Codex Security 0.1.22: finalization resurrects resolved checkpoint deferrals and produces inconsistent durable coverage

Summary

Codex Security 0.1.22 reproducibly retains an interim deferred checkpoint in terminal durable coverage after that checkpoint has been explicitly resolved before completion.

This was reproduced with a minimal synthetic target consisting of one 214-byte file. It does not depend on the original application repository.

No durable artifacts were manually edited.

Environment

• Codex Security plugin: 0.1.22
• Platform: macOS
• Fresh workbench state: yes
• Fresh scan state: yes

Minimal reproduction

Synthetic target:

• Files: 1
• Bytes: 214
• SHA-256: 3d06033bffeb0b451f0d1360430b46e281e4ef78bcdeb8487fca9a8ed44e4838

Scan ID:

71fee081-86ab-4d7a-9125-aa28f01b3321

Checkpoint ID:

synthetic-fixture-full-read

Lifecycle

1. Start a fresh scan/workbench.
2. Create an interim checkpoint with:
   • complete=false
   • completeness=partial
   • deferred=[synthetic-fixture-full-read]
3. Complete the required review work.
4. Submit the final semantic draft with:
   • complete=true
   • completeness=complete
   • deferred=[]
   • openQuestions=[]
   • checkpoint state RESOLVED_COVERED
5. Finalize normally using the standard completion flow.
6. Read back the durable artifacts.

Expected result

The resolved checkpoint should remain preserved in historical checkpoint evidence, but it should no longer count as a terminal deferral.

Expected terminal state:

• coverage: complete
• unresolved terminal deferrals: 0
• synthetic-fixture-full-read: RESOLVED_COVERED
• no open follow-up for that checkpoint

report.md, coverage.json, and scan-manifest.json should agree.

Actual result

After normal finalization:

• coverage.json reports partial
• synthetic-fixture-full-read is reintroduced as a terminal deferred item
• the same surface is also represented as RESOLVED_COVERED
• report.md renders both the resolved state and an open follow-up

The final semantic draft immediately before completion was explicitly:

• complete=true
• completeness=complete
• deferred=[]
• openQuestions=[]

So the resolved deferred ID is reintroduced during terminal finalization/projection.

Observed invariant violation

An interim checkpoint may remain in historical evidence, but once its terminal state is RESOLVED_COVERED, it should not remain in the final:

• deferred list
• open questions
• unresolved follow-ups
• unresolved terminal-deferral count

A genuinely unresolved terminal item should still remain deferred; the expected behavior is terminal-state reconciliation, not unconditional deletion of deferrals.

Additional notes

• Reproduced using fresh scan/workbench state.
• No application/private repository source is required to reproduce the issue.
• No credentials, production data, secrets, or customer data are involved.
• No product binaries or plugin internals were modified or reverse-engineered.
• No manual post-finalization editing of durable artifacts was performed.

I have a sanitized minimal reproduction package and final report available if useful.

Start at the standard completion flow that projects the final semantic draft into report.md, coverage.json, and scan-manifest.json. Trace how deferred and openQuestions entries are reconciled with terminal checkpoint states, then reproduce scan 71fee081-86ab-4d7a-9125-aa28f01b3321; done means resolved checkpoints remain historical evidence without unresolved deferrals, and all three artifacts agree on complete coverage.