Repository navigation
refactor(schemas): generate canonical artifact schemas from Zod - #1578
mldangelo-oai wants to merge 10 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
🟢 Approval recommended
The generated contracts preserve existing validation behavior and are supported by focused regression coverage.
0 open findings
What changed in this PR
Moves canonical artifact schema ownership to shared Zod definitions while preserving checked-in JSON validation contracts and SDK models.
Changes:
- Adds Zod sources and generation for four canonical schemas.
- Uses AJV narrowing for patch-risk assessments.
- Adds regression coverage and authoring documentation.
| File | Description |
|---|---|
CONTRIBUTING.md |
Documents schema authoring and generation. |
plugins/codex-security/mcp-app/scripts/canonical-schemas.mts |
Defines canonical Zod contracts. |
plugins/codex-security/mcp-app/scripts/generate-artifact-schemas.mjs |
Generates canonical JSON schemas. |
plugins/codex-security/mcp-app/src/helpers/validate-patch-risk-assessment.ts |
Uses generated-schema type narrowing. |
plugins/codex-security/mcp-app/src/patch-risk-schema.ts |
Defines patch-risk contract and type. |
plugins/codex-security/mcp-app/src/threat-model-schema.ts |
Supports canonical scope-list constraints. |
plugins/codex-security/mcp-app/tests/test_canonical_artifact_contracts.ts |
Covers compatibility constraints. |
plugins/codex-security/schemas/coverage.schema.json |
Regenerated coverage schema. |
plugins/codex-security/schemas/findings.schema.json |
Regenerated findings schema. |
plugins/codex-security/schemas/patch-risk-assessment.schema.json |
Regenerated patch-risk schema. |
plugins/codex-security/schemas/scan-manifest.schema.json |
Regenerated manifest schema. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ex/canonical-zod-schemas
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…/codex/compact-zod-contracts
…ex/canonical-zod-schemas
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
mldangelo-oai
changed the title
zcrab-oai
left a comment
zcrab-oai
left a comment
There was a problem hiding this comment.
Reviewed eabcaf3a3fdf in two source-review passes, including relevant callers and contracts.
Approved. No new actionable findings in the reviewed scope.
Validation: CI-helper TypeScript compilation and plugin bundling passed locally; native binaries came from CI with matching compiled source inputs. Focused MCP tests passed: test_canonical_artifact_contracts.ts. The full cross-platform suite was not run locally; Windows execution remains unverified here.
alandelong-oai
left a comment
alandelong-oai
left a comment
There was a problem hiding this comment.
Reviewed the PR diff at 57a6ed3c36b0 in three independent source passes, including comparison of the four exported schemas with the PR base.
The generated schemas preserve the existing structural constraints, named references, IDs, and legacy union representations. Runtime validation still uses the selected plugin's JSON schemas; the new Zod definitions supply generation and the private patch-risk type. No blocking findings in this delta over #1575.
Static review and schema comparison; I did not rerun the test suites or generators.
Summary
Generate canonical findings, manifest, coverage, and patch-risk schemas from shared Zod definitions. Merge current
main; the prerequisite compact-contract refactor is already merged.Changes
maincoverage semantics: do not restore removed completeness outcomes or constraints.Testing
Risk and rollout
Runtime validation continues to use the selected plugin JSON schemas. Public CLI syntax, current artifact inputs, historical supported aliases, schema IDs, named references, and SDK model contracts remain unchanged. Generated JSON stays checked in, and typecheck rejects stale output. The generator's legacy-compatible artifact shapes do not relax current semantic validation.
Public disclosure review