fix(deep-scan): remove coverage from aggregation

[daneschneider-oai]

Summary

Deep scans combine several independent reviews. A scan can reach its stopping point and still be labeled partial because one worker left notes about unfinished work. That makes the final status confusing: it reflects one worker's notes instead of whether the Deep scan finished.

Completion follows the scan's stopping rules, and reducers focus on combining findings. The report includes the configured directories and exclusions, and the host supplies coverage.json for existing readers.

Changes

• Remove coverage from reducer tool inputs, returned inputs, saved results, checkpoints, and prompts. Ignore coverage in older saved reducer results when resuming.
• Successful Deep compatibility files contain the configured paths, host-derived completeness, empty surfaces, explicitExclusions, and deferred arrays, and no openQuestions. Standard workers keep their original coverage.
• Publish the accepted aggregate directly without rereading workers, recovering checkpoints, repairing findings, or downgrading coverage during successful completion.
• Cancel unfinished workers at saturation; their late findings and failures cannot change the accepted result. Preserve distinct findings with colliding identities using numeric suffixes.
• Support stopped-scan recovery from coverage-free reducer results, including scoped scans without a parent draft and repeated recovery.

Testing

• MCP typecheck and focused reducer, validation, coordinator, template, and source/bundled tool-contract tests passed.
• Python: 20 schema tests plus 44 subtests, 11 publication/recovery tests, 5 stop-condition tests, and 11 existing recovery tests passed.
• SDK build, types, format, and 92 focused tests passed; the final bundled reducer suite also passed.
• End-to-end coordinator → native workbench → finalizer → SDK loading verified configured scope in the report, empty compatibility observations, and unchanged worker and legacy artifacts.
• Ruff, portable source checks, and diff checks passed. Full SDK suite completion remains unverified locally.

Risk and rollout

The reducer contract changes; canonical output schemas stay compatible. Existing readers still use the host-generated coverage.json, including completeness for status and comparisons. Successful Deep reports omit worker/reducer coverage observations.

Configured scope exclusions, Standard/diff behavior, stop thresholds, no-review time-limit diagnostics, and stopped-scan findings recovery remain supported. No version bump.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[daneschneider-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T00:28:00.776291Z	28e6e82	Manual request
🔒 Security Review	✅ Completed 2026-09-01T00:30:11.224079Z	28e6e82	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 28e6e82d14

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".