fix(deep-scan): recover complete coverage without hiding incomplete worker results

plugins/codex-security/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-security",
-  "version": "0.1.79",
+  "version": "0.1.84",
   "description": "Codex Security workflows for security scans, analysis, and investigation.",
   "author": {
     "name": "OpenAI"

plugins/codex-security/scripts/finalize_scan_contract.py

@@ -44,6 +44,18 @@
     "directory_snapshot": {"snapshotDigest"},
 }
 DISPOSITIONS = {"reported", "no_issue_found", "rejected", "not_applicable", "needs_follow_up"}
+NON_COVERAGE_TARGET_WARNINGS = {
+    "Directory contents changed while the scan was running; "
+    "results were saved for the original snapshot.",
+    "The scanned Git repository became unavailable while the scan was running; "
+    "results were saved for the original revision.",
+    "Repository HEAD changed while the scan was running; "
+    "results were saved for the original revision.",
+    "Working-tree contents changed while the scan was running; "
+    "results were saved for the original snapshot.",
+    "The scan target became unavailable while the scan was running; "
+    "results were saved for the original revision or snapshot.",
+}
 SARIF_LEVELS = {
     "critical": "error",
     "high": "error",
@@ -1093,6 +1105,26 @@ def _recover_unsealed_coverage(
         partial = True
     if partial:
         coverage["completeness"] = "partial"
+    elif (
+        completeness == "partial"
+        and coverage.get("mode") == "deep_repository"
+        and coverage["surfaces"]
+        and not coverage["deferred"]
+        and all(
+            warning in NON_COVERAGE_TARGET_WARNINGS
+            or re.fullmatch(
+                r"Recovered finding [0-9]+: "
+                r"(?:normalized [a-z, ]+|retained stronger duplicate logical finding)\.",
+                warning,
+            )
+            or re.fullmatch(
+                r"Skipped malformed finding [0-9]+: duplicate logical finding\.", warning
+            )
+            for warning in warnings
+        )
+    ):
+        coverage["completeness"] = "complete"
+        warnings.append("Recovered Deep Scan coverage marked partial without deferred review work.")
 
 
 def _recover_unsealed_hardening(

plugins/codex-security/scripts/workbench_saved_results.py

@@ -47,6 +47,9 @@
 _PUBLICATION_FOLLOW_UP_WARNING = (
     "Saved scan evidence remains on disk; result publication needs follow-up:"
 )
+_UNVERIFIED_COVERAGE_WARNING = (
+    "Saved scan source is incomplete or has unverified coverage; coverage remains partial."
+)
 
 
 @dataclass(frozen=True)
@@ -460,6 +463,11 @@ def merge_saved_results(
     if frozen_source_digests is None or allow_frozen_legacy_parent:
         try:
             parent_manifest, parent = _read_saved_parent_result(scan_dir, scan_id)
+            if (
+                parent.get("complete", True) is not True
+                and _UNVERIFIED_COVERAGE_WARNING not in warnings
+            ):
+                warnings.append(_UNVERIFIED_COVERAGE_WARNING)
         except (ContractError, OSError, ValueError) as exc:
             if not stopped:
                 raise
@@ -490,13 +498,15 @@ def merge_saved_results(
             source_digests.update(parent_preserved_sources)
     paths: dict[str, str | None] = {}
     current_results: set[str] = set()
+    required_results: set[str] = set()
     reducer_outputs: list[tuple[Any, str, list[str], int]] = []
     reducer = _latest_successful_reducer(workers)
     latest_reducer: str | None = None
     if reducer is not None:
         try:
             latest_reducer = Path(reducer["result_manifest_path"]).relative_to(scan_dir).as_posix()
             paths[latest_reducer] = None
+            required_results.add(latest_reducer)
         except ValueError:
             warnings.append("Skipped a reducer result outside the scan directory.")
 
@@ -555,6 +565,8 @@ def reducer_output(directory: str, attempt: int, reducer_worker: Any) -> None:
                 current_path = Path(worker["result_manifest_path"]).relative_to(scan_dir).as_posix()
                 paths[current_path] = worker["id"]
                 current_results.add(current_path)
+                if worker["status"] == "succeeded":
+                    required_results.add(current_path)
             except ValueError:
                 warnings.append("Skipped a worker result outside the scan directory.")
 
@@ -578,6 +590,8 @@ def reducer_output(directory: str, attempt: int, reducer_worker: Any) -> None:
         except (ContractError, OSError, ValueError) as exc:
             if (scan_dir / relative).exists():
                 warnings.append(f"Preserved unreadable checkpoint {relative}: {exc}")
+            elif relative in required_results and _UNVERIFIED_COVERAGE_WARNING not in warnings:
+                warnings.append(_UNVERIFIED_COVERAGE_WARNING)
     if frozen_source_digests is not None:
         if frozen_source_digests.keys() - source_digests.keys():
             raise ContractError("Frozen stopped-scan checkpoint set is incomplete.")
@@ -762,28 +776,45 @@ def valid_finding(value: Any) -> bool:
         superseded = (
             worker_id is None
             and parent is not None
-            and parent.get("complete") is not False
+            and parent.get("complete", True) is True
             and relative != "parent"
             and (not stopped_parent_seal or relative in parent_preserved_sources)
         ) or (
             relative not in current_results
             and any(
                 saved_worker == worker_id
                 and saved_path in current_results
-                and current.get("complete") is not False
+                and current.get("complete", True) is True
                 for saved_path, current, saved_worker in sources
             )
         )
-        if (
-            (relative != "parent" or not parent_manifest)
-            and not superseded
-            and (
-                draft.get("complete") is False
-                or draft["coverage"].get("completeness") != "complete"
-            )
-            and coverage.get("completeness") in {"complete", "unknown"}
+        if relative in required_results or (
+            (relative != "parent" or not parent_manifest) and not superseded
         ):
-            coverage["completeness"] = "partial"
+            source_coverage = draft["coverage"]
+            source_completeness = source_coverage.get("completeness")
+            source_complete = draft.get("complete", True) is True
+            if (
+                not source_complete
+                or (
+                    source_completeness != "complete"
+                    and (
+                        worker_id is not None
+                        or relative in required_results
+                        or source_completeness != "partial"
+                        or coverage.get("completeness") == "unknown"
+                    )
+                )
+                or any(
+                    not isinstance(source_coverage.get(field), list)
+                    for field in ("surfaces", "explicitExclusions", "deferred")
+                )
+            ) and _UNVERIFIED_COVERAGE_WARNING not in warnings:
+                warnings.append(_UNVERIFIED_COVERAGE_WARNING)
+            if (not source_complete or source_completeness != "complete") and coverage.get(
+                "completeness"
+            ) in {"complete", "unknown"}:
+                coverage["completeness"] = "partial"
         if (
             superseded
             and not stopped
@@ -1012,7 +1043,11 @@ def valid_finding(value: Any) -> bool:
             used.add(item["id"])
             if field == "surfaces":
                 item.setdefault("receiptRefs", [])
-    if stopped or any(warning not in initial_warnings for warning in warnings):
+    if (
+        stopped
+        or _UNVERIFIED_COVERAGE_WARNING in warnings
+        or any(warning not in initial_warnings for warning in warnings)
+    ):
         coverage["completeness"] = "partial"
     if stopped:
         if not isinstance(coverage.get("deferred"), list):