Codex Security: recoverable finalization schema error permanently fails completed scan

Start by locating the scan-completion entry point and the state transition that handles finalization validation; trace how snapshotDigest is checked and how failure is persisted. Use the reproduction steps to verify that repairing the digest allows completion, or that an audited recovery path is available without rerunning the scan.

Summary

A Codex Security diff scan completed discovery, validation, attack-path analysis, and canonical draft generation, but finalization rejected an empty scan.target.snapshotDigest. After repairing the digest in a fresh turn, completion could not be retried because the first validation error had already moved the scan into the terminal failed state.

This makes a recoverable metadata/schema error permanently prevent sealing an otherwise completed long-running scan.

Environment

• Codex desktop on Windows with Ubuntu/WSL 2
• Codex Security plugin: 0.1.17 when the scan began; 0.1.18 subsequently installed
• Scan mode: Git revision-range/diff scan
• Exact base and head revisions were available throughout
• Repository checkout remained unchanged

Private scan identifiers and unsealed artifacts can be provided privately if needed.

Reproduction

1. Start a Codex Security diff scan over an exact base/head revision range.

2. Complete all review receipts and the validation and attack-path phases.

3. Author the canonical unsealed draft artifacts.

4. Call scan completion.

5. Completion fails with:

   scan.target.snapshotDigest: expected a non-empty string
   

6. In a fresh turn, populate the correct deterministic snapshot digest and verify the canonical artifacts.

7. Call completion once more.

8. Completion fails with:

   Only a running scan can be completed.
   

The first finalization validation error has already marked the scan failed, and the exposed workflow has no supported failed → running recovery transition.

Expected behavior

One or more of the following:

• Populate and validate snapshotDigest before attempting terminal finalization.
• Treat canonical artifact/schema validation errors as recoverable and leave the scan running.
• Make finalization transactional so a validation failure does not persist terminal state.
• Provide an audited recovery/reopen operation for scans whose artifacts are repaired after a finalization error.

Actual behavior

The expensive analytical phases and valid draft artifacts remain available, but the scan cannot be sealed or displayed as completed. The only supported alternative appears to be rerunning the entire scan.

Additional context

The installed 0.1.18 package documents snapshotDigest as required for Git diff targets, but includes no recovery procedure for this terminal state. The public Codex Security changelog currently stops at 0.1.17.

No repository contents, finding details, local paths, scan identifiers, or sensitive artifacts are included in this issue.