Skip to content

fix(deep-scan): preserve convergence across alias consolidation - #762

Open
Hughhhhcoder wants to merge 3 commits into
openai:mainfrom
Hughhhhcoder:codex/codex-security-lineage-convergence
Open

fix(deep-scan): preserve convergence across alias consolidation#762
Hughhhhcoder wants to merge 3 commits into
openai:mainfrom
Hughhhhcoder:codex/codex-security-lineage-convergence

Conversation

@Hughhhhcoder

@Hughhhhcoder Hughhhhcoder commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #711.

Deep Scan used canonical finding identity to derive novelty, so consolidating semantically equivalent findings under one retained source lineage could be counted as a new finding and reset no-new convergence.

Changes

  • Match previous findings to current findings by complete source lineage, allowing multiple prior aliases to converge into one current finding.
  • Reject discarded, split, or ambiguously reassigned prior lineage.
  • Count only current findings with no prior lineage assignment as new.
  • Preserve exact-identity fallback for legacy findings without lineage metadata.
  • Add regression coverage for alias consolidation, persisted recovery, lineage splits, fresh evidence on an existing root, genuine new roots, identity collisions, and legacy artifacts.

Testing

  • npx --yes pnpm@11.9.0 --dir ../../plugins/codex-security/mcp-app run test:mcp — 23/23 test files passed after building the bundled plugin.
  • npx --yes pnpm@11.9.0 run typecheck — passed.
  • uvx --from ruff==0.16.1 ruff check --config plugins/codex-security/pyproject.toml .github/scripts/check_plugin_source_compatibility.py .github/scripts/test_check_plugin_source_compatibility.py plugins/codex-security — passed.
  • uvx --from ruff==0.16.1 ruff format --check --config plugins/codex-security/pyproject.toml .github/scripts/check_plugin_source_compatibility.py .github/scripts/test_check_plugin_source_compatibility.py plugins/codex-security — passed.
  • python .github/scripts/check_plugin_source_compatibility.py — passed.
  • git diff --check — passed.

The local SDK install emitted an engine warning because Node v25.4.0 is outside the declared Node 22/24/26 ranges; all listed checks still passed.

Risk and rollout

This changes internal convergence accounting only; it does not change a public API or artifact schema. Existing source-accounting checks remain in place, split/ambiguous lineage remains a hard error, and legacy artifacts retain exact-identity behavior. CI on a supported Node version provides the rollout gate.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@github-actions github-actions Bot added the bug Something isn't working label Aug 31, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-04T06:28:45.516871Z eba4473 Manual request
🔒 Security Review ✅ Completed 2026-09-04T10:45:47.873177Z 4746e9a New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@Hughhhhcoder

Hughhhhcoder commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 31, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 27e1271fab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@Hughhhhcoder
Merge remote-tracking branch 'origin/main' into codex/codex-security-…
eba4473 
…lineage-convergence

# Conflicts:
#	plugins/codex-security/mcp-app/src/deep-scan/artifact-validation.ts
@Hughhhhcoder

Hughhhhcoder commented Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

Updated this branch with a normal merge commit (eba4473) from the current main to resolve the merge conflict. The resolution retains the alias-convergence/lineage checks from this PR and the current coverage-free DeepReductionInput contract from main.

Validation on the merged tree:

  • targeted deep-scan artifact validation: passed
  • MCP app TypeScript typecheck: passed
  • MCP app suite: 21/23 passed; the two remaining integration tests could not start because this clean worktree lacks the ignored sdk/typescript/_bundled_plugin build output, and rebuilding it was blocked by local disk space.
  • git diff --check: passed

No force-push was used.

@Hughhhhcoder

Hughhhhcoder commented Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 4, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: eba4473fda

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@Hughhhhcoder

Hughhhhcoder commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

I refreshed this branch with the latest main at f9b686a60ae127665858c1106a61677764f6a3bf using a regular merge (no force-push), producing 4746e9aa08213afc252c726e7bbb865524f2bfcf.

Validation after the update:

  • node tests/test_deep_scan_artifact_validation.mjs — passed
  • npm run typecheck — passed
  • git diff --check origin/main...HEAD — passed

The focused regression coverage still exercises discovery validation, reducer validation, lineage convergence, and empty-artifact handling.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bug Something isn't working

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Deep Scan counts semantic aliases as new findings and resets no-new convergence

1 participant

@Hughhhhcoder