feat(deep-scan): allow discovery model overrides

[daneschneider-oai]

Summary

Allow Deep Scan discovery workers to use optional model and reasoning-effort settings while setup and reducer workers retain the parent scan's settings. Persist the choices for resumed workers and saved reruns, and account for each worker model when enforcing scan cost limits.

Changes

• Read discovery_model and discovery_reasoning_effort from the existing [deep_scan] TOML configuration. Each omitted value independently inherits the parent setting.
• Configure workers through the shared Deep Scan engine used by MCP and the SDK. Permission preflight and worker execution share the effective reasoning configuration.
• Use the existing response schema for persisted configuration and append nullable columns through shared migration 50, including the existing schema-repair paths.
• Carry optional discoveryModel and discoveryReasoningEffort SDK settings through the existing resolved configuration and saved-recipe schema into isolated runtime snapshots.
• Price native session usage by the model that produced it, including resumed model changes, and combine the estimates for the existing scan cost limit. Clear live estimates when pricing becomes unavailable.
• Extend current TypeScript worker/lifecycle tests and Python configuration/migration tests. Document configuration location, inheritance, and resume behavior.

Testing

Worker launch tests verify fresh and resumed discovery/reducer behavior, independent model and effort inheritance, shared permission preflight, and concurrent scan isolation. Persistence and migration tests retain existing rows and saved settings, including recreated Deep Scan tables; SDK recipe tests rerun successfully after ambient TOML changes.

Native session fixtures verify cheaper and more expensive discovery models, model changes during resumed sessions, inherited usage, and requested cost limits. SDK workflow tests preserve the mixed-model total in returned results and saved workflow recovery. Cost tests also cover copied results and pricing becoming unavailable during a scan.

The required portable source checks passed: Ruff check/format, SDK build:ci, plugin source compatibility, and its checker tests.

Risk and rollout

Migration 50 adds nullable columns; existing scans retain their configuration and default behavior. Settings are isolated per scan and saved when a run starts. Saved reruns replay the resolved discovery choices without rereading ambient TOML; existing recipes remain compatible. Mixed-model cost totals retain aggregate token counts and omit single-model pricing metadata. Local execution was tested on Linux with synthetic workers; native Windows and macOS coverage remains with CI.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-17T04:41:24.762994Z	e55b1c2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

The override is scoped correctly: discovery can select its own model and reasoning effort, missing values inherit independently, and reducers retain the parent scan settings. Persisting those choices with the scan makes resumed work predictable even if ambient configuration changes. The audit found no cross-scan leakage or introduced correctness issue.

The remaining improvement is user-facing documentation. The preflight guidance explains discovery_model and discovery_reasoning_effort, but a minimal [deep_scan] TOML example in the normal settings documentation would make them discoverable. Include the configuration location, discovery-only scope, and persistence on resume. This can use the existing settings surface.

Validation passed the executor/store suites and typecheck, 13 focused Python persistence/migration cases, and an actual MCP stdio Deep lifecycle with synthetic workers. A supplemental eight-worker matrix covered two concurrent scans, fresh/resumed discovery and reducers, inherited filesystem denials, and each role's model/effort values. Those tests prove transport and persistence; they do not compare real model quality, cost, or native Windows behavior.

AI-assisted review, reviewed by me. Most feedback is suggestions; concrete behavior issues are called out where applicable.