feat(sdk): publish findings through durable concurrent batches by kmbroai · Pull Request #453 · openai/codex-security

kmbroai · 2026-08-15T08:10:47Z

Summary

Publish prepared security findings in bounded concurrent batches and derive final results from validated durable records stored in local scan history.

Changes

Group connected Linear issue creation into batches of at most 20 findings.
Write finding-to-issue mappings into a private durable handoff instead of trusting model-generated summaries.
Validate exact finding, occurrence, destination, team, optional project, title, description, and priority before importing publication records.
Preserve team-only publication through private handoffs, recovered issue mappings, SQLite records, receipts, and results without inventing a project identifier.
Read final issue identities, URLs, and receipts back from the transactional workbench store.
Keep database-backed issue creation successful if its optional receipt fails, returning a sanitized warning without rerunning remote mutations.
Preserve partial successes, recover incomplete handoffs, and retain recoverable mappings if database persistence fails.
After cancellation, await Codex process-tree termination, persist verified completed issues, write an accurate partial receipt, and retain the private handoff with duplicate-avoidance recovery instructions.
Keep CLI commands, interactive presentation, and end-to-end CLI integration out of this SDK layer.

Testing

Real SQLite publication-store, connected-app event validation, and durable publisher tests: 70 passed with 286 assertions.
Verified a 41-finding 20 + 20 + 1 batching boundary, malformed or absent Codex output, out-of-order completion, exact destination validation, partial failures, and durable recovery.
Consolidated recovery assertions into the stronger case preserving both written and independently salvaged issue mappings when database persistence fails.
Verified pre-aborted requests, cancellation during preparation, interrupted partial imports, database failures, receipt failures, retained private handoffs, and real signal-resistant child processes.

Risk and rollout

Publication still uses the existing authenticated Codex profile and connected Linear app.
No issues are created before validating the completed local scan and every finding association.
Stacked on the workbench publication-persistence layer.

Public disclosure review

No customer, partner, prospect, or user identities, data, or identifying details are included.
No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

soyeon-oai

Reviewed the exact PR delta and exercised the stacked CLI against a real synthetic Linear publication. I found three durability/verification issues.

soyeon-oai · 2026-08-15T21:08:11Z

+    const eventFailure = eventFailed.get(issue.findingId);
+    if (
+      saved === undefined &&
+      !observed.has(issue.findingId) &&


[P1] Do not let a model-authored failure override a verified successful tool event. In a live synthetic E2E, the runtime observed and displayed a created Linear issue, but the handoff writer then failed and emitted a failure record; observed blocked this salvage path, so the CLI returned created: 0, persisted no association, deleted the handoff, and left the real issue remote. A retry would duplicate it. Prefer the exact-argument completed tool receipt, or retain recovery state and report an indeterminate outcome.

This was reproduced in my e2e.

failed in cli, but ticket was created.

# Conflicts: # sdk/typescript/tests-ts/publish.test.ts

# Conflicts: # sdk/typescript/src/publish.ts # sdk/typescript/tests-ts/publish.test.ts

soyeon-oai

Additional issues reproduced during E2E review on the latest stack (#453 86384db; integrated CLI #455 1fd8b0d; identical publisher source).

soyeon-oai · 2026-08-15T22:21:26Z

+      );
+      continue;
+    }
+    if (observed.has(issue.findingId)) {


[P1] Preserve both successful issue IDs when duplicate handoffs are detected.

Found during E2E review:

completed issues: SYNTH-DUPLICATE-A, SYNTH-DUPLICATE-B CLI: created=0, failed=1 | SQLite associations=0 | recovery handoffs=0

Detecting duplicates is correct, but discarding both IDs and deleting the handoff makes already-created issues unrecoverable. Persist the verified IDs or retain the handoff and report an indeterminate outcome.

soyeon-oai · 2026-08-15T22:21:26Z

+      handoffResults.created,
+    );
+    try {
+      result.created = await (


[P2] Prevent concurrent publications from overwriting successful receipts.

Found during E2E review:

concurrent publication A: success concurrent publication B: success SQLite associations=2 | issues in the shared scan receipt=1

Fresh issues on republish are documented; silently losing one successful run from the scan-keyed receipt is the defect. Serialize same-scan publication or write attempt-scoped receipts.

soyeon-oai · 2026-08-15T22:21:26Z

+    environment,
+  );
+  options.signal?.throwIfAborted();
+  const handoff = await createPublicationHandoff(prepared, environment);


[P2] Remove source-bearing handoffs when the publisher cannot start.

Found during E2E review with a missing CODEX_CLI_PATH:

CLI exit=2 | spawned processes=0 | remote mutations=0 retained publication.json=1447 bytes | finding description=1011 bytes

The startup rejection bypasses cleanup, leaving finding details and source locations on disk despite no recoverable remote operation. Delete pre-mutation handoffs on startup failure.

