[mldangelo-oai]

Part 38 of 46. Previous: #1160 · Next: #1162 · Stack index

Summary

Read finalized scan files and saved accounting without starting another authenticated Codex session when no follow-up prompt is requested.

Changes

• Add a saved-result path that locks the existing scan, validates its registration and original producer version, and returns the sealed artifacts.
• Return the persisted priced or unpriced usage receipt and report completion callbacks through the existing result interface.
• Keep Deep Scan execution on its prior path until the next PR connects final cost receipts.

Testing

Local checks for the implementation:

• Saved-result regressions passed for priced and unpriced usage receipts on the implementation checkout.

Ruff, the SDK build and portable source checks passed at this intermediate boundary; the comments-only source-size adjustment preserves the parsed Python code.

Checks against the complete stack passed: SDK and MCP typechecks, formatting, Ruff, the SDK build, portable plugin compatibility and its tests, focused recovery/accounting tests, and local-artifact package smoke using exact cached dependencies. The package check was not a clean registry install. See this PR’s Checks tab for CI results for its current commit.

Risk and rollout

The new shortcut applies to Standard scans, including diff targets, with sealed artifacts, a saved scan recipe and no post-scan prompt. Native scans without a saved recipe still go through preparation. Missing accounting can still reject operations that require cost tracking.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T18:08:49.940671Z	51bfdd3	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-04T18:08:59.132734Z	51bfdd3	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot review overview

🟡 Changes recommended

A seal-check race can still send a completed Standard scan through the Codex session path.

Review effort: Balanced
Findings: 1

Open (1)

• Handle scans sealed during registration before resuming Codex work · New

What changed in this PR

Adds saved-result replay for completed Standard scans without starting a new Codex session.

Changes:

• Loads sealed reports and cost receipts through the workbench.
• Relaxes session requirements for sealed scans while retaining Deep Scan resume behavior.
• Adds saved-result and accounting regression coverage.

File	Description
sdk/​typescript/​src/​api.ts	Adds the sealed Standard-scan result path.
sdk/​typescript/​src/​scan-publication.ts	Reads saved costs and publishes sealed results.
sdk/​typescript/​src/​scan-registration.ts	Allows sealed resumes without session logs.
sdk/​typescript/​src/​deep-scan-checkpoint.ts	Removes retired checkpoint metadata.
sdk/​typescript/​tests-ts/​scan-sealed-resume.test.ts	Tests sealed Standard and Deep Scan recovery.
sdk/​typescript/​tests-ts/​support/​usage-rollout.ts	Adds a token-usage event helper.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[faizan-oai]

Confirmed by tracing this PR's current head 2d36b8b: only the early sealed branch checks registered.sealed; the later ordinary registerScan destructuring does not consume it before starting/resuming Codex. The current stack tip handles the later registration result, via the code added in #1162 (sealedTurn plus the sealed && !postScanPrompt return). Please move that correction into #1161 so this PR is independently safe across the seal/registration race. This is a source-path confirmation; I have not reproduced the timing race end to end.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d65cc09302

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve persisted usage when reading completed scans

When the scan becomes database-complete before this read, the workbench record can contain a persisted usage receipt, but this branch never reads it: an unpriced scan returns turnResult.usage as null, while a priced scan reconstructs usage from cost and drops fields such as reasoning tokens and receipt coverage metadata. This can occur in the supported completion race after get-cli-scan-resume; initialize the returned usage from the saved record and derive it from cost only as a fallback.

Useful? React with 👍 / 👎.

[faizan-oai]

The common sealed-resume path looks good, but the existing registration-race concern still applies at this PR's head. If the initial filesystem seal check is false and registration subsequently returns sealed=true, the ordinary path does not consume that flag and still creates a Codex thread. #1162 adds the post-registration sealed-result handling. Please move that correction into this PR so the intermediate commit meets its no-extra-Codex-work guarantee. Holding approval until that boundary is fixed.

[alandelong-oai]

Reviewed the saved Standard-result path with three independent passes and root verification. Two existing P2 comments remain confirmed: (1) sealing between the early hint and registration still starts a model session, and (2) recovery drops a persisted usage receipt for an unpriced model. I reproduced the first by sealing during runtime preparation before registration; the SDK then called resumeThread. For the second, the real workbench retained the complete usage receipt while the returned SDK turn contained usage: null.

