feat: checkpoint dedupe reviews and replay group writes

[kmbroai]

Summary

Resume interrupted deduplication from validated review checkpoints and replay saved group writes after failure or a lost acknowledgement.

Stacked on #673. This update includes the current parent and canonical plugin source layout, and aligns checkpoint coverage with screening and pair reviews. Neither PR is merged into its base.

Changes

• Persist validated Luna screenings and Sol pair reviews in the local workbench database, including DISTINCT results and complete SAME decisions with required canonicalFindingId and generated mergedFinding.
• Use explicit SQLite columns for workflow metadata and checkpoint source/scope/model/hash bindings. Keep JSON only for receipts and result/write payloads. Existing append-only migrations preserve tables, foreign keys, review keys, results, and timestamps.
• Bind reuse to original inputs and ordering, approved source path, Git revision/refs/content including ignored files, scope, model/effort, hashed Codex configuration, and prompt/contract version. Source changes during review stop the attempt before group writes. Later reviews receive original findings only.
• Require merged SAME records to satisfy the Finding schema and retain canonical identity. Submission validation and correction still use review_validator.submit_decisions.
• Save the exact final result and pending group payload before posting. Replay after failure without new candidate lookups or models. Complete only after acknowledgement, retaining successful empty results.
• Preserve the parent's screening/pair flow and transitive grouping, with no whole-group review. Remove obsolete group-phase test fixtures while retaining SAME/DISTINCT migration and resume coverage.
• Support isolated helper imports and help in the canonical plugin layout; update canonical Python schema expectations. Existing helper functions and SQL migrations are unchanged.
• Reuse the approved --workflow-id / SDK workflowId; no additional public syntax, dependency, or command output shape.

Testing

Current integration at 18052bb5:

• Focused integration tests: 57 passed, zero failures.
• Full SDK suites passed with fixed seed 12345 and randomized seed 2857796939: each had 2,013 passed, 29 skipped, and zero failures.
• Canonical plugin generation/source ownership, generated-model consistency, TypeScript checks including MCP, formatting, and git diff --check passed.
• Canonical Python migration/setup, scan indexing, coordinator, and helper-help checks: 64 passed. Verified that all existing SQL migration tuples and helper functions are unchanged by this integration.
• Docker smoke passed from a tracked source snapshot with no pre-generated host plugin: publication, persisted SAME/DISTINCT review checkpoints, completed workflow reuse without additional review calls, group writes, restart persistence, and clean shutdown.
• The Docker-built npm archive passed package and installed-consumer checks: 368 entries, including 120 plugin files. Verified public imports, NodeNext types, CLI, credential locking, MCP initialization, bundled Codex, and nested-worker startup without global Codex. Test fixtures are excluded.
• Scoped workflow lint passed.
• Hosted CI is tracked by the checks attached to the current PR commit; these results describe local verification.

Risk and rollout

Checkpoint reuse is opt-in through explicitly named workflows. Existing workflows without review checkpoints run their unfinished reviews. Use updated workflow/checkpoint code after schema migration; old JSON-metadata readers are incompatible with the upgraded tables.

Metadata remains outside sealed artifacts in the private workbench database, which review processes cannot read. Source hashing includes ignored files and can add filesystem work for large checkouts; directory links are not followed outside the approved checkout.

A pending write or completed workflow is the saved result of its reviewed snapshot. Use another workflow ID for a fresh review. Unfinished workflows with changed inputs rerun affected reviews. Use one coordinating process per workflow.

Local verification uses Linux and synthetic provider responses. Native Windows execution and live model reviews were not run locally. No release, image publication, or PR merge is performed by this update.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-27T05:28:02.534513Z	2d2aa0a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[zcrab-oai]

Four validated findings introduced in this PR: generated-source placement, append-only migration ordering, eager checkout requirements, and unsafe/expensive source snapshots.