refactor(plugin): split workbench publication helpers

[soyeon-oai]

Summary

Keep the authored plugin source compatible with deterministic downstream import checks without changing its CLI or runtime behavior.

Changes

• Move finding publication and export helpers from workbench_db.py into workbench_publication.py while preserving the existing workbench_db entry points.
• Move two remediation state validators into the existing remediation module.
• Add the new runtime module to plugin-files.json.
• Apply the shared Python formatter to the plugin files that participate in the import projection.
• Remove hard-wrapped prose rejected by the plugin validator.

Testing

• python -m pytest plugins/codex-security/tests/test_workbench_db_exports.py plugins/codex-security/tests/test_windows_report_e2e.py -q — 30 passed
• python -m pytest plugins/codex-security/tests/test_workbench_db.py -q -k remediation — 8 passed, 93 deselected
• python -m pytest plugins/codex-security/tests/test_plugin_contract.py -q — 5 passed
• PYTHONPATH=plugins/codex-security/scripts python -m pytest plugins/codex-security/tests/test_cli_dry_runs.py -q — 3 passed
• npx -y bun@1.3.14 test --timeout 30000 sdk/typescript/tests-ts/publication-store.test.ts — 25 passed
• downstream plugin validator — passed
• Ruff check and format verification — passed
• AST comparison of the moved publication/export and remediation helpers against their pre-refactor definitions — equivalent

Risk and rollout

Low. This is a source-preserving module split plus formatting. The existing CLI entry points remain in workbench_db.py, and the new module is included in the shipped plugin payload.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

Change impact

The workbench keeps its existing entry points while publication logic moves into a smaller shipped module.

flowchart LR
  subgraph column_0["Existing entry points"]
    direction TB
    node_0["Publication commands<br/><code>workbench_db</code>"]
    node_1["Remediation updates<br/><code>workbench_db</code>"]
  end
  subgraph column_1["Extracted logic"]
    direction TB
    node_2["Publication helpers<br/><code>workbench_publication.py</code>"]
    node_3["Transition validators<br/><code>workbench_remediation.py</code>"]
  end
  subgraph column_2["Runtime outcome"]
    direction TB
    node_4["Same runtime results"]
    node_5["Same remediation rules"]
  end
  node_0 -->|"delegates"| node_2
  node_2 -->|"returns and ships"| node_4
  node_1 -->|"checks"| node_3
  node_3 -->|"enforces"| node_5
  class node_0 context
  class node_1 context
  class node_2 changed
  class node_3 changed
  class node_4 affected
  class node_5 affected
  classDef changed fill:#d7f5e5,stroke:#237a4b,color:#111
  classDef affected fill:#e6f0ff,stroke:#3569a8,color:#111
  classDef context fill:#f2f3f5,stroke:#6e7781,color:#111

Loading

Limits: Focused tests passed at the exact head; hosted CI is still running. · Deployment and released artifacts were not checked.

Source evidence (9)

• plugins/codex-security/scripts/workbench_db.py:L2433-L2441 — workbench_db preserves the inspection and export callables and delegates to the extracted module.
• plugins/codex-security/scripts/workbench_db.py:L3410-L3417 — The existing inspect-linear-publication command still calls the compatibility entry point.
• plugins/codex-security/scripts/workbench_publication.py:L27-L43 — The extracted helpers receive workbench dependencies through WorkbenchPublicationContext.
• plugins/codex-security/scripts/workbench_publication.py:L380-L400 — Export still returns the output path, scan result, and workspace state.
• plugins/codex-security/scripts/workbench_publication.py:L517-L520 — Direct execution now provides the standard argparse help contract.
• plugins/codex-security/plugin-files.json:L65-L75 — plugin-files.json includes workbench_publication.py in the installed runtime payload.
• plugins/codex-security/scripts/workbench_remediation.py:L56-L90 — The remediation module retains the same state-transition and pending-action rules.
• sdk/typescript/tests-ts/publication-store.test.ts:L204-L238 — The SDK test now patches the extracted module directly while checking native SQLite paths.
• plugins/codex-security/tests/test_cli_dry_runs.py:L21-L25 — The source contract runs every Python script with --help and requires usage output.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-28T21:38:46.664085Z	4f34f29	New commits
🔒 Security Review	✅ Completed 2026-08-28T21:39:45.932101Z	4f34f29	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tiffanycitra]

@codex security review

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: f7b37b25ad

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.