[mldangelo-oai]

Summary

The production dependency audit currently runs before candidate packaging, so a registry timeout prevents SDK, installed-package, and MCP tests from starting. Run that audit in the existing required static-checks job so package builds and tests can proceed independently. Windows diagnostic shards also receive the existing 90-minute Windows job budget after two runs exhausted the shorter limit while tests were still passing. Checked file reads also retain exact large file identities so replacement checks do not lose numeric precision.

Changes

• Move the unchanged production audit command after formatting in static-checks, using the same frozen SDK and MCP dependencies.

• Keep the existing required check names, audit policy, failure handling, and separate protected-release audit.

• Extend the existing workflow contract test to keep the audit in the independent static-checks job.

• Merge current main and apply the existing 90-minute Windows diagnostic budget to sharded modes; Linux retains its 30-minute budget.

• Preserve exact scan-file identities during checked reads, preventing large file IDs from losing precision before comparison. Keep the existing Windows device-identity fallback and descriptor-retention behavior.

Testing

Latest main refresh at 988ca97c45d9 includes main at e4b12f831536:

• All 66 scan-owner and standalone owner-suggestion tests passed; all 11 selected API/hosted owner-report, budget, progress, and recovery tests passed.
• SDK CI build, bundled plugin build, SDK/MCP type checks, formatting for the 13 refreshed files, and git diff --check passed.
• This Linux validation reused dependency installations and native payloads matched to the branch inputs. Native binaries were not rebuilt. Full SDK and cross-platform validation remain subject to fresh hosted CI for this head.

Earlier validation

The following records earlier commits through 3e67b51cd2d3. These checks were not repeated for this main refresh unless listed above; earlier running/pending status is historical.

• 51 Bun tests passed across the skeleton, workflow-quality, and container CI suites (seed 2839136031).

• The release workflow's required-check dependency test passed, including failed, cancelled, and skipped dependencies (86 assertions; seed 2900417644).

• Full SDK and MCP type checks, changed-file Prettier, and git diff --check passed.

• actionlint 1.7.12 syntax checks passed; ShellCheck was not available locally.

• On the earlier head before the timeout follow-up, all required cross-platform checks passed. The optional Windows isolated-2 diagnostic reached the same 30-minute job limit on both attempts while individual tests continued to pass; cancellation prevented its JUnit report.

• For the timeout follow-up, all 36 skeleton and workflow-quality tests passed (387 assertions; seed 2839136031). Actionlint 1.7.12 and diff checks passed. Fresh hosted CI is required for the revised workflow.

• The precision regression failed before this repair while the ordinary-ID and unchanged-large-ID controls passed. Afterward, all 13 focused identity, provisional-document, descriptor-retention, malformed-input, ownership, and Windows device-identity controls passed locally on Linux.

• Full SDK/MCP type checks, changed-file formatting, and diff checks passed for the identity repair. Native Windows execution was not available locally; fresh hosted CI is required.

Risk and rollout

Candidate test artifacts can now be built before the audit finishes. All required OS aggregate checks still fail if static-checks fails, automatic release cutting still requires successful main CI, and protected release publication retains its own audit. This isolates slow or unavailable audit responses; healthy audit requests were already fast, so no substantial median speedup is claimed. Windows diagnostic shards can now run for up to 90 minutes, matching the existing baseline and parallel modes. Individual test deadlines, assertions, matrix coverage, and required gates are unchanged. Checked scan-file reads now retain bigint metadata throughout the existing identity comparisons; parent ownership checks, diagnostic text, and public CLI behavior are unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T20:49:42.130327Z	988ca97	New commits
🔒 Security Review	✅ Completed 2026-10-22T20:50:19.123760Z	988ca97	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for keeping the dependency audit required while allowing package tests to proceed independently. No blocking findings in this owner-level merge-safety review. All OS aggregates still reject failed static checks, and protected release publication retains its own audit.

Validated 41 workflow tests plus the 88-assertion required-check test, TypeScript, changed-file formatting, and actionlint with ShellCheck. The workflow composes cleanly with #1858. Full cross-platform CI remains in progress.

[alandelong-oai]

Thanks for keeping the audit required while allowing package tests to run independently. No actionable findings across the three changed files. The Windows timeout change preserves per-test deadlines, matrix coverage and required gates.

Validated 51 workflow tests, the 86-assertion required-gate test, all 19 timeout matrix cases, types, formatting, actionlint with ShellCheck, and the production audit. The current hosted audit passed; Windows diagnostics and the broader platform run are still in progress.

[alandelong-oai]

Thanks for preserving exact file identities through the checked-read comparisons. The new bigint metadata remains internal, and the existing Windows fallback, parent checks and descriptor cleanup are preserved. The audit and timeout changes remain unchanged and required gates stay intact.

Fresh frozen installs, plugin/SDK builds, types, formatting and the Windows-volume comparison test pass. The three replacement tests match the previously reviewed stack repair; their local execution remains blocked by the unchanged ownership guard. Hosted platform checks are still pending.