[mldangelo-oai]

Summary

Codex can use a scanner executable, a hosted collector, a connected MCP tool, or a saved report to fulfill an import request. A later request to publish starts with the findings already in the workbench.

Review in order: #2602 → #2603 → #2604.

Changes

• Give the agent concrete acquisition guidance for tools such as Trivy, Semgrep, Guardian and GitHub. Let it inspect available tools and write a parser when a built-in reader does not cover the export.
• Route local imports and reviewed Cloud publication through the SDK. Preserve the existing CLI commands and flags.
• Add routing examples, CLI help, diagrams and an offline Trivy and Guardian walkthrough. The published scanner-import workflow can use the same examples.

Testing

• All 40 CLI help tests and 13 routing-harness tests passed after rebasing. Both compiled help entrypoints displayed the new guidance.

• Ran the documented offline example with the built SDK, bundled plugin and real SQLite. It stored one Trivy finding and one Guardian finding, kept the exact selected Guardian ID, and recorded two imports and zero publications.

• Exercised fresh Trivy, Semgrep and OpenGrep scans plus GitHub and SonarCloud API data. A parser written for a public advisory API imported five records with the installed SDK, preserved the original evidence on replay and rejected a stale selection after an upstream revision changed.

• The native model-routing evaluation stopped before a model turn with HTTP 401. The routing checks above exercise the deterministic harness.

Risk and rollout

Use the matching SDK and plugin. Tool availability and vendor sign-in depend on the user’s environment. The offline walkthrough uses recorded inputs and requires no vendor account.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[alandelong-oai]

Thanks for the clear acquisition-to-workbench workflow. This owner-level merge-safety review found no material issues in the stacked diff. The skill reuses the readers and SDK, retains exact selections and explicit Cloud upload approval, and documents retries against the approved finding versions.

Verified 40 CLI help tests, 13 routing-harness tests, nine portable compatibility tests, Ruff, focused formatting, TypeScript checking, SDK/plugin builds, and both compiled help entrypoints. The documented offline walkthrough also passed with real SQLite: two imports, the exact selected Guardian string ID, and zero publications. Live scanner/MCP acquisition and Cloud upload were not exercised.

[alandelong-oai]

Thanks for clarifying the stored-publication calls and partial-import handling. This owner-level merge-safety re-review found no material issues in the updated ten-file stacked diff. The skill’s SDK calls, approval steps and partial-import exit status match the implementation.

On this head, 40 CLI help tests, 13 routing-harness tests, nine portable compatibility tests, SDK/plugin builds, type checking, Ruff and both compiled help entrypoints passed. The documented offline walkthrough also passed with real SQLite: two imports, the exact selected Guardian string ID, and zero publications. Live scanner/MCP acquisition and Cloud upload were not exercised.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T18:51:06.825787Z	1f710a3	New commits
🔒 Security Review	✅ Completed 2026-11-11T18:54:08.151456Z	1f710a3	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks—this owner-level merge-safety re-review of ec6c5912 found no material issues in the ten-file stacked diff. The guidance matches the current SDK’s local import, exact version selection, approval and retry behavior.

Fresh verification passed 100 CLI/import tests, 13 routing-harness tests, nine portable compatibility tests, SDK/plugin builds, type checks and formatting. Both compiled help entrypoints and the documented offline walkthrough passed; real SQLite contained two imports, the exact selected Guardian string ID and zero publications. Live scanner/MCP acquisition, Cloud upload and model routing were not exercised.

[alandelong-oai]

Thanks for updating the scanner-import and workbench guidance. Owner-level merge-safety re-review of 1f710a3: no material findings in the ten-file diff. The acquisition guidance and updated collector examples match the current SDK and CLI. Publication uses stored finding versions, explicit preview approval, and existing receipt/retry handling.

Fresh verification passed 107 CLI/import tests, 13 routing-harness tests, nine portable compatibility tests, SDK/plugin builds, type checks, Ruff and formatting. Both compiled help entrypoints and the documented offline walkthrough passed; real SQLite contained two imports, the exact selected Guardian ID and zero publications. Live scanner/MCP acquisition, Cloud upload and model routing were not exercised.