[mldangelo-oai]

Summary

An SDK caller can save scanner findings locally and later publish an import or selected finding versions from the workbench. Publication uses the stored evidence, so the original report and vendor credentials are unnecessary.

Review in order: #2602 → #2603 → #2604.

Changes

• Store import membership, including unchanged findings, alongside the versions and provenance used for review.
• Group selected findings by provider and source key, show exclusions, and reuse the Cloud preview, upload and retry transport. A changed selection requires fresh approval.
• Record acknowledgements against the local versions and Cloud destination before retiring the repository upload checkpoint. A retry can repair a failed SQLite write without uploading again. Repository uploads retain per-item outcomes. Private inbox uploads use the completed job receipt.
• Append SQLite migration 72 for the import tables. The native helper can initialize these tables while Python retains ownership of the repository identity migrations at versions 67–71.

Testing

• 128 Node workbench tests and 186 Python workbench tests passed across runs, along with eight path and repository identity tests. One Windows-only Python test was skipped on Linux.

• Opened a schema 71 database in Node, imported a finding, recorded a receipt and reopened it in Python. The pre-existing finding survived and the foreign-key integrity check passed.

• All seven stored-publication tests passed against a local HTTP fixture and real SQLite. They include forcing SQLite to reject a receipt after a successful upload, then retrying with the original approval and verifying the original receipt and exactly one POST. No shared Cloud deployment was used.

• SDK build, SDK and MCP type checks, CI script build, plugin compatibility and its nine tests passed on the final combined tree.

• Imported real public advisory and issue API responses from GitHub and SonarCloud, replayed them into SQLite and verified the versioned selections against a local HTTP service. The first 460 records produced 460 verified readbacks and receipt links in eight batches. A separate 293-advisory run resumed an interrupted three-batch submission.

• A public CxSAST scan produced 714 accepted findings and 137 explicit exclusions. File and stored preview matched and all eight upload batches verified. Twelve public captures from six commercial providers produced a further 356 verified local links.

• Forced a second-batch conflict, a SQLite receipt failure and a repository reset. Recovery kept the first batch’s original acknowledgements and required fresh approval for the reset destination. A separate test restored identical evidence at a later local version and verified that it could not acquire the original receipts.

• Reproduced the large-selection SQLite iterator failure on Node 22.13.0, then repeated the fixed operation five times under GC pressure. The workbench tests also passed on Node 24.

Risk and rollout

A whole-import selection becomes stale when one of its finding versions changes. Prepare a new preview before publishing the updated evidence. Tenable and custom provider names remain available locally and appear as exclusions when the Cloud contract does not support them.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[alandelong-oai]

Thanks for adding publication from stored evidence. This owner-level merge-safety review found no material issues across all 41 changed files against the stacked base. Version-pinned selections and per-source approvals reuse the shared Cloud transport, and receipts remain attached to the versions actually uploaded.

Verified SDK/plugin builds, SDK/MCP types, Ruff and formatting, 625 SDK tests, 128 workbench tests, 190 Python migration and boundary cases, and nine compatibility tests. Two Windows-only cases were skipped on Linux; no live Cloud service was used.

[alandelong-oai]

Thanks for tightening receipt recovery and large-selection handling. This owner-level merge-safety re-review found no material issues across all 42 changed files. Acknowledgements are persisted before checkpoint retirement on success, conflicts and repository resets; retries remain tied to the approved local versions.

Fresh verification passed: 650 SDK tests, 128 Node workbench tests, 292 Python migration/Deep Scan tests, nine compatibility tests, builds, type checks, lint and formatting. Two Windows-only cases were skipped. On Node 22.13, ten selections of 714 large findings passed under forced garbage collection. No live Cloud service was used.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T18:27:02.955468Z	056da6b	New commits
🔒 Security Review	✅ Completed 2026-11-11T18:27:20.741518Z	056da6b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b9540f4860

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

This owner-level merge-safety review confirms the existing Sonar retry finding. With real SQLite and a simulated Cloud-accepted upload whose response is lost, both the original capture and a newly reviewed capture fail confirmation. The refreshed preview discovers expected_version=1 while stored publication resumes expected_version=0; exactly one POST occurs. Preview and confirmation need the same checkpoint scope, with a regression test for this recovery flow. No duplicate inline comment added.

Fresh checks passed: 650 SDK tests, 128 Node workbench cases across the initial run and one environment-only retry, 440 Python tests, nine compatibility tests, builds, types, lint and formatting. Two Windows-only cases were skipped. Ten large selections also passed on Node 22.13 under forced garbage collection. No live Cloud service was used.

[alandelong-oai]

Thanks for fixing Sonar retry recovery. This owner-level merge-safety re-review found no material issues across the 42-file contribution. The prior checkpoint finding is resolved: lost responses and failed readbacks resume correctly, while changed local versions and destinations still require fresh approval.

Fresh validation passed: 414 SDK tests (one Windows-only skip), 128 Node workbench tests, four independent recovery scenarios, minimum-Node selector checks, builds, types, lint and formatting. Prior evidence of 440 passing Python tests remains applicable after verifying their source, tests and dependencies are unchanged; those tests were not rerun. No live Cloud service was used.