feat: persist resumable local findings workflows

[kmbroai]

Summary

Make the local scan → custom publication → dedupe workflow resumable between completed steps, using the existing workbench SQLite database.

Stacked on #667, with individual review checkpoints in #674. This update includes the current parent, canonical plugin source layout, and screening/pair deduplication. Neither PR is merged into its base.

Changes

• Add the approved optional --workflow-id ID to scan, publish scan --to custom, and dedupe, plus corresponding SDK workflowId options. Without it, existing behavior is unchanged. Publication and dedupe can resolve the saved scan from the workflow instead of requiring --scan.
• Record scan ID and artifact directory atomically during registration. Recover completed scans even when their workflow receipt was not saved; retry unfinished stages without repeating acknowledged work.
• Persist immutable scan/artifact identity, destination and scope, stage status, receipts, errors, and exact dedupe results, including successful empty results. Workflow dedupe completes missing publication first.
• Use explicit SQLite columns for metadata and retain JSON only for receipts and result/write payloads. Existing append-only migrations preserve records, timestamps, references, and atomic updates.
• Keep workflow metadata outside sealed artifacts and retain existing output shapes and source authorization.
• Move the helper into the canonical plugin source, retain the runtime package contract, and support the existing helper --help check. Align canonical Python schema tests with this branch's existing migrations; SQL is unchanged.
• This integration adds no public CLI syntax beyond the previously approved workflow option.

Testing

Current integration at f6b60100:

• Focused integration tests: 230 passed, zero failures.
• Full SDK suites passed with fixed seed 12345 and randomized seed 44458130: each had 1,993 passed, 29 skipped, and zero failures.
• Canonical plugin generation/source ownership, generated-model consistency, TypeScript checks including MCP, formatting, and git diff --check passed.
• Canonical Python migration/setup, scan indexing, coordinator, and helper-help checks: 64 passed. Verified that all existing SQL migration tuples and helper functions are unchanged by this integration.
• Docker smoke passed from a tracked source snapshot with no pre-generated host plugin: host publication, embeddings/SQLite storage, workflow resume, dedupe/group writes, repeated invocation without additional reviews, restart persistence, and clean shutdown.
• The Docker-built npm archive passed package and installed-consumer checks: 364 entries, including 120 plugin files. Verified public imports, NodeNext types, CLI, credential locking, MCP initialization, bundled Codex, and nested-worker startup without global Codex. Test fixtures are excluded.
• Scoped workflow lint passed.
• Hosted CI is tracked by the checks attached to the current PR commit; these results describe local verification.

Risk and rollout

Opt-in behavior with append-only SQLite migrations. The column migration retains existing IDs and payloads without rebuilding the table or disabling foreign keys. Use updated workflow/checkpoint code after upgrading the schema; old state_json readers are incompatible with the migrated table.

Use one coordinating process per workflow. Reusing an ID with a different scan, destination, or bound repository scope fails; use another ID for another workflow. Unfinished scans retain existing output-directory and archive safeguards. This PR resumes between stages, not inside an unfinished scan or dedupe review. Lost publication acknowledgements retry the existing idempotent upsert. #674 checkpoints individual reviews and pending group writes.

Local verification uses Linux and synthetic provider responses. Native Windows execution and live model reviews were not run locally. No release, image publication, or PR merge is performed by this update.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-27T05:11:51.946708Z	2212f5f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[zcrab-oai]

Two validated findings introduced in this PR: cross-repository workflow reuse and incomplete scan recovery metadata.