Preserve summary findings across review epochs

[kwakayama]

Explicit same-head code or security findings in a connector summary must block an older clean verdict, including when the code completion predates a review epoch or a finding update shares its timestamp. Treat authenticated summary updates as finding evidence and preserve ambiguous ordering; clean summaries retain completion, reaction and epoch requirements.

Validation: 193 focused test steps and strict Deno typecheck pass. Regressions cover findings without a detailed comment or reaction, later-clean recovery, older verdict edits, post-epoch findings and equal-time ambiguity. Branch review found no actionable regressions. The Node adapters in infrastructure, API and Studio agree with this candidate on 24 shared cases.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T07:37:44.233499Z	5ba886c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
src/index.client.ts	65	359 KiB	✅ 0
src/react/components/Head.tsx	5	74 KiB	✅ 0
src/react/router/index.tsx	5	74 KiB	✅ 0
src/react/context/index.tsx	5	74 KiB	✅ 0
src/react/fonts/index.ts	6	81 KiB	✅ 0
src/react/components/ui/index.ts	111	714 KiB	✅ 0
src/react/components/ui/adapter/contract.ts	1	18 KiB	✅ 0
src/react/components/ui/icons/index.ts	3	17 KiB	✅ 0
src/chat/index.ts	300	2010 KiB	✅ 0
src/chat/ag-ui.ts	59	451 KiB	✅ 0
src/chat/protocol.ts	1	11 KiB	✅ 0
src/chat/types.ts	45	240 KiB	✅ 0
src/chat/message-prep.ts	65	506 KiB	✅ 0
src/markdown/index.ts	6	30 KiB	✅ 0
src/mdx/index.ts	2	2 KiB	✅ 0
src/agent/identity-contracts.ts	1	2 KiB	✅ 0
src/schemas/index.ts	42	214 KiB	✅ 0
src/platform/env.ts	5	53 KiB	✅ 0
src/workflow/claude-code/react/index.ts	9	88 KiB	✅ 0
src/events/index.ts	30	561 KiB	✅ 0
src/events/ag-ui/public.ts	29	555 KiB	✅ 0
src/run-events/index.ts	53	314 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

[kwakayama]

Score: 82/100. The change correctly makes explicit same-head findings in an authenticated Codex summary block an older clean verdict, including at epoch boundaries.

• Strength: parseCompletedCodexStateMetadata now returns {head, hasFindings, clean} instead of rejecting finding summaries. Findings from either the code or security section are recorded as evidence and no longer dropped. This closes a real fail-open path in the review gate.
• Strength: Ordering is conservative. A finding summary with updatedAt === boundary.time is marked ambiguous, and an older updated_at is only dropped when freshness says older. Clean summaries keep the completion, reaction and epoch requirements. The waitsForReaction path correctly skips finding summaries.
• Strength: The four new tests cover code and security sections, later-clean recovery, an equal-timestamp epoch, a post-epoch finding with an older completion, and an older verdict edit. They exercise the main failure modes.
• Concern: The new test block is dense, with long single-line objects and calls. It probably doesn't match deno fmt, so check deno fmt --check and deno lint before queueing. The new describe block would also read better with the file's existing helper style.
• Concern (minor): A state block that is neither a finding nor clean (for example has_any_findings: null with status completed) is silently skipped via continue. Skipping is the safe outcome, but add a test or a comment saying it is intentional. Also, hasFindings now treats security.has_any_findings === true as blocking, where the old code checked only has_unresolved_findings. This is stricter, and the PR description should say so.

No blocking issues found. This is a CI gate script, so the exact head needs the required human review before it enters the merge queue. I only read the diff and did not run the tests.

---

Generated by Claude Code

[github-actions]

@codex review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[kojiwakayama]

Reviewed exact head 5ba886c. Standards and spec reviews found no actionable findings; inspected summary parser, exact-head resolution, epoch/finding ordering, later-clean recovery, and status publication callers. Independently ran pinned Deno 2.9.7 official test:file: 11 groups / 193 steps pass; strict JavaScript typecheck passes. Mandatory branch review is clear. Merge confidence 95%, subject to required review status and merge-group checks.

[kojiwakayama]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 5ba886c093

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud