refactor(plugin): simplify workbench persistence

[mldangelo-oai]

Summary

Workbench mutations repeat transaction cleanup, and Deep Scan startup duplicates the standard scan insertion path. Reuse the existing transaction and startup mechanisms while preserving scan ownership and recovery behavior.

Changes

• Use SQLite connection contexts for commit and rollback, retaining explicit transaction starts and required early commits.
• Reuse target identity, scan-root resolution and running-scan insertion helpers.
• Write progress fields together in the same owned transaction, and remove redundant internal declarations and path-comparison branches.

Testing

Passed on commit 1827f98ae57c:

• python -m pytest plugins/codex-security/tests/test_workbench_*.py -q -n 4 --dist worksteal --max-worker-restart 0 (25 files) — 884 passed, 2 skipped.
• python -m pytest plugins/codex-security/tests -q -n 4 --dist worksteal --max-worker-restart 0 — 1,587 passed, 6 skipped, and 162 subtests passed.

All five portable plugin checks passed:

python -m ruff check --config plugins/codex-security/pyproject.toml plugins/codex-security
python -m ruff format --check --config plugins/codex-security/pyproject.toml plugins/codex-security
pnpm --dir sdk/typescript run build:ci
node .github/scripts/check_plugin_source_compatibility.mjs
node --test .github/scripts/test_check_plugin_source_compatibility.mjs

Three independent Codex reviews and separate verification completed without findings.

Risk and rollout

Review focuses on commit timing, early returns, failure rollback and concurrent scan ownership. Progress updates preserve the supported command's committed result and diagnostics. Public command syntax, managed migrations and credential/path protections remain unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T18:51:56.577115Z	1827f98	Manual request
🔒 Security Review	✅ Completed 2026-10-04T18:46:54.531488Z	1827f98	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review the current head SHA.

[Copilot]

Copilot review overview

🟢 Approval recommended

The refactoring preserves existing behavior and transaction boundaries without introducing unresolved correctness issues.

Review effort: Balanced
Findings: None

What changed in this PR

Simplifies workbench persistence while preserving transaction, scan ownership, and recovery behavior.

Changes:

• Replaces manual commit/rollback blocks with SQLite connection contexts.
• Reuses shared scan identity, root resolution, and insertion helpers.
• Consolidates progress updates and removes redundant declarations.

File	Description
deep_scan_workbench.py	Reuses shared scan startup helpers and transaction contexts.
workbench_cli.py	Registers remediation cancellation directly.
workbench_constants.py	Removes unused remediation constants.
workbench_db.py	Simplifies transaction handling across persistence operations.
workbench_progress.py	Writes progress fields in one transaction update.
workbench_publication.py	Simplifies publication transactions.
workbench_remediation.py	Simplifies cancellation transaction handling.
workbench_scan_start.py	Reuses diff identity construction.
workbench_scan_usage.py	Simplifies cost reconciliation transactions.
workbench_validation.py	Simplifies scope containment checks.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 1827f98ae5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

Reviewed the actual PR contribution at 1827f98ae57c3784acf036995c30e6f501f5416a against 1fb0e5fbf8684c926cac2a36d08389b212d28d5a with three independent full-diff review passes and root synthesis, including every changed test and fixture. No actionable introduced issue was identified.

Read the full contribution and complete scan insertion/start critical context. Shared identity/insertion helpers preserve the touched scan mode, target, directory and thread fields. No supported introduced cross-scan value change identified; concurrent and resumed-worker runtime behavior remains unexecuted.

Static source review only; tests and builds were not run locally. This approval does not establish whole-stack integration or deployment.