[xeonvs]

Correct DLP admission for proven nonsecret source expressions, distinguish completed analysis from filtered publication, and add the local ocr-ci dlp-audit diagnostic command. Related issue: #282; stable receipt verification remains the issue-closure owner.

• Bind declaration/reference and numeric-operator interpretation to exact complete source; retain independent whole-input secret, contact and obfuscation checks. Arbitrary data and unknown syntax keep conservative decisions.
• Audit snippets, selected files and immutable Git corpora with bounded isolated workers, private authenticated reports, exact annotations, replay comparisons and owned-source cleanup. No automatic corpus scan or GitLab stage is added.
• Make the diagram owner inspect cross-group changes and submit independently of finding count; align conditional-edge reference requirements across the MCP schema and parser.
• Measure coverage before raising result/preflight to 85%, and enforce separate local 90% floors for new audit/source-context modules.

Validation: the full sequential quality gate passes 3747 tests and 357 subtests (47 conditional skips), with 88.79% coverage and every scoped floor. Clean wheel/sdist installation checks pass. Both complete captured corpora replay unchanged after acceptance; unexplained transitions and lost confirmed protection are zero, while untriaged observations remain explicit. Extended DLP/source qualification passes 545 tests/properties at 1000 examples per property; 24 official native grouping/round/diagram checks pass. One aggregate Security scan has no findings; subsequent corrections have focused independent review. Actual ChatGPT/Astra high self-review of 72abb603..b4cfbb1 completed 51/51 selected files with zero raw or delivered findings and an admitted diagram.

DLP admission and private audit flow

flowchart LR
    n0["Offline audit#58; select files#44; Git blobs#44; stdin or snapshot replay"]
    n1["Bound input capture and bind corpus to private authenticated state"]
    n2["Remove owned raw snapshots while preserving originals and evidence"]
    n3["Annotate exact hits and compare complete identical populations"]
    n4["Request owner-group diagrams and require conditional-edge references"]
    n5["Apply sink-aware DLP with independent secret and contact checks"]
    n6["Raise result#47;preflight to 85#37;#59; add local per-module 90#37; floors"]
    n7["Separate complete analysis from incomplete output in review summaries"]
    n8["Project safe findings and omit unsafe optional code fields"]
    n9["Prove exact source ranges and cache bounded syntax interpretation"]
    n10["Persist bounded audit hits#44; completeness and scanner identity"]
    n11["Isolated worker evaluates whole-file and nonempty-line units"]
    n0 --> n1
    n1 --> n11
    n3 -->|"Operator requests cleanup"| n2
    n4 -->|"Validate diagram labels with their dedicated sink"| n5
    n5 --> n8
    n8 -->|"Review output is admission-filtered or publication-filtered"| n7
    n8 -->|"Audit checks code admission against publication projection"| n10
    n9 --> n5
    n10 --> n3
    n11 --> n9

Loading

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T15:09:18.940938Z	113029c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.