feat: preserve cross-scan finding relationships

[mldangelo-oai]

Summary

Preserve confirmed, uncertain, and related relationships between findings in the SQLite workbench so later comparisons can reuse known identities without collapsing independent findings. #575 remains stacked on this storage work.

No user-facing CLI commands, flags, accepted values, or defaults change, and this PR adds no model calls.

Changes

• Validate complete comparison payloads before replacing saved data.
• Reuse stable identities and confirmed links while preserving uncertainty and coverage semantics.
• Return saved related-finding metadata through batched lookups.
• Add migration 31 with two lookup indexes without rewriting existing history.
• Use UTF-8 stdin for comparison payloads, with an existing-format fallback for older plugins.
• Keep legacy records without target IDs scoped to their repository.
• Preserve the current matcher's input until feat: match repeated findings across scan history #575 consumes the stored historical groups.

Testing

At 6ad300c88203e6336ae1336297d9ac7f3086b002:

• Focused history, runtime, comparison, publication-store, and compatibility tests: 309 passed, 16 skipped, 0 failed.
• Full SDK run with Bun 1.3.14 and seed 12345: 1,578 passed and 30 skipped. One stale cached-response fixture failed before correction; its focused rerun passed.
• Type checks, formatting, Ruff for the changed Python files, and git diff --check: passed.
• Build, package inspection, and installed-package smoke checks passed for 255 archive entries and 111 bundled plugin files.
• Regression coverage includes legacy repository scoping, related-pair validation, grouped coverage and uncertainty, migration upgrades, large UTF-8 comparison payloads, current matcher isolation, and older-plugin fallback.

Risk and rollout

Migration 31 builds indexes under SQLite's normal write lock but does not rewrite saved comparisons or completed scan artifacts.

Older custom plugins keep confirmed and uncertain results, but cannot preserve related links and remain subject to operating-system argument limits for large comparison payloads.

Merge this PR before #575.

Public disclosure review

Known historical exception: three earlier commits retain a work email address in Git metadata. This update adds no new sensitive material.

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the current head, cd4b7a67c7c729fac3e4ccc1c33c963abe974374. This is the scan-history storage and compatibility portion of #567. The existing matcher remains in place on this branch.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: cd4b7a67c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

The description now includes the final QA results and merge order. Please review the current head, cd4b7a67c7c729fac3e4ccc1c33c963abe974374. The code has not changed since the earlier review.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: cd4b7a67c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-21T23:44:05.192211Z	6ad300c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

Please review the current head, 02a2e338f9f515a7a7d76d38a17e238bcbd32be0. The PR description includes the latest cleanup and QA results.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 02a2e338f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the current head, aa2ed4119c0334b896cef05c426ec1b3a5fea86f. This additive update merges current main, including #573. The PR description has the fresh compatibility and full-suite QA results. Please check migration compatibility, confirmed-link reuse, uncertainty, and coverage handling.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: aa2ed4119c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review exact head 67d380ec17b191bbf31258d0fd6ef4873676de47 against main. This additive update preserves main's stdin and Python-resolution fixes, scopes legacy records without target IDs by repository, simplifies finding-alias bookkeeping, and exercises large comparison payloads. Please check relationship grouping, coverage and uncertainty, migration compatibility, and the transport fallback for older plugins.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 67d380ec17

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex security review

Please security-review exact head 6ad300c against main. Focus on stored relationship validation, legacy repository scoping, stdin transport, credential isolation, and custom-plugin compatibility.

[mldangelo-oai]

@codex review

Please review exact head 6ad300c against main. Focus on relationship grouping, coverage and uncertainty semantics, migration compatibility, current matcher input isolation, and the fallback for older custom plugins.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Unknown error

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 6ad300c882

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".