[mldangelo-oai]

Summary

Scanner readers and Cloud publication use the current capture and checkpoint formats. This removes the code that inferred historical request identities during retries.

Review in order: #2602 → #2603 → #2604.

Changes

• Retire Semgrep Platform v1 and Snyk REST v1 capture readers and historical Cloud checkpoint matching.
• Keep current-format retries tied to the selected findings, destination and recorded receipts.
• Build private inbox payloads from the reviewed selection. For Wiz and Endor, reconstruct native records when the inbox requires them or the normalized payload exceeds its limit.

Testing

• Built the SDK, bundled plugin and CI tools. SDK and MCP type checks, the plugin source compatibility check and its nine tests passed.

• On rebased code, 470 scanner tests and 380 Cloud transport tests passed, including the physical-parent path regression. One Windows-only permission test was skipped on Linux. Formatting and Markdown checks also passed.

• Ran Trivy, Semgrep (JSON and SARIF), and OpenGrep on pinned public source checkouts. Across these inputs 216 eligible records imported, all 216 retained their IDs and versions on replay, and 19 ambiguous Trivy observations were excluded.

• Loaded published scanner reports for Snyk, Wiz, Black Duck, Checkmarx, Endor and Veracode. The checkpoint cleanup also passed 65 targeted retry tests, with one Windows-only skip on Linux.

Risk and rollout

This is a breaking reader and checkpoint change. Finish interrupted submissions with the client that created them. If the outcome is uncertain, inspect the inbox job or repository records before approving a fresh submission. Recollect archived Semgrep Platform v1 and Snyk REST v1 captures with the current collector. The command names and arguments stay the same.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[alandelong-oai]

Thanks for simplifying the scanner import path. This owner-level merge-safety review found no material issues across all 56 changed files. Current selection/destination binding and receipt-based retries remain intact. The intentional compatibility break is documented: finish pending submissions with the client that created them before upgrading.

On the latest head, SDK build/type checking, changed-file formatting and 380 publication tests passed; one Windows-only case was skipped. Another 743 reader/payload tests passed before the two-file cleanup, which leaves those inputs unchanged. No live Cloud service was used.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T18:02:06.366504Z	7590375	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-11T18:02:50.707606Z	7590375	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.