[mldangelo-oai]

Summary

Checked scan reads now retain exact file and directory identities so distinct large filesystem identifiers cannot compare equal after numeric rounding. Synthetic Git repositories also keep their LF line-ending setting local, avoiding inherited conversion warnings in Windows tests.

Changes

• Keep checked file, parent, and scan-root identities as BigInt stats through subsequent comparisons. Preserve the existing Windows device comparison, permission checks, and diagnostic text.
• Add deterministic file and directory replacement regressions using distinct identifiers that round to the same Number, plus an unchanged-file control.
• Set core.autocrlf=false at 19 disposable fixture initialization sites across 14 SDK test files. Explicit line-ending conversion tests retain their own overrides.
• Merge current main while retaining the fixture changes.

Testing

• Focused contract, custom-validation, and import tests: 178 passed, 0 failed.
• The unchanged-file control passes on the pre-fix baseline; both new replacement regressions fail there and pass with the fix.
• tsc --noEmit and the bundled plugin build passed. The build reused unchanged, source-matched native payloads.
• SDK types and full formatting checks passed.
• The full seeded (12345) SDK suite is running. The unseeded full suite is deferred to avoid competing for test-host capacity; hosted Windows qualification remains pending. The historical Windows failure did not record filesystem identifiers, so its precise cause is not asserted here.

Risk and rollout

The identity change preserves existing scan-file protections without changing serialized scan data or public CLI/SDK surface. Permission checks still receive the same mode and owner values, and the Windows device fallback remains intact. Fixture-local Git settings affect only disposable test repositories.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T15:01:35.419431Z	587c86f	New commits
🔒 Security Review	✅ Completed 2026-10-22T15:02:09.294625Z	587c86f	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for the cleanup. This owner-level merge-safety review at 147daa6 found no material issue. All 19 settings are local to disposable Git fixtures and occur before the relevant Git operations; explicit conversion coverage and production Git behavior remain intact.

With inherited core.autocrlf=true, 35 focused cases passed and two platform cases skipped. Six failures reproduced on the exact base: existing fixture ownership/Git-boundary limitations and an unchanged sparse-checkout expectation under conversion. The changed fixture cohort emitted no line-ending warnings. Types, changed-file formatting and the plugin build passed.

Native Windows behavior and the full SDK suite were not exercised locally.

[alandelong-oai]

Thanks for the fix. This owner-level merge-safety review at 587c86f found no material issue. File, parent and scan-root identities stay exact through comparisons; permission checks, the Windows device fallback and public results retain their behavior. All 19 Git settings stay local to disposable fixtures.

Types, formatting and SDK/plugin builds passed, along with 10 import-boundary and 10 inherited-CRLF fixture cases. The directory-ID collision regression passes on head and fails with the exact base implementation.

The broader contract/custom-validation run had 12 passes and 121 failures at the local environment’s existing output-ancestry boundary; two MCP fixture cases hit that boundary too. Both new file-identity cases are blocked there on base and head. Full Windows SDK CI is still running; it is not represented as passed.