[mldangelo-oai]

Summary

CSV exports can contain several occurrences of one finding, but importing or publishing those exports rejects the repeated finding ID. Leading apostrophes can also be mistaken for spreadsheet formula escapes and lost during import.

Changes

Keep occurrence IDs as the CSV row identity, including for cloud publication previews. Escape literal leading apostrophes during export so new exports round-trip through import while retaining spreadsheet formula escaping. Match the exporter’s Unicode whitespace rules when removing those escapes. Document the ambiguity in older CSV exports and the JSON recovery option.

Testing

• Import/export regressions reproduce repeated-identity, literal-apostrophe, and Python/JavaScript Unicode whitespace mismatches against the previous implementation.
• Focused import/publication suites: 43 passed, 156 assertions. Python CSV coverage: 14 tests passed, including 5 subtests.
• Final SDK seeded suite: 3,574 passed, 53 skipped, 0 failed (--seed 12345).
• Final randomized full SDK suite: 3,574 passed, 53 skipped, 0 failed (seed 2073818745).
• SDK types and formatting passed on the final commit. Build:ci, plugin Ruff check/format, source compatibility, and all 9 checker tests passed before the TypeScript-only whitespace correction.
• Windows fixture decoding was checked with legacy cp1252 stdin settings; all six import tests passed using the failing CI seed 4226971147.
• Three independent native reviews and fresh independent verification passed on the final commit.

Risk and rollout

No command, flag, or default changes. Distinct occurrence IDs remain required. Older exports can contain inherently ambiguous apostrophe prefixes; this change cannot reconstruct those original values. CSV publication now derives distinct stable identities from source occurrences.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T12:18:31.317757Z	fd6aeb2	New commits
🔒 Security Review	✅ Completed 2026-10-05T12:19:26.606474Z	fd6aeb2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a37616e980

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

Reviewed the full contribution at fd6aeb27dfb43a805994deeaa8468d8fb8e4e883 with selected base e4eff6521926241c1ad1df1bb6395b71135e56d3, including changed tests and touched context, using three independent reviews followed by root synthesis.

No supported introduced finding.

Static source review; tests were inspected but not executed. CI, mergeability and integration are separate.