[mldangelo-oai]

Summary

Local vendor imports can discard valid findings because their readers apply Cloud publication limits. Local imports now retain complete evidence and source identities while Cloud publication continues to enforce its existing payload contract.

Changes

• Select local validation for local file imports across Semgrep, Snyk, Endor, GitHub, and Wiz JSON, SARIF, CSV, and normalized formats.
• Preserve schema structure and defaults, repository provenance, relative paths, credential-free links, JSON and numeric integrity, and identity collision checks. Existing reader defaults and Cloud publication/retry behavior remain unchanged.
• Add persistence/readback regressions above Cloud evidence-size, string-length, array-count, nesting-depth, and identity-length limits, together with Cloud rejection and retained-protection checks.

Testing

• Frozen SDK and MCP dependency installs: passed using the locked cached packages.
• Plugin build: passed.
• Focused adapter, local import, Cloud publication, and new limit regression suites on the final tree: 838 passed, 2 platform-specific skips, 0 failed (seed 12345; 12,079 assertions).
• SDK types/generated-schema checks and formatting/Markdown checks: passed.
• Full SDK suite with seed 12345: 6,796 passed, 83 skipped, 0 failed (99,938 assertions).
• Full SDK suite with normal randomized order (seed 2840322998): 6,796 passed, 83 skipped, 0 failed (99,938 assertions).

Risk and rollout

Local imports may retain larger records and use correspondingly more memory and disk space. Existing reader defaults and Cloud payload limits are preserved; malformed evidence, unsafe paths or links, conflicting source identities, and repository mismatches remain rejected. No CLI flags, database migrations, duration limits, or archive limits change. Native Windows execution has not been performed locally.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T10:24:02.777495Z	8617c98	PR opened
🔒 Security Review	✅ Completed 2026-10-23T10:24:31.781594Z	8617c98	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for preserving complete local vendor evidence while keeping Cloud validation intact. No material findings at 8617c98533d0be8590ca449907d224ed5305912c. Builds, types and formatting passed; 382 local tests and 30 additional reader/storage/boundary controls passed. The local adapter run also had 57 publication failures: 54 explicitly hit the filesystem-owner guard, and three had downstream failures consistent with that path. All 57 test identities pass in independently verified CI artifacts for this exact source, along with all 23 new persistence and validation cases. The additional SQLite controls cover storage components; the guarded end-to-end path was verified through hosted tests. CI still has pending checks, and native Windows execution is not claimed.