feat(classification): support canonical records with host reviews

[kmbroai]

Summary

Add repository-free severity classification for canonical reports. A host can submit an immutable Markdown rubric and report snapshots, execute the requested model reviews, and receive computed assessments without changing original severity or requiring a saved scan.

Changes

• Add classify-severity --records and the typed classifySeverityRecords() SDK entrypoint using version 1 JSON-RPC.
• Verify exact UTF-8 SHA-256 hashes and echo record/rubric revisions; preserve report JSON verbatim in model prompts and reject mismatched assessments.
• Reuse the existing records transport, preserve saved-scan behavior, and return explicit unresolved results after review failures. Document host execution, cancellation, capability probing, and conditional persistence.
• Include the new compiled modules and guide in the strict package allowlist.

Testing

• All 38 package archive fixture tests passed at the failing CI seed, along with 77 affected classification and records-protocol tests including existing deduplication CLI pipe tests. SDK types and formatting passed.
• Native package build and archive validation passed (584 entries). The installed tarball passed the public SDK import, version probe, and canonical classification using a synthetic Python host with independently computed UTF-8 hashes and preserved large numeric evidence.
• Three fresh native reviews and a distinct verifier passed with no actionable findings on the packaging-corrected commit.
• Full local SDK runs completed on ee17ce9; subsequent changes add four package-validation lines and one synthetic archive fixture entry. Runtime source is unchanged, so this is inherited runtime evidence, not a full-suite rerun. Seed 12345 had 4,897 passed, 68 skipped, and 36 failed; seed 1723550278 had 4,901 passed, 68 skipped, and 32 failed. Of the 36 distinct failing cases, 34 reproduced on the unchanged base. Two saved-scan bootstrap timeout cases passed in a targeted baseline run and remain unresolved full-suite limitations. Neither full suite passed.
• The full installed-package smoke reaches its final Deep Scan fixture and fails with an output-parent permission check and a worker-interruption assertion. A native package built from the unchanged base reproduces both failures. No permission or timeout workaround was used. The records-specific installed-package smoke passes separately.

Risk and rollout

The new mode is opt-in and uses host-provided execution; it does not create model sessions, credentials, or repository checkouts. Hosts must authorize the requested model, cancel remote work, and compare immutable bindings before conditionally persisting computed fields. No existing published package is claimed to contain this capability: require an artifact containing this change and verify protocol version 1 before use. No release or runtime activation is included.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-16T21:38:53.533405Z	d3390ba	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.