores everything. Treat absent journal paths or parents as already removed and continue cleanup; add a regression covering this sequence.

The intended partial-result recovery, scope filtering, current-contract duplicate selection, and committed-success handling otherwise look sound. Fourteen rollback/model tests, six publication probes, MCP typechecking/formatting, and the plugin build pass locally. Portable checks pass after suppressing only an injected proxy warning in the checker tests. Hosted validation passes all 232 affected Python cases on an identical merge tree. Local CLI/store integration stops at the existing trusted-owner guard; the current hosted MCP job was still running when checked.

[alandelong-oai]

Thanks for fixing the incomplete rollback. Owner-level merge-safety review: no actionable findings at d1611ca. The missing-journal-path failure now cleans up completely; deadline recovery preserves partial findings and pending review without claiming a completed reduction.

Fourteen focused tests, eight publication/failure probes, model-retry checks, MCP typechecking, and the plugin build pass locally. Portable checks pass after filtering an injected runtime warning. Hosted merge coverage passes all 45 deadline cases on Python 3.10, 3.12, and 3.14 plus the real store integration; production code and every PR-changed file match this head. Local CLI/store runs stop during fixture setup, and full hosted CI was still running when checked.

[Copilot]

🟢 Approval recommended

No unresolved blocking issues remain, and focused regressions cover the recovery and rollback behavior with reported successful current-head CI.

No open issues 🎉

1 resolved since last review

• Skip absent journal entries during rollback

_{Review effort: Balanced}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e203e81cb8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

Thanks for fixing scoped deadline recovery. The existing inventory issue is resolved: recovery now derives scoped inventory from the registered scope before finalization, preserving valid worker findings and partial status. No remaining actionable finding after reviewing all eight changed files and the new regression cases.

Twenty actual recovery/finalizer controls and 14 focused rollback/threat-model tests pass, along with frozen installs, portable checks, builds, types and formatting. The new full finish/complete regression stops locally at the unchanged registration ownership guard; the independent controls use a synthetic database adapter. No full protected lifecycle, cross-platform or complete current CI pass is claimed.