Validation: 43 tests passed across the sealed-resume and resume suites. Declaration compilation and an ES2022 consumer with Node types passed. The moved disposable-library directive is undesirable but did not cause a failure in that supported consumer. The malformed-manifest candidate already fails in the base workbench and is not an introduced regression. No repository files were changed.

[alandelong-oai]

Three independent restack passes and root reconciliation are complete.

Persisted unpriced usage is now returned correctly. The existing seal-completion race remains at this own head: after the early file check, registerScan can return a sealed result, but the normal-path destructuring ignores it and proceeds to resume Codex. The later #1162 path consumes that sealed registration before launching work. Approval remains withheld for this remaining P2.

Approval remains withheld. This review distinguishes the PR's own head from fixes verified later in the stack; it does not duplicate existing inline findings.

[alandelong-oai]

Re-reviewed the real PR diff at 528e82126a16e3e2a66b937808b646979b87bad5. The patch is unchanged from the prior three-pass review. I reconciled the inherited changes in touched files and retained the prior verified findings and tests.

Persisted unpriced usage is now returned correctly. The existing seal-completion race remains at this own head: after the early file check, registerScan can return a sealed result, but the normal-path destructuring ignores it and proceeds to resume Codex. The later #1162 path consumes that sealed registration before launching work. Approval remains withheld for this remaining P2.

Validation across touched paths at branch tip 06e75cfe: 1,356 SDK tests, 867 Python tests plus 100 subtests, and 108 MCP tests passed; builds, types, portable checks and installed-package checks passed. These are integration checks at the branch tip, not a claim that every intermediate PR or its CI is clean. Current CI still contains failed, canceled, or pending checks; this review does not establish merge readiness.

[alandelong-oai]

Retained the three independent passes for the identical patch and reconciled inherited touched-file changes at f3838de63b30.

Persisted unpriced usage is now returned correctly. The existing seal-completion race remains at this own head: after the early file check, registerScan can return a sealed result, but the normal-path destructuring ignores it and proceeds to resume Codex. The later #1162 path consumes that sealed registration before launching work. Approval remains withheld for this remaining P2.

Current tip 355ec321 passed 75 report-projection tests, portable source checks, SDK build:ci and plugin build. The immediately preceding tip fec36f1d passed 1,360 SDK tests, 873 Python tests plus 100 subtests, 109 MCP tests, builds/types and the clean 600-entry installed-package check. Only report_projection.py and its test changed between those tips; SDK/MCP runtime files are byte-identical. Both descend from main 008a8b4d. These are integration checks, separate from own-head probes. No native Windows local run.

Approval remains withheld for the findings above.

[alandelong-oai]

Completed three fresh independent full-diff reviews and root verification at 9e2d61b43090.

Persisted unpriced usage and archived-session recovery are fixed. The existing seal-completion race remains at this own head: after the early file check, registerScan can return a sealed result, but the normal-path destructuring ignores it and proceeds to resume model execution. Only the archived-session option changed in the touched files since the prior verified head; the later #1162 registration path consumes that sealed result.

Integrated tip 6ef8cbb8, based on 008a8b4d, passed 1,388 SDK tests, 879 Python tests plus 100 subtests, 109 MCP tests, portable checks, builds and the clean 600-entry installed-package check. These are branch-tip integration checks, separate from own-head probes; no local Windows execution was performed.

Approval remains withheld for the findings above.

[alandelong-oai]

Completed three independent full-diff passes and root verification at 57a9f5cf11da.

Persisted unpriced usage, archived-session recovery and sealed missing-path normalization are fixed. The existing own-head completion race remains: after the early sealed-artifact check, registerScan can return a sealed result, but normal-path destructuring ignores it and resumes execution. The new normalization hint does not consume that registration result; #1162 does so later.

Branch tip 3e0083d9, based on 008a8b4d, passed 1,392 SDK tests, 881 Python tests plus 100 subtests, 109 MCP tests, builds, portable source checks and the 600-entry installed-package check. These are tip checks, separate from own-head probes. No local Windows run was performed. The tip excludes the dependency update merged separately in #1184; combined validation remains outstanding.

Approval remains withheld for the outstanding findings.