refactor(plugin): reuse migration repair declarations

[mldangelo-oai]

Summary

Historical schema repairs duplicate column definitions already recorded in the migration list. Reuse those declarations to keep fresh migration and repair paths consistent.

Changes

• Read additive column declarations from the existing migration definitions and share the repair dispatch.
• Consolidate legacy migration-name handling while retaining its repair order and data updates.
• Use the SQLite transaction context and add an exact CHECK-error regression for repaired phase-progress columns.

Testing

Passed on commit 478a39141f6b:

• python -m pytest plugins/codex-security/tests/test_workbench_setup_and_migrations.py -q -n 4 --dist worksteal --max-worker-restart 0 — 63 passed.
• python -m pytest plugins/codex-security/tests -q -n 4 --dist worksteal --max-worker-restart 0 — 1,587 passed, 6 skipped, and 162 subtests passed.
• All five portable plugin checks passed:

python -m ruff check --config plugins/codex-security/pyproject.toml plugins/codex-security
python -m ruff format --check --config plugins/codex-security/pyproject.toml plugins/codex-security
pnpm --dir sdk/typescript run build:ci
node .github/scripts/check_plugin_source_compatibility.mjs
node --test .github/scripts/test_check_plugin_source_compatibility.mjs

Three independent Codex reviews and separate verification completed without findings.

Risk and rollout

This affects existing database repair paths. Migration versions and historical entries stay unchanged; the refactor preserves historical constraint text, repair ordering and transaction boundaries. No new migration or persisted schema version is introduced.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T18:45:56.141456Z	478a391	Manual request
🔒 Security Review	✅ Completed 2026-10-04T18:45:46.292089Z	478a391	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review the current head SHA.

[Copilot]

Copilot review overview

🟢 Approval recommended

The refactor preserves migration semantics and is covered by focused legacy-repair and rollback tests.

Review effort: Balanced
Findings: None

What changed in this PR

Refactors SQLite migration repairs to reuse canonical migration declarations while preserving legacy upgrade behavior.

Changes:

• Centralizes additive-column repair logic.
• Consolidates legacy migration normalization.
• Adds exact CHECK-constraint regression coverage.

File	Description
plugins/​codex-security/​scripts/​workbench_schema.py	Reuses migration SQL for schema repairs and transaction handling.
plugins/​codex-security/​tests/​test_workbench_setup_and_migrations.py	Verifies repaired constraint behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 478a39141f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

Reviewed the actual PR contribution at 478a39141f6bed820783f0593582efb06581e278 against 1fb0e5fbf8684c926cac2a36d08389b212d28d5a with three independent full-diff review passes and root synthesis, including every changed test and fixture. No actionable introduced issue was identified.

Read the full migration contribution and relevant SQL/transaction context. Repair declarations reuse original ADD COLUMN definitions while migration bookkeeping and transaction handling remain explicit. No supported introduced migration failure identified statically.

Static source review only; tests and builds were not run locally. This approval does not establish whole-stack integration or deployment.