fix: preserve findings with list severity conditions

[mldangelo-oai]

Summary

• Normalize a non-empty array of valid severity change-condition strings into the canonical prose string during unsealed finding recovery.
• Continue rejecting empty arrays, blank entries, and non-string entries so malformed finding data remains fail-closed.
• Document the producer-side mapping from attack_path.change_conditions to the schema-required severity.changeConditions string.

Why

Attack-path analysis can naturally emit several severity-change conditions as an array, while the canonical findings schema accepts only a non-empty string. Before this change, an otherwise valid finding with that producer shape was discarded during completion. If every finding had the same shape, the finished scan incorrectly reported zero findings and downgraded complete coverage to partial.

Recovery now joins valid condition entries into one prose string before validation, preserves every independently validated finding, records an explicit normalization warning, and retains complete coverage. Invalid arrays still follow the existing strict rejection path.

Validation

• Full SDK suite: 708 passed, 5 expected skips, 0 failed.
• Focused scan recovery suite: 18 passed, 0 failed.
• pnpm run types.
• pnpm run format.
• git diff --check.
• Reconstructed a previously affected scan from its existing candidate ledger: all seven findings were recovered, coverage was complete, seven SARIF results were generated, and all 11 sealed artifact hashes verified.

[mldangelo-oai]

@codex review Please review exact head 68e2171, focusing on preserving valid findings when severity change conditions arrive as string arrays, retaining strict rejection for malformed entries, maintaining canonical schema compatibility, and preventing complete coverage from being downgraded.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68e21719bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 68e21719bf

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review Please review exact head 579e7c7, focusing on per-finding severity-condition normalization, malformed Unicode surrogates, preserving unrelated findings, coverage recovery, and the current-main merge.