[markstuart-oai]

Summary

SDK-only changes rebuilt native bundles whenever the committed pin fell behind the native source. CI now finds bundles by the exact native input hash and platform. This removes the manual pin update.

The lookup accepts qualified direct Alpha builds from approved branches. It compares the native inputs and workflow with the producing commit. It verifies the owning upload's artifact ID and digest, then checks the downloaded bytes before extraction. The lookup skips incomplete and expired candidates. A miss builds from source immediately. The current SDK build and native/security checks still run after a cache hit. Native bundles keep the existing 90-day retention.

Test plan

• Nine focused tests passed, including real CLI, Git and archive extraction with controlled GitHub responses. Coverage includes SDK-only reuse, native input changes, untrusted artifacts, warm reruns, concurrent reruns, and corrupt uploads.
• Two independent reviews of the final diff found no remaining issues.
• The required verification wrapper passed install, SDK build, lint, declaration checks, and changed-file formatting.
• Local example type checks stopped when Prisma could not download its schema engine checksum from binaries.prisma.sh. The same command fails on the unchanged base. The parallel full test run was interrupted. Hosted full CI and cold/warm timing checks are pending.

Issue number

None.

Checks

• I've added new tests.
• I've documented the cache lifetime and failure behavior in the workflow and scripts.
• Full tests and example type checks pass; local coverage is blocked by the Prisma download.
• I've run .agents/skills/code-change-verification/scripts/run.sh; the environment gap is recorded above.
• I've confirmed all verification steps pass.
• Two independent code reviews passed on the final content.
• Changeset: not applicable; this changes CI scripts and workflows only.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 844a949

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[markstuart-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T23:51:10.200191Z	844a949	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-05T23:52:31.211281Z	844a949	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 844a94933b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 844a94933b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[dpiet-oai]

[P2] Treat a concurrently replaced artifact as a cache miss. The artifact list is captured before the run and jobs are queried, while uploads now use a stable name with overwrite: true. If a producer rerun replaces the artifact and completes between those reads, the selected asset contains the previous artifact ID/digest but the latest successful job's log contains the replacement's values. verifyUpload then throws, failing the consuming SDK build rather than skipping this stale candidate or building from source. The previous attempt-specific artifact names did not have this replacement race. Recheck the artifact/attempt identity on a verification mismatch and retry or skip when it changed, while retaining hard failure for an integrity mismatch on an unchanged candidate.

[jbeckwith-oai]

Requesting changes for the existing artifact replacement race: #2186 (comment) . Independently confirmed: discovery can retain the previous artifact ID while a successful rerun overwrites the stable name; verification then reads the replacement upload log and hard-fails instead of treating the stale candidate as a cache miss. Preserve immutable attempt identity or revalidate/skip a replaced artifact without weakening digest checks. Referencing the existing finding without duplicating it. Reviewed input hashing, producer/source restrictions, rerun selection, checksum verification and extraction; no additional findings. Hosted platform CI remains in progress. Static review only; no candidate code or local tests run.