fix: make standard scan inventory authoritative - #88
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 732f9ffa07
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…/codex/authoritative-scan-inventory
Preserve and harden the scoped-inventory design from external PR #71. Keep standard workflow instructions, explicitly selected dependency scopes, both attested inventories, and authoritative target finalization consistent with the released 0.1.3 base. Co-authored-by: Create Something <micah@createsomething.io>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b829040ab6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Address the fresh exact-head review findings without relying on recoverable snapshot hashes or fragile CLI configuration overrides. Keep the private inventory physically outside configured state, output, and repository roots; fail closed if no safe location exists; and honor manually selected dependency scopes. Co-authored-by: Create Something <micah@createsomething.io>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d9a0da5f84
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Verify exhaustive sealed per-file review, candidate scope, and completion against the protected host inventory. Make the fail-closed protected-root regression deterministic across Windows drive layouts. Co-authored-by: Create Something <micah@createsomething.io>
…itative-scan-inventory
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c621811c83
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Use the current workbench registration contract and a deterministic unavailable inventory-root fixture on every operating system, including native Windows. Co-authored-by: Create Something <micah@createsomething.io>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 42144a435c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Reconcile candidate outcomes and sealed findings, validate full phase closures and empty scopes, enforce bounded inventory traversal, and execute verification from the isolated plugin copy. Co-authored-by: Create Something <micah@createsomething.io>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ce7a58d6f7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Allow independently bounded exhaustive review receipts, bind the authoritative digest for all Git diff modes, and preserve valid POSIX colon filenames without relaxing Windows path safety. Add failing-first regressions against the real inventory verifier and workbench finalizer. Co-authored-by: Create Something <micah@createsomething.io>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 79a71258ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Stage the isolated Python verifier outside all model-writable roots before starting a scan. Bind reportable finding CWE, precise locations, severity, confidence, validation evidence, and attack-path closure to the authoritative candidate. Reject coverage surfaces that finalization cannot seal and document the exact durable-artifact mapping. Co-authored-by: Create Something <micah@createsomething.io>
ianw-oai
left a comment
There was a problem hiding this comment.
Blocking: the new verifier staging breaks the existing standard scan path. The required Linux, macOS, and Windows Node tests all fail with ENOENT for installed-plugin verifier scripts. Fix the staging contract and get the required tests green.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 205c9b0c27
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Verify sealed candidate and review artifacts again immediately after workbench recovery and before publishing completion. Materialize the actual installed plugin in the injection-resistant prompt fixture so the isolated verifier passes unchanged on Windows, macOS, and Linux. Co-authored-by: Create Something <micah@createsomething.io>
ianw-oai
left a comment
There was a problem hiding this comment.
Approved. The updated head fixes the installed-plugin test fixture and verifies authoritative coverage again after finalization.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2eebe71a8a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Validate host-attested inventory paths lexically so disappeared files remain durable deferred coverage, require the associated receipt surface to signal follow-up, and normalize supported list-valued change conditions into the canonical finding schema. Prove each edge case with failing-first real-helper regressions. Co-authored-by: Create Something <micah@createsomething.io>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 03fab8298d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Seal the exact attested inventory and normalized candidate ledger alongside exhaustive review receipts. Preserve independently reportable child instances, canonical severity fields, escaped-path security, and deferred files after deletion; independently verify every protected input and final finding. Co-authored-by: Create Something <micah@createsomething.io>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d9af3e8a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Reject a Python verifier inside model-writable scan state before starting Codex, bind deferred coverage to its exact validated proof gap, and regression-test protected interpreter, complete sealed provenance, independent child findings, and finalizer recovery. Co-authored-by: Create Something <micah@createsomething.io>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fd5c83c9f2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6657295895
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…itative-scan-inventory # Conflicts: # sdk/typescript/tests-ts/scan-recovery.test.ts
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: def145009f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8dd1f65177
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 64efc3e604
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8ddff07891
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 8ddff07891
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 73500c1926
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fcdd06c135
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: fcdd06c135
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
.git,node_modules, or symlink entries.scan.scope.excludePaths,coverage.excludePaths, andcoverage.explicitExclusions; preserve explicitly requested dependencies even when a broader repository or package scope overlaps them or a requested scope disappears during the scan.Why
A standard scan cannot honestly claim full coverage if discovery silently omits an inaccessible directory or symbolic link, its bundled instructions regenerate a smaller filtered file list, an explicitly requested scope disappears, built-in exclusions are presented as an empty scope, the model can replace and restore the inventory it actually consumes, or the final coverage omits inventoried files. Likewise, a valid scan must not fail finalization because a model-authored target kind conflicts with the sole target kind permitted by the workbench.
Contributor credit
Builds directly on @createsomethingtoday's thorough scoped-inventory design, real scan reproductions, and singleton target-binding fix in #71. The hardening commit includes the original contributor as an explicit Git co-author and preserves the original standard-workflow and finalizer improvements.
Verification
ab3b91c8b1fc0403d7fd6ae35a3a46f7fb2a470f; exact reviewed head:6ae935ef00187c12869b5a61af711972400aa48b.gitHead=6ae935ef00187c12869b5a61af711972400aa48band the current^22.13.0 || ^24.0.0 || ^26.0.0Node engines.git diff --checkpass.node-ci30502627963 (all seven Node/OS jobs passed) andcontainer-ci30502627900 (Linux amd64 passed).