# Conflicts: # sdk/typescript/src/publish.ts # sdk/typescript/tests-ts/publish.test.ts

# Conflicts: # sdk/typescript/scripts/check-package.mjs

The base branch was changed.

kmbroai added 19 commits August 15, 2026 05:59

feat(sdk): publish scan findings through connected Linear app

a685b07

feat(sdk): prepare security findings for publication

078966b

feat(sdk): stream scan publication progress events

5e7b105

fix(sdk): use Luna low effort for Linear publication

5ddd5dd

fix(sdk): avoid redundant upload identifiers in findings

4822111

Merge commit '4822111' into dev/kyleb/linear-publish-engine

5bedb20

fix(sdk): recognize connected Linear issue creation results

a34f486

feat(sdk): persist finding publication associations

405b00d

feat(sdk): batch finding publication through durable database handoffs

d71a863

fix(sdk): require concurrent Linear issue creation per batch

83aff49

test(sdk): consolidate durable publication regressions

94b8388

test(sdk): consolidate connected Linear publication coverage

2cb6e6b

merge: inherit focused publication engine tests

5926306

merge: inherit focused publication parser coverage

69a2b72

fix(sdk): match Linear publication results by finding identity

72f6830

Merge commit '72f683077af7831fa91d12b3d2732691b0048b6c' into HEAD

8b9f2a6

Merge commit '8b9f2a61e51db2f2fa26cf5ca71bad866ee9ed03' into HEAD

a6f150f

fix(sdk): reconcile publication handoffs by stable finding IDs

6e9fa3b

fix(sdk): preserve full Linear issue descriptions during publication

f0d54b3

kmbroai marked this pull request as ready for review August 15, 2026 19:30

wholley-oai previously approved these changes Aug 15, 2026

View reviewed changes

soyeon-oai reviewed Aug 15, 2026

View reviewed changes

kmbroai added 8 commits August 15, 2026 21:27

fix(sdk): preserve partial Linear publications on cancellation

aca4db5

fix(sdk): terminate Linear publication process trees on cancellation

8e1a4e2

Merge Linear publication cancellation support into persistence

1b67824

Merge cancellable Codex process lifecycle into durable publication

b335c58

# Conflicts: # sdk/typescript/tests-ts/publish.test.ts

fix(sdk): preserve created Linear issues when receipt writes fail

57c51bb

Merge verified Linear receipt warnings into publication persistence

0235843

fix(sdk): report persisted Linear issues when receipts fail

1126732

Merge verified receipt warnings into durable Linear publication

86384db

# Conflicts: # sdk/typescript/src/publish.ts # sdk/typescript/tests-ts/publish.test.ts

soyeon-oai reviewed Aug 15, 2026

View reviewed changes

kmbroai added 17 commits August 15, 2026 22:47

feat(publish): allow team-only Linear publication destinations

5b18c90

feat(publish): support connected Linear team-only publication

a3d080b

Merge optional Linear destination contract into publication engine

b2b7e92

test(publish): keep optional destination assertions well typed

a86b22a

feat(workbench): persist team-only Linear publications safely

0441a8e

Merge optional Linear publication contract into SQLite persistence

c384a92

feat(publish): preserve team-only durable Linear handoffs

df565a8

Merge optional Linear destination persistence into durable publisher

39a9f89

# Conflicts: # sdk/typescript/src/publish.ts # sdk/typescript/tests-ts/publish.test.ts

fix(publish): preserve every sealed scan coverage mode

8ace470

Merge truthful sealed scan provenance into publication engine

2b67f38

Merge truthful sealed scan provenance into publication persistence

17797bb

Merge truthful sealed scan provenance into durable publication

61985a3

Merge main after sealed publication foundation landed

8003667

# Conflicts: # sdk/typescript/scripts/check-package.mjs

Merge resolved main publication base into workbench persistence

3e66ffc

Merge resolved main publication base into durable publication

ec1421f

Merge main after connected publication engine landed

15acebe

# Conflicts: # sdk/typescript/scripts/check-package.mjs

Merge landed publication engine into durable publisher ancestry

f05d7a6

Base automatically changed from dev/kyleb/linear-publish-persistence to main August 16, 2026 00:47

github-actions Bot added the enhancement New feature or request label Aug 16, 2026

Merge main after publication persistence landed

7edd09a

Navigation Menu

Uh oh!

feat(sdk): publish findings through durable concurrent batches - #453

feat(sdk): publish findings through durable concurrent batches#453
kmbroai wants to merge 45 commits into
mainfrom
dev/kyleb/linear-publish-durable

kmbroai commented Aug 15, 2026 •

edited

Loading

Uh oh!

soyeon-oai left a comment

Uh oh!

Uh oh!

soyeon-oai Aug 15, 2026

Uh oh!

soyeon-oai Aug 15, 2026

Uh oh!

soyeon-oai Aug 15, 2026

Uh oh!

Uh oh!

soyeon-oai left a comment

Uh oh!

soyeon-oai Aug 15, 2026

Uh oh!

soyeon-oai Aug 15, 2026

Uh oh!

soyeon-oai Aug 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

kmbroai commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Risk and rollout

Public disclosure review

Uh oh!

soyeon-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

soyeon-oai Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

soyeon-oai Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

soyeon-oai Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

soyeon-oai left a comment

Choose a reason for hiding this comment

Uh oh!

soyeon-oai Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

soyeon-oai Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

soyeon-oai Aug 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kmbroai commented Aug 15, 2026 •

edited

Loading