Deep Scan Windows path bug

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.803.81509

What subscription do you have?

Pro 5X

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

When running the Codex Security Deep Scan on a Windows checkout, the scan fails immediately during its deterministic setup phase. The failure happens before any source files are reviewed, before discovery workers are started, and before any findings, exploit-chain analysis, or final report can be produced.
The issue is caused by a path-format mismatch between the inventory generator and the Deep Scan validator. The inventory generator uses rg --files with the scope . and produces Windows-style relative paths such as:
.\trusted-html.js
.\src\services\example.js
However, the following validation step only accepts safe repository-relative POSIX paths, such as:
trusted-html.js
src/services/example.js
Because the first generated path contains the .\ prefix and Windows backslashes, the validator rejects it with:
in_scope_files.txt:1 must be a safe repository-relative path
As a result, the Deep Scan terminates during setup with zero discovery runs and zero workers. This appears to be a Windows-specific path-normalization issue in the Deep Scan workflow, rather than an issue in the scanned project.

What steps can reproduce the bug?

Feedback ID: 019ff6d0-6414-7a71-9129-9045206322af

What is the expected behavior?

The scan should normalize generated inventory paths to safe repository-relative POSIX paths (for example, src/file.js) and continue with discovery, validation, and report generation.

Additional information

No response

Locate the Deep Scan inventory generator and validator, then reproduce the issue on Windows while inspecting the rg --files output for the .\ prefix and backslashes. Done means generated paths are safe repository-relative POSIX paths and the scan proceeds beyond deterministic setup into discovery and reporting; run the relevant Deep Scan checks once located.