fix(plugin): align Deep Scan worker draft guidance with MCP input schema

[Ultron09]

Summary

Align Deep Scan worker instructions, prompt templates, continuations, and reference guidance with scan-draft.schema.json by explicitly instructing workers to omit workbench-derived fields (scope.includePaths, scope.excludePaths, coverage.documentType, coverage.schemaVersion, coverage.scanId, coverage.mode, coverage.inventoryStrategy, coverage.receiptRefs, and finding identities) from record_codex_security_scan_draft payloads.

Fixes #668.

Changes

• Worker Templates & Continuations:

  • In plugins/codex-security/mcp-app/templates/deep-scan/discovery.md, instruct discovery workers that the workbench derives authoritative target, scope paths, coverage mode, inventory strategy, surface IDs, missing deferred IDs, finding IDs, and fingerprints, and to omit these derived values from draft arguments.
  • In plugins/codex-security/mcp-app/src/deep-scan/worker-runner.ts, update standardScanCompletionContinuation, transientExecutionContinuation, and writeValidationRetryPrompt with explicit guidance to omit workbench-derived fields.
  • In plugins/codex-security/mcp-app/src/server/compact-artifact-tools.ts, clarify tool descriptions for record_codex_security_scan_draft to omit workbench-derived metadata.

• Skills & References:

  • In plugins/codex-security/references/core-scan.md, update Step 8 to clarify that draft payloads passed to record_codex_security_scan_draft must omit workbench-derived target, scope paths, coverage metadata, and finding identities.
  • In plugins/codex-security/references/scan-artifacts.md, final-report.md, skills/security-scan/SKILL.md, and skills/security-scan/references/desktop-scan.md, align draft guidance with the MCP schema.
  • In plugins/codex-security/schemas/tools/scan-draft.schema.json, add explicit descriptions to scope and coverage properties in scanDraftInput.

• Tests:

  • In plugins/codex-security/mcp-app/tests/test_deep_scan_templates.mjs, use fileURLToPath for platform-neutral path resolution and assert guidance against derived fields in rendered discovery prompts.
  • In sdk/typescript/tests-ts/deep-scan-draft-guidance.test.ts, add regression test suite verifying prompt rendering, continuation guidance, and schema rejection of derived fields.

Testing

• bun test ./tests-ts/deep-scan-draft-guidance.test.ts (3 pass, 0 fail)
• bun test ./tests-ts/deep-scan-reducer-recovery.test.ts (4 pass, 0 fail)
• node plugins/codex-security/mcp-app/tests/test_deep_scan_templates.mjs (passed)
• pnpm --dir sdk/typescript run types (passed with 0 errors)
• pnpm --dir sdk/typescript run format (passed with 0 errors)
• uvx ruff==0.16.1 check & uvx ruff==0.16.1 format --check (All checks passed)
• python .github/scripts/check_plugin_source_compatibility.py (Plugin source compatibility checks passed)

Risk and rollout

Low. This is a guidance and documentation alignment that prevents worker MCP -32602 validation retries while preserving the strict workbench schema and security boundaries.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.