refactor: delete the retired worker runtime

CONTRIBUTING.md

@@ -16,8 +16,7 @@ packages and releases. Do not edit or commit files in that directory. See the
 commands.
 
 Model-based evaluations live in [`evals/`](evals/README.md), outside the plugin
-source. Deterministic triage checks and the MCP reducer IPC regression remain
-part of normal CI.
+source. Deterministic triage checks remain part of normal CI.
 
 Search [existing issues](https://github.com/openai/codex-security/issues)
 before opening a new one.

evals/README.md

@@ -5,12 +5,8 @@ being embedded in its source tree or shipped npm runtime.
 
 - [Triage finding](triage-finding/README.md): Promptfoo input contracts, OSS
   calibration, and SastBench. This suite owns its private package and lockfile.
-- [Deep reducer](deep-reducer/README.md): optional model evaluation of real IPC
-  size-limit recovery, pagination, and finding retention. It reuses the MCP
-  test helpers and dependencies.
 
 - [Completed-report merge](../sdk/typescript/scripts/merge-eval/README.md):
   synthetic grouping quality checks and negative controls.
 
-Model runs are opt-in. CI still runs the deterministic triage helper checks and
-the real-IPC reducer regression through the normal MCP test suite.
+Model runs are opt-in. CI still runs the deterministic triage helper checks.

plugins/codex-security/mcp-app/package.json

@@ -11,14 +11,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
-    "@openai/codex-sdk": "0.159.3",
-    "smol-toml": "1.9.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
     "@types/node": "^26.6.2",
     "esbuild": "^0.28.2",
     "prettier": "3.9.9",
+    "smol-toml": "1.9.0",
     "typescript": "^7.0.2"
   }
 }