fix(severity): use saved scan context for helper selection

[mldangelo-oai]

Summary

Saved-scan severity classification now resolves the selected repository before choosing helper executables and carries its protected paths through assessment persistence. Selecting latest preserves chronological ordering across timestamp offsets and sub-millisecond differences.

Changes

• Reuse the shared saved-scan bootstrap for SDK and default CLI lookups, carrying repository and caller paths through severity persistence.
• Share the existing feedback timestamp comparator with saved-scan selection. Order scans by their latest scan or progress update, then start time, then ascending scan ID.
• Register the shared timestamp helper in the package inventory.
• Cover helper selection, saved-scan selectors, missing repositories, concurrent lookups, timestamp precision, and tie-breakers with synthetic fixtures.

Testing

• Final-head focused severity, history, and feedback checks: 26 passed, 0 failed; 126 assertions, seed 1319506487.
• Three precision regressions failed before the correction and pass with it; offset and fractional-second coverage also passes.
• Final-head pnpm pack, including prepack builds, and the existing archive checker passed; 630 archive entries validated.
• Full local SDK runs with seeds 12345 and 694279854: each had 5,527 passes, 81 skips, and 13 failures. Both runs failed. Every complete failure diagnostic matched a fresh baseline control, with no unclassified failures.
• Type and format checks passed.
• Deep Scan executor checks passed, covering concurrent discovery/reducer workers, fresh and resumed launches, inherited settings, intentional overrides, and per-scan executable, environment, and configuration isolation.
• Hosted CI passed for efdc65a (observed 2026-10-20 at 09:33 UTC).

Risk and rollout

Uses existing CLI arguments and saved-scan formats. Feedback selection, custom history runners, and direct-directory classification retain their existing behavior. Saved classification continues to support removed repository directories.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T09:08:20.972376Z	efdc65a	New commits
🔒 Security Review	✅ Completed 2026-10-20T09:08:24.875609Z	efdc65a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4654202107

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

The saved-scan helper context is carried through lookup and severity persistence, but the existing timestamp-precision finding remains material. I independently reproduced latest selecting the older of two scans updated within one millisecond. The shared selector also changes dedupe --scan latest, which previously preserved that ordering for normal UTC timestamps. Please retain sub-millisecond ordering before merging.

Types, formatting, and the plugin build passed. A direct selector probe verified the offset/fractional-second fixes and reproduced the precision regression. The focused suite had 14 passes and 69 failures at the existing fixture ownership guard; full SDK runs were not repeated under that limitation.

[alandelong-oai]

Thanks—no blocking findings in this re-review. The timestamp-precision issue is fixed: saved-scan selection preserves microseconds, offsets and deterministic ties while retaining the intended helper protections.

Validation passed 30 focused tests, 68 real SQLite selector cases, SDK/default CLI helper-rejection probes, types, formatting, and fresh package/archive checks. The previous head still fails the independent microsecond reproduction; this head passes. Full saved-scan persistence and broad SDK suites remain limited by the unchanged fixture ownership restriction; hosted CI is still running.